Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 03:09

General

  • Target
    2eca98bc4ff4cff2734f9f64e3e73212_JaffaCakes118.exe
  • Size 303KB
  • Sample240709-dnh15atbkr
  • SHA256 9422665f22dfa05e85032bbd552c3defbe92e968f508f83a5a056a4b7a322e5d
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • discovery.no-ip.biz:81

Mutex
  • disco

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_file

    system32.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3440
      • C:\Users\Admin\AppData\Local\Temp\2eca98bc4ff4cff2734f9f64e3e73212_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\2eca98bc4ff4cff2734f9f64e3e73212_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3632
        • C:\Users\Admin\AppData\Local\Temp\uncrypte
          C:\Users\Admin\AppData\Local\Temp\uncrypte
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2948
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:4912
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:3276
            • C:\Users\Admin\AppData\Local\Temp\uncrypte
              "C:\Users\Admin\AppData\Local\Temp\uncrypte"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:4868
              • C:\Documents and Settings\All Users\Start Menu\Programs\Startup\system32.exe
                "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\system32.exe"
                5⤵
                • Executes dropped EXE
                PID:1652
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 564
                  6⤵
                  • Program crash
                  PID:2524
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1652 -ip 1652
        1⤵
          PID:1328

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 47da201a463be5eb6d9bd63b8c81d17b191d22d7ceaf5d9e413ac6f6d917c525
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 bbc656b37f15e33566427a89cc401dea9bbb4e6191d1739d631ec456e22da7f4
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0078f8738397c2649653784bad070e68cd43e8adb20ba210db2564acb263c8a6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3fbf47bd6ea1078a913438aa2b793ea3dc87c21a7dbb5bcaeba794ec6ab3a4bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b8a4fc45c904d345e05eab68548ff4810a0863ec170c5a8f80b5f35c01b5a6b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb7317b9ce5c07b921d89e4938b133a989142a27bdaed2b26bcc0c5eaff6193b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 80ce9ac9ab5af2182c74fb3c5c6dde242f3d511bd12ef11aa834ac97184f7851
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d17e9641748b9318341f45dcc8d99ea91c24c5d9aaac8a7a4f1f3e07b16f7abb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0493a35e2f281261aa51a3220299efc84163d1086f2c8f2f86067a99045c2ff0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 99c25c762c84f6ac76360615c5f30a816064415a243b7015674d7817d3a0f791
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b6e35ddbacf09d22efc2aab4ed46326099e7ae28f181e5034e6bbb33bf0274d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1a10d163d7ca6bfe2de9b07ea496ca2c52be925d1aedd65da86560856993515b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf250207e66f83ada9b468eb6b8908cc22a5ecda9586333a95c5a93f2cc34905
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d5ec27a4770b3578e2e4ae51ff189d6fbdc62d34c82e8d0ec4899bd15258564
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de5bafab9233c8268f21ca6d5ad05bf92732e644370328c0e3f1c3a7c219e199
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 627f8386959c25da5e4d8266d84954b7a24b5f1bcdb91c696067c0b03ac0f91e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67df491a038519770b88d6fb2e9452b9a58cf810cf1041d8782e9b4f680a4b7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 51cf6fcb90053513ed1d95243cd96f64247e1c0194b2e9e19ba72ac02af4e1c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ed26127c8e80a72ae2e8d25483315e842b09ad6547bd674a2b6c6cd79d684ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f63549aad41d787f51846c543d8b11242853eeae36c21940655a1c72beaadc45
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aac3b55a5e81499120853b83c7dec8585f95e6f95cd1a75a1df00d16292f7555
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a217f053d495f94e5a7f7f496b185f52b295e711bd7c6088245f8954830464d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e04bb2742db49af0700735c4cd1a59b2696d4856d555036c1b58d64056b94965
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 61a489c5e84f2160d77e1848aac782059b995d61b168968570a9e2812768cdbd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 227eba40d1768d946bdf791aa75b7666331292e4f0e373c2c1fc98b50322675a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e92e8b273470ee92a315d7f3e59293a0206da71a4c4a1404b523df2004709aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60ebeba516b8ff8107693a382d0ea435291d46ebbbba6331e9eaef1034a7b3ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4371304c1fe51d3ca90ed7c87e9a198ce2c323c2c691b1d19e621204c1d4f124
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa429a052f2b8813ebf4a6dbd6638cbfef19d2e5799ace458dec879894fe1f96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25d71a28a5d128874b8a36a95a5c6462ae3fabc235938592d05b062429d0d32b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6736447ba5ec65570a5a410c688799f620fec8c75893daa965573d2f20d56f10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b811397c66f227baa2d53ba361b1b39e27ae92f6a53a19f61ddd9eaa9e309285
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4efe25a29c0d8df617aca61292771a3b40070336cd53b4258e844e07677a2de9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cef5ca33d10933bdd1a62f7084f09aca0db9c9855ffd6818ea1ab76e87aa8b33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf6201405db95686fe1080e0d95121d23d2da13f0b26ae768877a2d702b8a66a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 732ab3042b1e9a39de35039e67f9d34a7c0516d4c8b7533302e903fb32e3cb91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f1d1182f8e41d22440366507da708adbf040f09baeb80e27428a7ea3b9f71e08
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c77c86d59f27c9c316bb2ee4a507a2a311b70c1c9d804f30b61f4689b6fb0b68
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc59f2190163c22bdc0bf49714dc5844373788f536926ebf46ed284d6acb31eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d604133e009f874355de03e9281bbf23a10d1ea2f0284db91d9f52203a928ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf36afe009be07802a58c167f41af8b25641a2f2b99888f2b2249eb69d94da39
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29ecf4337602b8d65fcddae3db5819bb3f6d0a1c4fb8afc06f0c735a43901e51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9ff0710de1e16d059897574bbc6b22357ee70ba7a39e582f90eea4b622ddf59
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c0d2ad02ab3a45d69a67ca1a5b60c9651a3f05b5d9becb86f6669c01dc2125a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6bae7a08644a7c19827fe65ce2c90bdd212e366e9df5b32220df7a2962619b11
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afd22c72ada6a0b5680e0845bf02a22bd0634210af1644c440ea674825ff6059
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f836a270a77cf3ce5f537c45a52208678b8b3fecc56d1f2e1794018b64096fd0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d99acd4bed0532d89d9e4b0d679c403350f8db64ff3d30b6e7dafb39db32034
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab8c81fac622d544c7a5e283783334f0185466fe36b2e73e9b23b98e17974826
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5bd03e056ae6bf07598ef8dc5be7b7907e64a83678dc8b5f27ba611815a2325
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 96bef60af5e98f28591211d2a65febba7569b2e064f33938f0b06a5392a2fc34
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5531d4f54715ca2d98f6b1902d6a8869f23f6f52657a3c6efa9772838be71518
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d78707e4bbaf7534ccf6ecbe7aef12cc7a1e72cb596639cd07ca3c423a021f5b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11fd57c358e1d0cfa12cd0542a597b0c0d6518be353eccde570aed135bbc8e49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 414d6f2b886524ecbb4273266292a307c6791ffefd3d31c47296ff75d7f296d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 962e00ac95da4337fd0168f2075af33c7209572b5afd6cc7e4a5e09bae657e9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d27a3eb14f974fd84cab9f48df9b8fabd2402d8cd875fde31cb07aaa1a42785
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16c873c745f195c9885928ef4bd49e7e242d7d078c861afca1d9acfc42ec9407
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c7afb503478dd61975d1af719289286135e837c9d46075d4d2d4d3f7352279e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2cbbb13d5d43cd9ed672aadd0dc28f5c129cd5ec36a492bb613050e3fb145b2e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a19406fc9a9b7996f5ce5c417fcbbdd3632957ec8e6414f42c87fc411b7ec1c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bee08bf1e3ff1650b3907b65c3f7d4bb41376e7b4224f54df888f90e4edfa239
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5eaefc637c0b87bc9b4e93052a0f6ad2496b0efda392feb0bb8e2caad5202493
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d5b474cfcbda0179ce6ad8c3fe46e08d84edec48870b6a0ca2c19e6175b1978
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5bfcc02a7611bed909a66ffca2621afdfeb1693b54bcb84d95bc43256300614
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5125430ef2ec3ca3e06e121ce052c5ab5fa629d3a90447def32f34fa2a9a177d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a63e92b3fd986a04eac651641f86e368317348ba4add6b94ac6b669b45f7643
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 974f9fec0ab45c3211fc556a011560c5107aad6a7d987315e2b1fcfe9938dcbe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1099535fc0e8e6ddb93c043153eeb07a5edc448c11340c49c2aa3e678c33f6c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b97bc7a7c741cc7e30a7c9850b8d003cfba5cda40ea6bfb14703317231dd2664
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1431bddfd16ac18fcf6b05828231f790217d333d2f8d792a1d5d6930cf98fb25
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cb854434f8b786f0cec6afc0fa75691d24f814364e550993567dc7b10afbdae0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d0a996f5121906695a2a1e6bc41e7ce1064d3c84fe3c653eaa5ad840b52ac832
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 954379c0802ec09bae3540900a08f39fd4d2167a369f041dcb441c1b8e2fe21d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31f599009d9973eb23a6218991a86989d87f3720b6606cde9fa5783c24aabc58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bbd9c76d844d264326364b88ef8bde49296021db2e240bda72596346f2ba05a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f049c0cc0ae46bfc7c9c46f3b1ae6d3d3aed0437f04e9e3f68a815c0c07acf4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d26f898d004e1f092c2500abdfc8741ab002595aa48d96d75bd6c9c9b2d7f3fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c8c3da80c889406081bc8369cd0b7525fefe769b0e5e9f74a38f746edd81b58d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6906ad44c23824ea4b6644bda7f596bfc72f3d6d120491102b192a437b594dfd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43edfade6282eb7e99151c2316bb93aafca4f26ae441a21360543ccc8a3c5f90
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9242d63298af832cca8078f0de6733e01a07bf07b825eb9a68b72c50bf8bf4a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c864d92be4ad89e0fa2b58ca8d10ef2776caaa8709c9b032932311e9dd9d585f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5cb29f375c5f1137f852b8cccb46a4a359d76d1b7f400aa94bbe72bf655df396
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8167e80d63838f6d93e86b7db2a8bb38e9a76ee87012af97d152b934f7bc4a06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e53775d393ad618534cf020af3366da9eea250f88d91c2b05d8b1696c9a1177e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 250652a745dc48712ce71a9ea71c2ce77178a917ac4399b75caf02cd0dd1ed08
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6f14f447e06494fbe442866d5f457011d1c467d3f1da0a45147a77fbe8ab38e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f20d6b08209808894b3b123bafdba94955335e47324d88633c107c6d7c1b08b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0bee3c95a0c160cb52564fe5be430ae90ed986a8531ed4d50d950ddea0670db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c2a4c1046f6d75a858ff0849bba5fa862e3228d81d3774fc69b35e517ff6795c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ece9f157c59b34cbe37117cecb7999de97c9663e332bddaf7a7319be58637130
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78df9fad15903bc0de900f4651903ec267a9cae7b9bbddc119e1a6c8d4ab88ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd87286ff0a3fc44af442d9eded0c594294e7b6728b92aa69e1eb06c9deb2b68
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 283da019210b6f9b18f91500922eccd074261cf32d2b041d755b9a3c5e4d3e4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cad9062d5d75f434a1ead0edd25ef9885bf73ed7faa5da407fedfc6a4184eb1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a83d357e2f51964c22dc77028b7255c1712aac5bc387344064dc3098c626f20b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 066180c2f4d02d5944d90e45aa624fd99ab9cc6c2742b1a32ec29a02a4660847
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 957ac62d8bca6db2bc8acbe1ac456b75daca8db8c329e30f2457eff471f515fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7856efc5d6c83512ff2caadb7b8a0dbdebbef648b30eeee03b69e4df08120120
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ddc1baf1fc417d167342c1eb0e21a943cb2a3135e490af499906dd55ec77ae0d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4cd7f1a839a1df054df24e06c79b01c94bfde9bd696d0b82857386d85b00b50
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af992e070c7ab17a45eaf70265606b9392c017d566b511b4a98c87fcb54a8304
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df72e48413c297f79c60d0f27b7504445519b0430efa73d9789e1ecfe6fab013
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 599b4acb4b9e6d9302cfa68727df092ee5923d3805a47217acd300a1e0d8a19d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 386c195385e1621659ee095ea8e0b6a1940f10162f88734954f64150bbbc81d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dead90ad7c8016d7c10f79b113919c15d53cd5a6be250ddadf5c89a3ca560226
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f58c2c6b551a43e4a51ecd6495567f71fd041b92a27405d207690e3d165bf46
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9c7d84f6e9a5d70d3bf3765cdb969f9a9980e51e6d4dc41cef37a9c6d659ce6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 540e46e8b80e172183d3de6d347071879d6443fd365079a7cdac443d15d64688
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2722238164594defaa67ff85c66fb139e812480fd18b86aec8aede31be5b69f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f6ec1ec0eae8e5466aa786a7280942029fbee0437e76a124d7aa00e7dd8889d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ebda49cf127a460d9c65c3738eb43624bb7ecb9bf3a799509d5d6e0c2b1bd2fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92cd91e3b1908c9d206f1627ba19afd97fba3870c19b254b216ba24b19c3c574
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ad2d7e245aa0e439f8d28ad7e593ffe17aae05538c7d99e7e7f763b1c7f8c3d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d931e056d493bb4dcb84b88949c01517746208318b55942e80300c7887b965ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83eb1423ceaf7620e9bf1414dd56a523435f332bb164963b1f043e049591d25d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 212926ea334231fcddea8a07987dfc9cdb9636c38899c93f157a7c91a2012c2c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 098aafb90bd37ecf3bbf63f6a765ce14d2f046ae678d7ac2e84926ee5dc8b1aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14421bd38339b5df6d70dd07a21cb47b608fece50589ede0c224a72b3c9a0a45
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d25dbe11efde20d8e55e32febcfb3acfa260dee00f5b2db317f52bcb82a1d4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca614fb988381f62b899c1f5b4c43da67de9bda2597fc8b9270ab5d9500296eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4fc0c44c475b5996f57979477a223d9881ca6ceb7f2c9ffad5a7e57cfbd0fa17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c36a30b6609d4abce3928848afd6d2b5d1fa22b2125a2bc1f08fdc320a3eba8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cb4b05bf5def489d82712bc1b0bd21a1e5b486d1be832d6db2bb0231173a0f7b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 400ef373e8d901e14af511f6ebdae016442013eb0503c97d5822cdbf0632645e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf8d82393073df1ed42a0e52282cdbd52a135360f7df2945457ab688818eda81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de76e35cc809f131cf026522f7935bd9b454803bb6fd0b84791880d3d943daef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1ad1a06a1974a74901db87af25cd451385c32461f8b905563a0d1ec93407929
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29337270fcf62abb91374e0291ac86395190568b9e5615adfb71ba15ce335ee7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 493c1bf02198ca65b98a7b02d89b9160df360d09f35fe0e5c708556ce228040f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 349403ba58739db04d69d0f101400a05c1a680ab463d2b09d7192fa47745ddec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8b96d561bfb6e63700430805448497fbb3050a84f9b03dfd7ac29b58bbd32ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a82d69c3ea9657ff7a27f386cfa5b8d7271429584b0e5ec97e074716f4e3267
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e942d183cfe532f43bb2709f54b0c1b62bfdc4fb68bb7df5f311444955a67631
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8237a5fc4fed1a667c6b25af770a43a38e24e5078863bf86ef45945bf9d5216f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0562040564942f23eb5e202bbbafdc7477a166ade31405da5193e24349a764d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 854f8b75ce9836f2b8c1a04bcb54c69c8826df9e1eb2809c0f33119e5913155b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 891cb5062b1fc5bfcfaf20f11d4ff5bc547c69b60252d85a9cc5a1b493567df7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd2ed89e948e28e12ec736730dc0448c85f1f7f5cdf37e4e79b54fbf34871a50
              • MD5 SHA1 SHA512

              uncrypte

              • Path C:\Users\Admin\AppData\Local\Temp\uncrypte
              • Size 283KB
              • SHA256 e830dfbb53a6c5fcd6bb633def54378a3d84e7f112d348759c33f6617010a0b3
              • MD5 SHA1 SHA512 SSDEEP

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              memory/2948-9-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2948-69-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4868-145-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4868-1467-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4912-14-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

              memory/4912-13-0x0000000000C00000-0x0000000000C01000-memory.dmp

              memory/4912-72-0x0000000003BF0000-0x0000000003BF1000-memory.dmp

              memory/4912-74-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4912-73-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4912-784-0x0000000024080000-0x00000000240E2000-memory.dmp