Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 03:57

General

  • Target
    2eebac6b3171b751befce6f290b47932_JaffaCakes118.exe
  • Size 637KB
  • Sample240709-ehx4javemn
  • SHA256 a9d5b6a08b07bdf2d4e3014c3333448be496a9dd7f8f5dead87cff943a13b5ad
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

  • mahboul10.no-ip.info:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    windows.exe

  • install_dir

    windows live

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3404
      • C:\Users\Admin\AppData\Local\Temp\2eebac6b3171b751befce6f290b47932_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\2eebac6b3171b751befce6f290b47932_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3636
        • C:\Users\Admin\AppData\Local\Temp\2eebac6b3171b751befce6f290b47932_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\2eebac6b3171b751befce6f290b47932_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1008
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:2228
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:2660
            • C:\Users\Admin\AppData\Local\Temp\2eebac6b3171b751befce6f290b47932_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\2eebac6b3171b751befce6f290b47932_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in Windows directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:4420
              • C:\Windows\windows live\windows.exe
                "C:\Windows\windows live\windows.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:4736
                • C:\Windows\windows live\windows.exe
                  "C:\Windows\windows live\windows.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:3848
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 532
                    7⤵
                    • Program crash
                    PID:3440
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3848 -ip 3848
        1⤵
          PID:3448

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 1de1e6957c3b86c4ea8afffc4aaa050b0f554830e8164ce7fd242720ffd75f78
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 dbb8d5fcf870733b2d8c68ac900e726bed0c3646d9ffb94fce167b3cec262513
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f93a11811f9999336cc43c29ee352cb5aa49062b4289565af7abbd278ee963b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1a8068772da44513cf84acf6e7301a23fb7d4cf6b6c8a177fec7735e7b873d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 119777dd3d16a83507661053f5d15d546197adf5a3637a1307e0779c5e2a26fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 91d07c69c5ce5c0f82a7d71d4d00f839a1191b9a31d05d7b8fa7831487764d27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 709c5cbf371ece624ad6ea2dc9bef58fb05dd2c8bff283f771bf286fc827ba49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 37434074aa307e6b766da726faeb0ad5e498b0250d18e53a31499dc3e0528d70
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85e5167c1e5c8ab30ec3acb48d168347b0ea4d3136d1aa5eefe15f1c00202afd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1c8ed124537fcd1103e5118fcffc2804c1ae510436ed603bff664d6203a5010
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1de097fdf4fa413bd85eb8b2f5b2b71ead6e5fbbb2a853a145544399c013438f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38729690df5ab3e4536815912ac783c1f99ef714f253f79a356089193496c2c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bfed8cf319a04a81c2c632cea775aa9dec77716bc6f32d274be00cba058ff568
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b765c5fd7e208ade21d3f32c53074b9b796bd6b6463b928ec954a670a4a13c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9ea625893deef8d1bd3cdb1298452dbc411520542c9e8757fe86a6990702700
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ca9063d1e12d8c8efaec49d1ba982b67b7961f1d08a658e31b9cdeb100f9583
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9fa9ef250104b0775f3dd75250b369fb256012f8347044ee78741751cf7df902
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c248015c19f2aabdb53e0b2f06644faf664cf9f6be58281b7cc39400c6972a85
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4d7d5eea133e33340052ce824581f2f4f846abd0eb8ac6d74d85b89f1a48623
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b5c61540fcd5e3434eb5b1df73fd389a07828d7473e1e426c972ed8c44787ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 800d03a65cbb8408abda374cc9d91c8edfdeb92b8e6f639bb6bd8db39dc41b52
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93eb91d9d5aafeda94a95174b10f2bc9c2b5ce731ab106fb1652bfbae78b5c36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe9aff9410b882035ede392d66449e03787bd107b0e0b6d1cfb3ac9002c3a82b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 39d53704f07b8616e049c608f3a56b968f11db999b19438baac51df61d4a4e4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 496322f0d382dfd1512d8ba223277863de47c4f08804fcc8325d2556aa742f59
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 380292197041b925cdd1409c28dd53dd3adbd2dc8ad0eb3a8578c609396d6e53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 147c0c3cc620f06bf63d83a748f876b08daeffd832e374decd08d6928c97cb1a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e3462020f1516560efdbab4db536e532f6e3abed128d6f46c136605f05ba9d5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef1b31560703c4d28a6c2357be5361032c6379f604329b69225b2130277108f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 021ff566291617d71b0c3ff0e8bd27186fc094dba6cdfaca8fca027c1eda710a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cff7436b40c23241d91ba26554c8ebdf0f0b8335a325906b206f871fb32d71f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 879b5475564e6efa3cc7265ef631cbf23a6b00efa9fd23c5ba24b5c75ea8be79
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e146c8c9e5bd83179dc7282ce05240a4517b78371c128373daacb4d87fa2e234
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e3a3931a96ef7a8166749073c64336d6d3d2bd996d0898ba12cc0cfe854f08c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9091714d51df73cef1407f4979aace489568b5be42f1cdc1c80f5d4243a6de01
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4748db002145a57ffc9f9a01047e7846ee3ea58711998e0880be57b70eaf660
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b8400f662e700b9de200a6aee423316e6199ffbf472978fb92a61074cffaf5dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 81074cc5c1157cbbab9b5bda20e9392a3e33773bd4ebec986a743dd95a2f15a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 567425ad89abe322e8e5a9ca02e84e5ad51584a89fcf400dee54a540135256cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2eb919e9f7b1667927cbfa76faf8d61dfaa9922819ea4274ba43c2dc6c8c309c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3462112d6b0b8ba9269435b4c084f0820810dbb9d2e9a3517464f715898d329
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67a236460fbf63482a893798923e460dcb6f31e40182ae21a57d56ee918a9bb0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d717aafa3711b6c6d61037a91d25fbee7d53f4fd863ac54315355da05c549f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a92cf41c11d2d3609e659a2ae088c6deba40296c232630beaa1e6cfac6b6ebc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7667d6d62a77440f6a43e64ab1caa8f67ee1d64ad5de3f5273fccb90ef2b6889
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa15f5b7aa1e218daa8255847d72582186749b6195c6de7ed6600d7360046a7e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9211543def2533b82e3c70cc0debba766a30279684884ab797b91a2969f4a454
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acd7dc8dcbc78e1de9a83e42ce85766beba5d9b6dd4673cd127577ad7cc798c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ad656f5d751572d916e3669930d9b10bc3c82cca01ce7b78b43a953d8de58a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 329862a2803ae0e29e80ad68292da1b900c0236afd87510a13fe6f6868dd3b30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55292851c1566eea050079563c44416b9c81b25f45169125bf85cc1d2e5a9ff6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e7aa52f29d8599ea25a364ff8b575fbbb057e73a4d80b28cbf2a56b2ee75bc3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 45886c8696d3553cc4779797e4503f7f6323ecb2034259dec8a200dff37ae01b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acc454caa4628200d9f37a00b56a7d4f8fa27043f1c8f44bc61b22db81b846ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e63e49e31ea999eb179a077842ddd0782f0c54e2424dcdb75fda5030cb92c536
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 266d548b04ec62af03af3abda97325a54cbf94093e3aa1128ff18983100a242e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 61db399d8b6d7fa81da0a278b73c4f47938e5cd9c43a8a5469dfe59528ff84c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1340cfb35b29f8acda73962365029f7881bf092de1819ea0f8556c753ff186f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4bb92e4279cff88f52fa1e5ab68233ac53096b7d7c0fd640007f5d384792f78a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3d43d98e86a910095e763bc922f509c9c5602cd9eb20387ea2d3af03d76b0202
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31471d10e6bc6cda6820f13db8885152451e640b6d44f63e0973d5eeb362bbee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12bfae5c7dd31969057bbb0131419d6b90cc5a8c6ee83ba92caf6d84a0690db5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16bf02cf811a8353650e467a385300b2108f5d64d39c96760bf403b2c4950c4d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92a34dac8eb1cb3c20d8251016de87530224fab08e7a764f9d047fb9b0587933
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de8c80116a8d1bf61af7602c8e82b0013924a5a894b62f8458459ce59198849f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 755b51e2f8570a2192a3eb74eea363ba1ce9aa571648df7bfb5d6bc4af61eca4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dad32de2825eb8c74227dba598f84b18ddf7739bc0ac512ba0d4bb88c0a3779a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2c75aad64e32d3834474c15476b175402e6650008e13a854779d109f0ff7c16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e1e96dc156d49ad63f298656b602afb6f93eb4c31a6203c260d0573f2825472
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7659f2dcd578715e81e95688e2151b1acabfe555fc7a4ac4c272002261846d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7c8184cc2a4c9ce426d55bf42a0702cac164f94ca62cee164503e60168d3993
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfe2ccfdad2d53b2840184dc599078e7df5f918cd93c737eb5f6a925ecba987e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72b75c88f0c196eef45c0745611248b698d2f484c94f2b57cb9b1b01fbc7f5cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 49e56d5562b45793a0070bb090aa1cdebfc554428dd9775d2a698d3badae230a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11a00699abe219baa510d76b277b48153b47d6ce47cf1741a611a58063f323d2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d79dbaf886b6863c79a0d5a37a520872ae933972ebfb6e216be6a4db090eda4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33f089d5f67a14668003b0b940cf052296d4c79c8a77868c1842f61f2c28b563
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cfee96f64dce22207fab701499358fc738ed8fe3f826ea9fe41dc5f006ff8f64
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 038d9b916083f818270a997a720884e8367c276c57d513831f6c2f703e2431aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 997561cba609c1f756171adfa15494bfa9db66560346602fe592dba538cf8e35
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7af9c44a0de0fa761cc2f68b12823c94c0c7543a15529cf01d55fc2db18b242c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e81238ecaf3ffb98bd8002af577b59094ece09fe83836a9ce7a0fcc0887ad8cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d71692bfc2895e7d84e182beebb1e1844d62990b5091309dc128a4f1dd4b8f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 950e8adfbe1172324544c482fb16756e646ccaca833f2f9f66e2bae2d0ed7dd8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ac5e3e6ac051cbf9c7ea8aced8cf9df93299a2fedcaf991487841888dca5d633
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c00fe9175886e4a0c775ebb5fddea27189340b042000e8f84d5d8dca70d11b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4193a38a1c7df6676da59d989e35eed3ffd000f8c1904443895166c66067b6d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1047d2a9abacef8c96f3a880f579b3750eec8f353293e44d1868b884e40a613
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c4c54f91577c315899fe26823171caec4f1d816bbf63f27a0ced4429fc697b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad74621f66b9415378ef915166765945357724143b9546327fa1f39437daa447
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 663bc94572fde7eb62885d2489c9f807f30e8e5b7be983fec8830b8d8dc51c03
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ecfee9f4a24216b0daee1fa04a075b35168f886d9629f0035a736036cf72d80f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca902cfdb0d9a1935a8ea5a5ff9f19598048852e48d7618aa088e5bacbbdb6b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ccb4eb677fddf9a3800d73b5184d68d5682192baa3402d056431ca1dbdb011c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 818e3b270362026200cad3bfb6ef8f2ed2ffbdeb0e8ff47d6065764529209efa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e0451a6b7b6aa4409e51bf68014ea44a9d843e0baf89c4d8ba78950d3ec588b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93d4c15494b4b5d2fc0a6d6883a1cef628a308f6c716cd79e3e74e5c884dd28d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 222fbeb3cda4fcd36455469ee8b9abf219851cefabe272ac099302c4e98b3201
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4340432c6dd0071154cf721ec40b2a53296fa947f3e38648370bf4ea360163f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ac63406c8d95901fe2008dc741643d96d02a2a403df90a68f657910a507f5cbc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc877968098e8567fdc80c34c59aa1c2bb503e1cfa4bfbf0b4afd8d930966d63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 555646cbda09b72ebdb5d08b138da371048db065bbd95dab285baea1286555ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9589be5c66f2fba0bea377a92cc1099a0229b2e082757d03fe8196917fe7557
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2b05d30fc0f6ee93c9de8b0527142bf5293a062889617a33706b9e4ce49905a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e6cffdbd6c16ab6805a15a2f8c5aa22fe69feb5104f3de7d7a6df8a342eabf0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d2d490ec3cbc26ca968579377394e09f76c7b0d60b1a942ae0402d6b77a04093
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e02ee3fa8e85c5157bee899d3368d86cc8854d45876d69bbe630c497316b53eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d77c3092f0e9be878f5eef164055550860d944518572706966aa28b85db6e89
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b67de8876ff7d84730e6800771bdab2b2a815d1923c32a8a0ac55dc573a9942f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3471753cd95982541a4b4aa010cfcff0217fa987ac1a9a509a7effc6cfe5361e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bae6c0169e38f050c576249f96a862c29b3756e9576a4d0ee3324305c12ef519
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd8f3b744d1437af7c9ee926884f793efdc1dbacedb29a0e6b4f443397511859
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1a3b21bd09bfce064d7e6f3222c4b889006bb3abb76f80107bd1493272e97a31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 378a6228eb4e645cd58038b72a2260cde7d1b579c28cadc1fbc927fd7d280867
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4595d24ca9528397aac1393cb156ce4f188b8180624dd10f2f7c41e0d0fd4de9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c56e4bdd108814a2f917982fce6da8bf590a843f46e384588a667ef8e463dabd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dcc3efb0a603d8c5a492f66c96c8108de012b0165a86f5b74475fd8c70d77fa2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 101ef8a23942b4d66111b6cc128e7cd30d5427fdecb227024d568fc519556436
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9bdf38ff0ddbf53de99de645e2a46c6a8fbec785aaa338b5bf160d9e8e99b600
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4333c3de64a46876b5a006762f7d4e07898a5b26dde3e48a052990de9b55f187
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 138f23181b8fb5b3bb68a5e8196d1a80c1a5d47a9aab466aada28b591e4b1846
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0bd77ec0eb39133132f04659cd36d61c3edfd3adcb3df41ac4d8b259eb0be5b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 925b5a90a313f1aca7b8ed55fc1e64ccd365403355eb4c0ea43b07dd275b4539
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b62f3ea495ee1fd440f67c96cad6bbbe2d8663efa8ac591b3bb1690515703ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be7882932a77aacaa4e9bb5b9dda840a854ce0bff9164f8ac1671de43efbde12
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9094de10a0e43f2354cb10fda326784baac09ac0e60da737b327feadc8d1416
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ba78026e2bc0e51bf3359a9a94dd9b6078e50df2a6bb87df1842da3fba0cf7d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60b7576df976d99c6b28d75e97ec2053ad690d13c2144902dbb1a2e24dd1153b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f385e3f80b7ad947d2018b54cfcb741a0f94c3b539f697ac2c191d3c54b29c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a49055793dd35a634d971887616bc56404c528a94b0920a770db6f7d77af7356
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3f41701787de0e9aeaf13498869599d35116402b13350073d4419cbd58c76b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40ba26049ec9b6f1261bcef418e7acff34e83c2927e32a03cc8b2b7252c7af58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1523adddb39a233c0887c042d3c4c85ce8801d1a752f2629a89a44c03cec2092
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bfd5f21ccc85a95b7b6c0cefeb0c327b0c925e46874132e00d6367314c785cbf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 018c3dd9a9bc064757ee10164497f60c558f9d1506abee02afb9dc46acb3dfa1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d758cd321a9211ea235b386438546a802a04d639d7f3000f25d52bd60aef4f6
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              windows.exe

              • Path C:\Windows\windows live\windows.exe
              • Size 637KB
              • SHA256 a9d5b6a08b07bdf2d4e3014c3333448be496a9dd7f8f5dead87cff943a13b5ad
              • MD5 SHA1 SHA512 SSDEEP

              memory/1008-3-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/1008-4-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/1008-6-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/1008-148-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/1008-5-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/1008-9-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1008-13-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1008-10-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2228-15-0x0000000000690000-0x0000000000691000-memory.dmp

              memory/2228-14-0x00000000003D0000-0x00000000003D1000-memory.dmp

              memory/2228-75-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2228-814-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3636-0-0x0000000000400000-0x00000000005EF000-memory.dmp

              memory/4420-1508-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4420-147-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4420-99-0x0000000000400000-0x00000000005EF000-memory.dmp