Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 06:49

General

  • Target
    2f5c120914049467b37d3530ea754176_JaffaCakes118.exe
  • Size 1.1MB
  • Sample240709-hlc5batcqf
  • SHA256 18974720856651402ffb8ef67c54902d311b5f3e016c9956cb5544cadaaa45b6
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • darkabuzai.no-ip.org:80

  • darkabuzai.no-ip.org:82

  • darkabuzai.no-ip.org:83

  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./public_html/logs/

  • ftp_interval

    5

  • ftp_password

    Oo52wc4nR6

  • ftp_port

    21

  • ftp_server

    dofustore.com

  • ftp_username

    dofusto1

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    local1.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3488
      • C:\Users\Admin\AppData\Local\Temp\2f5c120914049467b37d3530ea754176_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\2f5c120914049467b37d3530ea754176_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3620
        • C:\Users\Admin\AppData\Local\Temp\yuh.exe
          "C:\Users\Admin\AppData\Local\Temp\yuh.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:64
          • C:\Users\Admin\AppData\Local\Temp\SERVER.EXE
            "C:\Users\Admin\AppData\Local\Temp\SERVER.EXE"
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:100
            • C:\Programmes\install\local1.exe
              "C:\Programmes\install\local1.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4536
              • C:\Programmes\install\local1.exe
                "C:\Programmes\install\local1.exe"
                6⤵
                • Checks computer location settings
                • Loads dropped DLL
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:1792
                • C:\Programmes\install\local1.exe
                  "C:\Programmes\install\local1.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:2444
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 528
                    8⤵
                    • Program crash
                    PID:4912
          • C:\Users\Admin\AppData\Local\Temp\SOFTONICDOWNLOADER_FOR_N-NINJA.EXE
            "C:\Users\Admin\AppData\Local\Temp\SOFTONICDOWNLOADER_FOR_N-NINJA.EXE"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2676
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Yeni Metin Belgesi.txt
          3⤵
            PID:2236
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2444 -ip 2444
        1⤵
          PID:668

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              SERVER.EXE

              • Path C:\Users\Admin\AppData\Local\Temp\SERVER.EXE
              • Size 472KB
              • SHA256 b50a20045df71549cf723c1faf0d4ddab152bd8d07128c23856b954bf6712f2d
              • MD5 SHA1 SHA512 SSDEEP

              SOFTONICDOWNLOADER_FOR_N-NINJA.EXE

              • Path C:\Users\Admin\AppData\Local\Temp\SOFTONICDOWNLOADER_FOR_N-NINJA.EXE
              • Size 294KB
              • SHA256 3f1ec1211a057a6990ef0de796d2bcad79672a2c1a0eccb7ac7e763ec510dcb1
              • MD5 SHA1 SHA512 SSDEEP

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 71efb473d97ca5d6ee6e2943e6c99e20cb7aff5696071e0164ac0284ade397f6
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 588KB
              • SHA256 f84756f7b11a38a53e657e2849b1c20a6fba3bb0e6e61a8413f57c18591183dd
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be416d3005fa3dbdb0d9af939e2f60d59f95f290496d07b1cd7c62f0e411b6b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29a9661992e06de20623f2aeb1e26a1ec66ed9fc38bc50dc594c7dd88cf4793e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77dc2f32c56d941b12c8caa3d74dd0fb088dacc27e55003c372a9504d76edc95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d3075e2bb587ef7cf987d9d1c5531dead947ddbef6f32632fd967a70dd65abb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c69db4cc212a35423d06262ea9d3d3e211b622d0f8b5d7ae6011a51f42cd7e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f198513a8d7133f5b861761be530624f31eb7a1fbcc6bbbd5d15ae9ff40abde
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57737a0d71f3af8d61e8026371bdc7fa2ef05d8f62ee2da8ce5a5f1152f55828
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d85badcd026c3c1559e6cbfda7eac2976f09ee3807b6c7acf7f231daa1583ba8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d66417273ddc16aae318a552307b48b290f80f15a597b4df852816656af13151
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d82f7025473c3b97e59e35c13d9a90b03df121790bbe85dabbda17e9b3058143
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8ebd6de1cfc0f63ac6a3658e71e0d717d6351dc8e27f93042ab7da1414ab97c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7a0ff63442868f1de4bad8e781c0cfab16c357854c9cb91dd686d4e2172baa7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 868288e691de30949e131e7523fd0a7e8f13df622d452cd1ca64e4e8a385c3e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e64e7ee09e84c73e1f732a1f4cd1d65dd3d2da0a6d45ab7fe67ecddd479b730f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 423cedfea8e9317628ebb678412a51f2ad9b0b82e1592425e6f8ddd1d648543d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d14f295657861ea13161b1849a6655b270df3f47897bda0cdb136886cd6d8c55
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e010dd9ad974163f50f4fa9bb37d510972e018dbb40d976a70a015fd6a47b8e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fafa2b75fa1d33e98b026c1647369a937ad54d84f0ded3b0958f6d77a2e177da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b8948cf16f27fe8b9b48fa6d80b4ed3024e0b296ec130e0d7a55d74397554ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a55e7aaed09d5cbbb97ab0fb295846ff5f96cdb0c35f3fc19a57fa3cf41f4ace
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eccb68c8b905ade9c029a6cf900cd8c11993c6f41d1e9abbdab969bd7cca1bab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4f0c4cb9cedb867cd55490dc7de54d5aa98dbacb34569da5edbd1e1d899f5c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1e6f29810029a5989faf98f31e8c32c8a5b4b3c35dc2c8d2994eb2c88d4a4c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 911721181320729de60c8d26df6cd336fe672d0f2a9ef6bb90be14dfab7285d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 691508bdfa267e37494ca680859ed67f7e504cf58748a0f8bf509d6443f4b33e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6347e0589c811c38391732978d1780392df0e2c225c61da69cf23e268f8751aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f752a2d35209443a95717f9bf33d17046143e952c8022b2731f2b9f52b69ffec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9364530351ae47b3d8b5fb9bf5c9672cecbb552e7a4e9a9ade0957a5abfa35f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7d02af3ab7b0361148d7dc0152cd8828756ee19e0c65c9c420e106781615265
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 569343404da9a31f2555c23bb49ab4581378aa79bf869b91ace730fdcf5f4d7c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3f78a6b0965b1d34d0330d7b785366cac2aa34831d85ae0fe5ce4906cad8353
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 99e7a261bafe5ae77b9a2083518e9ccebb17218b2e520d559a751b5d4a4f2662
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c00aac5d8a30c6b247e0d105fa5a5040115095dd70bffb5f50bd791e7932161
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 76f64dc72ed42b369dfa31bec75f6f1ff1aef36049861be537c0a55a1ce60185
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7e55719a0cf71179f61d317d7ef0cc4adce15d5a2cfc27073dd06c892828d12
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48142656c7f3f8786e4c1e7f59c8c6d14dce848f4a6be35b3657b2e28044f8f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0593b7c17cb3f358e052d24f9ed834f599eca099671b3ac98f3ddace43aa3ae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9621d2f1402ab4471532e77a00367195687882cd99b44c3d0fafdeede9975980
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73455f293a6b8262674bdd7ac46e31e198a487c2d56beff5c5f88fa29c774756
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87e659277e3e981518ffd3f01adf6824f617ec550ec4656cce9b14dcede70757
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 76c1cade244cea9a7a11bd10f590a8a5794a7e962f1261f5c037b4937fa12ce0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b57f322c26887106c07617cba27ad6605b1c889c37ecc3dfcf11ce36afc6218a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 224379f9aa4c3e7e0b91ef06ee536c5c10283e207fb0f18decdb7c024c8e2743
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7fbbc0ffe47b88110d2c52daaae90e3441443fb3253de0880103a1b6ee492cf1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 026ba55f09fc1c5b42127dfdb8e1b8106a6e54a3af169fe6d390987c3a63b1b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fea8ee12a6bb153ae21e6c96731e8fe2193d05fc6243b2f0998058cddd2317fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 946e57eded6cb1f067808972329032040d8ba1e8b0c8f6c36a317ea41cdda075
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2f38058c64ae912acbb8da3b48073c84abe72bae6b861b1773a3ffafcefd98c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a63c0f82a753de1e8b0081e9b50f515ac3e2e79b41c3c89b6b9bfcc448b18e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc5e629b87d87dcaf6c815be049db4a34ffdc76eb0570c868733ffd3f4a08758
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b6fd331fc21c0a2f42c0dfaf99f692663b0cfaaa65a3683eaebc22ffd97e768
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6c33abd6f0fe05ad4623edca50d398c725812d5f595c31b9bc622ca9c5be1ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5eae2f94b81ab330eb04d53d012f3fe7b66348b097bc99d0737578eece63ee30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ad8d5c37a9cd91de3bc59e11a292a86698325001ce035667eb8f046303362af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c6c5a266274aacbe150ff74378821f4e174f1f1ad6e01782c6030512e14bff27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9bdffae7661fc7e3dcddceee393d55eb0ef188445f915bbb4774f4a9205e0c36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fed0baee750f87dcde21aa6bdc701f926e4390d7334d69e34fe246d6b6a363b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b4a419c5d8f2bd7cdad3c19038e131f8eff41a8e21a52b1d87228188256be37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7659177c9936493d9ccdfa121339d49ee2b191464966444bc2a54875715bb97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 300d998afc6558928d343275b9dde9ba13054626213acc821a18544ae8b181d2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf40b2abfd63af5c31d8ee6e2838fb63b3045504ad327754bd55c86523687792
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59c00bd0fc9eedc4ce70a5e0a1fa135d10e0105ba1b480cbcbc2d1824a5facf9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 600860d822f80e2b6e451bb9c394b70fa0d280d15f210a2d4bf2849d2ac7815a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17c21aa52bfa189c09489fcd1f6944001fc65829db8237e91b2deeba03a9a04a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf860cecaf39e3c2b26d395e816caa5354a8a5b833eff4517489d1514f5821d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 19396f3b1294146e4dcb4a9576fefa4fe46ec1dfff67913a189a626609f6f29a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4651bacbe1c416120be01906f9ae960b8a574d2f182eb785bb433f03feba02c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 575dec53e32ec346efc40f78a4a4b4d861427d4794d18f50e1890f2d895c6c0b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a889838d75ce2c79ca78a4fe3668f6fa2a36cb5cad14144ce374619040e46b7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 986256402aae7201942f42f694270360d687ee55c5251aefdf6597f5ac9fcc34
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8f5c6d36f04f293f3b56eec5181e4b188e972a239c9941134d04ce6be8dac8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c9e365a2f6c82b39a914ca68daf690639aa5d65b5102e316616da103bd80135
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5d492e1e625db84cbbce58724d2bd5eb7ebea25d0ebd018bcf7f70ec6526219
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c43c26f0587a228146d5689803453718d2b47b4f6cd432683a4393ec2d0ee49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e555e15f9437033d2cfa1ec3ec0ec14977167b72cc7fc08f9487d23037094f05
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6fd46cf1b46a5d04ffee480ab1eafaabc0ca6813a730dfbb9368206505656e49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69133dd19cc5921b82c7b8f74f16e65f4877b7cfcbe3e87bc90685d27faa5cbe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c8d8339502f70eed942aef51f37c2c3fa10bc2239f8c763e99bc0c370eb0883
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e2178d21dcb6a1a90296b0369fc5baa3096ea4b543a9d4bfbe17e16c5bb2606
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f437aded1052908ffb08d1e93a98427b91c330e9313f7e52e2a72dec4b04cb82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7956acd25ef901c50554f47c65fbbddfc7a6b6836f7a1a138aef1a593089dea9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1fef0880b22c00a02c869c25113884c55e2c22e5d33c65d44abacba7e118c72c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 076d9ccfca73845e10a0a238cffb607b0b5de99f56b37d08d678a3831c8e1d28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82923e3d5f7eab01a970cc2a3f6ba53f5bf65fb1a2ce8670d3f4e06dacddba36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d233cc45f414df7023d8da5f35fe036938fe6f6e85acb4805aecff95dfe9899d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1448ac13ad786ebdece1e2258c4caa038c25a5e8db49e955fed58c0b022dc1b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f511f4cd171c083309ded625b5c39508b37a0718b8a472aec0d225446dc0bb8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec7e44eb659639aec777ab332e20a145032c43be517f4b0b7ddf0d7ab02b0df7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df374f0ad2a03a37267de19c40f38b62ff4f984d19db3ed276e1de49167fe6d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e5fff61dea759d3f1d391e257676e971ef0603fb959f4cf8fd516065ca3f21b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4af1adbcf689448983719a609209a319c780404076de51d7f23ecc2a4e16bdb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08338347115ce5ae97d291a6103f8486d349ae1c8a0b9ddff6fb7a51ac5e30e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3be6ff0c9411f1f373ac673b39ed11603b7bc27cde932a5d3b632c24f018db38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe1a062950b82d80fdab4ce8847c1d199cbb1aad9842a8eebc4a47d569c8d662
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dbc7df435098e38d914bffcdd15b59b938e26fb24441f941c71b31e30b65e5d2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53625c3d8a3b7fb492d19688fa11c4cd30c02e17eb30ddc782a250c6c8088600
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a30b5a5d78eb17d2adc5f4b21a113c011970727bf7fb809c27bbe1f0f762352d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a86d8149302923fea2101a07009446dd662a39bc2e5102d6e2e3ef2e16360ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb3979456138b37a0224ffbc76f06dd6ce805b55ac6616d6cb5b0480a2aad09c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d50748341772fd067f187614a3722d39c01ffa45ca52e6232b0a1c06b5af231
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69881b7a2625e47d64209fd229cef9411d9dc9578e5b54d5943e87a6e392de3d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1819fd0d500a0e3052c33974728fd81091e9438a76a21b8718e6481b868321e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d87492190f8edfa91a7a97b5a5aa67f0ab420b45c954ef77cf14e443aa34b4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d3f46a3d487c225c5a0e4492f82ea642e564eb243901898b8b8db0098c4b2e43
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad80bd82c3bb03364342be168301888ee7d5db5889b633e62dd224319f8aae63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f25873afec430f2f9459b2413f2c38a5b6b5ab6b86d8730f739816eba0e7c79b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44dc259cf780ec8c6604ad34c541253a0029986a31295690b87b3b190ae45b44
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd8a468cafc43d449c1108d3a15249a0e1018552b11b2dcd1b86bc212e346be9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3165bab20fd1c89e2521790b7d30619dfea5236242c8b32a1467f5bc29a07d25
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f77d3bcbc339937386028bb3e7a5ffd4f52f2cacd82b1c3e338e10bc2345d600
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33a01347c742f4da20f7d861bb322cbe069744b8b6d3b44bc2ca7f30c9fa44a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba7c674dddc4c4c4269eca6213fe210b2865ea1030395d59211e6b9d86e66c59
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8078f82e7c90cb0b9e407fe46b9f92aab7f5fac637645a2103df85c25ee9723e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3878177645769fc031cc47bb16147a6d62b1c88b109b4733391c94a34d8d3ed3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9088148dfb0c64f1a987f65f15b57cb6020c792b6df55d753b349c6ce1b911c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e861021a1611093a6bd559397eaf32dddffeb49217438ccd9f4367bb788b0bb8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1095b05851599ebc96b1c48755377f62b49258990e3779899ad3df9df8a63371
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 237002c624c890da3a391aeb744e037de8dfd91ec322143019339347ce412f1a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20239b243828df58996d8404b01171839f9d2e1c88b6f6e0be00eebd0d9fffdf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9dc4a6bf41e103df7005c8837600c2c1d7ab73f0b0941197b780df5616746f3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c06bb3e7680695e6e5782c592c4e459283cc3f8ec253daccfd92eb209bd58a20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e4af046ebbf4feae790af4078224d336a00311a1d32a5b8ab3aa458692e8a2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77c096f6a2c4d44cab4619a66b9ef6bcd3219d6ed3d81ee8af33a68ff4e79f0e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 820abc2f8ba245e7117de03f5537fe4b4e4cd1a3ac3f1dac5bf91b2b305f6d0c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bbef1f2b44479ec6d15db535a8f2a228f4e2858d7e3d2e9c6890ece22c5fef77
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2bedf2316e8208bb298557ba1d5988e67de3ffae5d9fb1841cb8106e9244fda3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e4f6cd4b4ff61107899f9017f0c899e01da2bffb6dc7dd27c95ba3e82d9630b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 caa814e4e3bdef87b0a9b02c778b631a4d86dfbcbd72effc1d4916d1ea203f55
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7eb88660c48301ef4a388b103f6d547a03e9b7df03a5bbb63710f7ebcdde8650
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 442872f7e0806e235885ad608dfa72db7cc5707d252e350205a8d0a491df4a01
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c622bc79ac8e86c32c1ae323b8897fe85b831c6706134f30dcf6f8f190347106
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 780117c72b740f5132bb1e34d1dd38f31b73d8041da2079df98222255c5e646e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 669c80f9e13f3e8bab9dd6b1becfc255dca447dbb0226f4685fc717ec2d35075
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb7196fe689f56146eb322f6e0822f0df8220dc59d52d1a4ff135515185befd1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1acd57f94c687eff84d1a577c4b4741467c0d6aca2a20a22de4b283e0fec2cd0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2106c61f899370c24b038d0694ec5a7e3609cc1bb7e911a260076a9dd7202a62
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6fba6921cde578128ee9b6fc023917c93ef7f4070918c0bb1b6944d94ecf5b67
              • MD5 SHA1 SHA512

              Yeni Metin Belgesi.txt

              • Path C:\Users\Admin\AppData\Local\Temp\Yeni Metin Belgesi.txt
              • Size 9B
              • SHA256 c351b34307b7757dece9eea61fafc46c552c35fe599f98b02d3c466c944cf85b
              • MD5 SHA1 SHA512

              yuh.exe

              • Path C:\Users\Admin\AppData\Local\Temp\yuh.exe
              • Size 820KB
              • SHA256 05cdb77731cc6ef9d127647b81950f134c0b55fa66f7240582f2201a33b0ed71
              • MD5 SHA1 SHA512 SSDEEP

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              memory/100-27-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/100-51-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/1792-62-0x00000000001E0000-0x00000000001E1000-memory.dmp

              memory/1792-63-0x0000000000610000-0x0000000000611000-memory.dmp

              memory/2444-756-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/2676-37-0x0000000000400000-0x00000000004D6000-memory.dmp

              memory/2676-1386-0x0000000000400000-0x00000000004D6000-memory.dmp

              memory/3488-47-0x0000000000C70000-0x0000000000C71000-memory.dmp

              memory/3620-17-0x00007FFA74380000-0x00007FFA74D21000-memory.dmp

              memory/3620-4-0x00007FFA74380000-0x00007FFA74D21000-memory.dmp

              memory/3620-2-0x00007FFA74380000-0x00007FFA74D21000-memory.dmp

              memory/3620-1-0x000000001B610000-0x000000001B6B6000-memory.dmp

              memory/3620-0-0x00007FFA74635000-0x00007FFA74636000-memory.dmp

              memory/4536-61-0x0000000010410000-0x000000001046C000-memory.dmp

              memory/4536-732-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/4536-49-0x0000000000400000-0x00000000004AD000-memory.dmp