Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/07/2024, 23:59

General

  • Target
    3b3c66400f4065bc113178a065a42a79_JaffaCakes118.exe
  • Size 332KB
  • Sample240711-313zhasenc
  • SHA256 89701a1f12c5d3dfcb992dbf13bcd487152ccea3b5ea7c753261b04604e8c8cf
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • htnouk.no-ip.biz:81

Mutex
  • Tutorial

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Svchost

  • install_file

    Msnmsgr.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Error composants

  • message_box_title

    Erreur

  • password

    abcd1234

  • regkey_hkcu

    HKLU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3436
      • C:\Users\Admin\AppData\Local\Temp\3b3c66400f4065bc113178a065a42a79_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\3b3c66400f4065bc113178a065a42a79_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1408
        • C:\Users\Admin\AppData\Local\Temp\3b3c66400f4065bc113178a065a42a79_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\3b3c66400f4065bc113178a065a42a79_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4184
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:3940
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:3128
            • C:\Users\Admin\AppData\Local\Temp\3b3c66400f4065bc113178a065a42a79_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\3b3c66400f4065bc113178a065a42a79_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:3984
              • C:\Windows\SysWOW64\Svchost\Msnmsgr.exe
                "C:\Windows\system32\Svchost\Msnmsgr.exe"
                5⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:2472
                • C:\Windows\SysWOW64\Svchost\Msnmsgr.exe
                  C:\Windows\SysWOW64\Svchost\Msnmsgr.exe
                  6⤵
                  • Executes dropped EXE
                  PID:684
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 576
                    7⤵
                    • Program crash
                    PID:2000
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 684 -ip 684
        1⤵
          PID:5104

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 da8f066fef4d345ddbaaf6c0173ac9673af998ebd31ee9fb6a62859e1724ba7f
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 d68cb00d44b500c7e95e0776e180096b5e1f29b18ee81fe7376acf9b457a2396
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13ca8c16914f5dcb7305115c8cb502bbcce844b2240f26138b5efea239fe3e51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5596aeada39b9b15579476c7df9858ce567623e9b54a3a08b27461e9cdc367ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9fa41b13b400d6f3a6b9938e94656291d0adf10a6865bcd30a6625cc26b96f76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 774fc4ea73994f8962dca42d4d97c72ae2bd37c36e510f27feab4919073b0cc7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 752ff7f3cd62cb065176aabb5a3075769d5597ce28d33e073d36a7b022e07b37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dec04d841f8b66685744d92b4cd245746eb54cf97650050ad01c41e75e2a043f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2166e35d3c7cb2bd5248aadee4e061e4fb76035bca9373c9643c8e11369ea875
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2a9d91fb80e73c7afb6852b7c2acb2f5df598d415197f0edbec54a602a19def
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 47ca0da0e2a84b290ae98c20d6055b98ad72e2df90900fc76f1a80ccae9c165c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b875c5742f17e1dfb0fcc329f73ce38353db554a6f93ac3104d2c59bf227cf64
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a5f04fb57b187a7d51f305f04271447cb5331acfc3934a9bde4603932a4fd6b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1fcd6bedeaf58daa2a7f0d63f80de4768dc1005cf843b76487086ffb8fe82b79
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de627da4dfbc9bfc555b1efff41f8c0a3124229981bd00fd191200fe24c8b262
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5cb5ef5b0dcb2e8542bb7289cec10a45de0bf6b0195266d676efe491c6c2872e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 791b31a85f63e4e090b8db22059224051c9ba101ece1fb962edc1a34053ff59e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d88532ede1fd067f51c5a3a0e6f0d79d067a2c7a33bc5a0c2694107e93a555a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0bb3c3b39ec6a596dd91d63e9c6d6976b493e5da39a79170f417a75c1b2fd3e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd9a517d78136a60b9e4823a7e573588d11d98bd27c14d607618f58ea25dee82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 290c04f193b9e626b431574dcb696157f0681f4c52c575171a859f260c69afa7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d0fe7e065d4d2185c5e7ccf26ef77ce07358153250c6067a2a0a63ec3515f24
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70b759c9fb91617c8dc34494fda31bb010757f5fe8c591ec9778e45b140f86f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5371c94633ec2385d397b070559c6e4893ea59b167974f213a7d5236cdc22c15
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a15c78e47d0591debaed1f63cddb4d6961b570a46042dabbf7fe9e746307966f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f364210741fcea459e331d3d1efaeb4ab22c41d3a109cec8d249656857e6e5eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43f2f2f191166c5b78534e6b348e6afc807c36fa4c69d25ab34f5e44d8b3000f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2d7418dade609012bcb974d7e86fe58f69ed52500b16eec9237ba8cd281fa17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ace79e61de3da33e2b5a2f7d6b3ed29d08945ce1e05e26a0cbd0f4d42099f843
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0142686ba1e7824ec880b4f54389a9d3f36662b9bf296bc8ae0e5247067de154
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba5d022412289d317bf654268f38ad24c39138ae95f53c87e340260989636ce9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 104a891a9972253116e0a90c4f35920d589591119e958d2b88f3cb6ebc51127f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1b342b3aee1a32ea0a33ec6e27b1ca1e60e14e02ad9538b1f6c855baaea1f0c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 95ba359c5e2983513f0f4833067863997554568bb2a8cbfaf755709dd4d61f63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 822f68b01783bb3f3bb9bdfb454bd6d0ec31bd0ef56c62fc2f1b9e9103e1394c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 733e0891995c5089268cb9780178b0e156df4ad2fdf9f86b42018d62b01015a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b20e020c3679b9b2aaf39c837d95719991347ca13626470e6ad89e508e7f822d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e92ae7425786f9c6705853e28a18e1028c9d867e8442e3a0fe85fe5fab56b648
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b08f29a47d448037352a042668bb317b2b672e48e5bb157a03f578a8b17101ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d7064bf2de72cfcc7356391af1df143789916fe36f5b8726f987ccbd4d89dea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85b8f5ac1ee2069b0acc21cb5020c7fe1793b8f17e1dc10999c4fa09c40e4f80
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4e4e55a1cf49efce35d0e302b725aec3d576cef38176aa01c5266a6ab2968ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ee6a1d3f1f0ff51c5de754e0d79e585cef75bff84d23fb02c3ed713e5783c03
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5dd3652c9c7995adcedf5fe9ffe1f2096ed60d3f87a8e7231889c6345d266cb3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a5f90897ba6c273a6f17bee0d0f4f7aac08980525d83d9ee956f080ba2b2f52
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f784b842a357b4e594c40490ba2e4d242f4372c2e7e6cc57de8c40acec1cb6dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e15f7bc817e3c3a80621847f6bef535fbe89dce373e607d20bddba098aa46e8b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1307c28dddf1cce7ac4820f18722c7ae087bc524b62e253d14148364ca0395a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8c7baf52d04803d41fb0394a6c90de0009ca7ce765f5192ffba103971a766f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3462767cd6f07c68f9be70fd81cc5a44fdf73c79071b88c46147ac364e60797f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 823fee71292fd9e9bef3d1e2297f0ffd648d66b8f4c1b8364859f781d62ade7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c2579d9ab27e5a6742f78be0341aa869590d29dfc682185725ec0aba85baaa1a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9881b535902789f102b1f880174340f70d06edead91ee7f25aad2f32e028907
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 677afcc56030c61ac2fd5c4b98f7a477b937f425555deeda7a1d751f590e8037
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6fbbea9f803c155077443deddda2f6de39b0089a6b358ac5b297e0c90bfa2cb8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab5c0343a3b625941402abb64031f23eb06f04988d9c2376cccaa0051a52d6c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e007ef47ee3b9fce64dd5d1f6039d6498220291e8a4b959b9c8f689c989bcb63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cffdd06ef9c469959cf3260edde041e067f5483419d4d3fd5e089599112669f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4190fa4d2cfc587905e8ae9f6c905c1df48a22608c847c2f73fefc3abeb0bf29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44dfd2c04c4e13bbcea495d988dd43ab59d34a77f04e76c56cdbebd2e900130a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cfdc6c5ccd0f03b1f01725572e84cd27b85b52423fabeaffc3872ee470bdb9c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94b4705c9ce553786d30ed8e7a214c426c6c25ac376e0663746f0a7ade95817d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0145a7ee1ae896132c67fdf6d8eb983ac9ad8750424b410b9bad9c9f5392811f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d05816ad0c3ef621eccad7f50c12fd22532d0fbc7ad9b5683eebd7df9fa39ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 91623528369851b04777ba062ca9cc7d8222c2cfb9ec5b8908749dbe4a8cc23d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3d0c917881ab468c64c5cee685052f60297eead67c1563459218b8a1273e6bd2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ef089a84ea1477e2d1b879be16cd0e540fd5fb2ff2c6e7f31c072fde4fb6dd6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1cc4267ca929d8364db163f7af193f3673227232bc04506677822ef0c8de7e6a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65d3f8fe45a94c79434ae8dce0e69dc9a0b7bc0a754a344fd9b9208f09b0aa31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd76e808e4ab97d0cfdbca4a53677b85b71b058e293c7665a10470fcce8719bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 006a8c4cf8c0ca97fe5438c84e5d84c0f84efff7213e193879405cc9bc128fa4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e83d9aef5adc1d05b08a346159fdd9f4d15b444812c7154d952ba17146daa09
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 784a65deaac71b86884bd2646f23f5534d5350cbe6b62c7349afb002e16149cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2f552477de623b57fd1e3f9e07c36f26b63789234ce9973c3e847764e73f9b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c58cd7762853cddde6c2935d55bc913fe8bf1041d1a47ddca2d820f13c4c7d91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5830bc8eda1438b3539ae7c6eb335d7c6e9fafba7d5af787b5b1ef19ec5df61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f64ba5b5371158d8745dd66b66804862b06907f15f3a5e6ef4a4fe983e42d25
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42ec1c729c57c9b944845f2e135b97d742c3a4687786d3f3f41c3e898f9fb179
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 767f2ef46a9444807f6bf3845c339db96f6aee28a34113221b03a033260e69ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 783a953a25fde8940349c09fb4bd502f71e0c4d7d4bc69168fd12bcd171d24f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f476d04cf22ce54da61212a607030aff2b434cf5846adf38caccff8e8128b97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b07269ed36eef79769ef5753d6b9adffd45070c1ca4516999b31184b23478ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cea8238546a61d7551a4ffb1cc19f14f7a83c708751ccd272cd0293430c1e86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d78b3a06d23531d1f755433c86dcd91b874faf21f56258328638174f60f4fd92
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a850e09b4893ae61074a184cf2e40694e7166a90bad14c3ca4fcb7e0efe09fb1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d53cd343b22496a7f51805961d20bf2f758251094146310e0d423b653db00f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f684ca57d76dc18748fd85ad790f698a94444bb604952029f9eb94bc3bb0dad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ddba30734f857a3e296b5e4a281ec95073da097cf92f942ba84e330c2e71263
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29da6bae5d30602205e412b12b74c4a4f3d38a597c54c78c73b6c8cb1094eb44
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 45512a7e11005fa3dd5ab55d9c9d741841340b573f5b62621452bea9507fb88a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16e5c5a7b9e2384c2d0b2b4d0dd6e784d268f56c52555937695fc0260dae1ca0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0419f787ec71993ccc8b1b5a6e83931b0750d22a971e28ba5d618327b3af4cf1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dba4acc43682f9f636eee673a7f05be9304e8ea69a12c3d3cd5a37fe374d7eaf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 763fa163ad8136e08b67b76ff3d291148228618f7247418b7729da1f9a218c26
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 99dbc5ee5e4ae6fc76f7982ed2e353f42562dd5bdef8c4ed40cb38a7db3cc645
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad34c86ffdecde4c89b373e40edd9dc299a65b0ca438066c000b865e29e78577
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69eb1d507da8642cf51dbc1f51cb70671959ec5e875ad38c0f23d6df04200f1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97630bb871567168c3fccb4aa687383df9e96ed70775d3ec162a3cf5b4ee01e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7fe1c81e36740f79abb8b248b9e1e2e3eeae0b54f1eb38eaa870c55d140cb2c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df115dbe3bcea3b4b6ff0887fd6b850eb50f50d8762325db273877745dbee687
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84b48c3f925112add07b1db7ce4c4df14cca6636ceb4b7736a799b8e5a2ea961
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5dfc18c63a4ccc48d8d5f6fffd2595585d1620c3e1c694ce5b098dfdeca00665
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9a7e2450aaeaf649dc85d4c73f2d66460a72e2285a0ab123faa5f4f90e63a74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 324cbc45426a6fbe80d9dc388bc23737a588f614143237c95994351bba9f2331
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 513039d05a6b5eeaf2cad6e338b6e6a26e210e6d919b2973ed1daf0f6e2f9036
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc23be92599d7e6c562b3640e77f1b3acf281f37a76c6d443e2379ff5a548f89
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57f5ed2521a982718882f52ba06bdfd8b4aebbfcd1ad8e96c16a8a37c49ba04e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ac4ba94a1993d8be85117b50c8bbdf06d223368f932d351927a9a220b455e9dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d0733f70b8ca0ba8a4a447f6e1106618ef25a4bc2936d24b3eb925de0bf386d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3534e5ec517df4e5f659d5927e41df57c8d1f910f2c1b658664e15eaf8fea53e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b2f2e19bb674098c6bd0c021c69c62f92263f714d6b27d92ab8badf20237925
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd42662fc8a6420d006a6e0e5f44feb73a36975bb11b1c64eb3b26d4c2304da7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e43d6a13e6f013e8e22b9337d57a81ef11af4f9cf31ebdeed301f76ed1bff52
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0ffd898f870e75cd5a15a9cdd8f589c8ec2eb26eb8ed2ae4744e8fe3777c61c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c2660c8618a9778ab0077a50b75655eee48dc8cd96598b0afa1c72384b99d56
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2547636d7d1b76960aa3bf85c8796cf6b5a6ee77cf51a95f66099fa95bd78476
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 90614fa8e915e32e278c0fdbd5d023c8faf064cafd9563baf2ac6d627337ce24
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a47e08b1f83f0b363ed670e64975fd705d2f424b3b8e37e6dc626d53e02ffe7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98abbbfe3cdef3b7ec0bbd920f1fd509a273f0bfe7140e934cc1736b79507e6f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 823f1e835b7f3ada66e28995f89f01e5c9e1d22b3b95e6938c397f76c96e923d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e24ecb578987bd4dccf947624acd3a65fa908c857bd0c7fe5db1a256a83d1414
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd5988f9877cdb7437a23be7d5a947150bab3e8fb2cf931d23b9fc5aa5a0c938
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf8cc25ef963f6b08dfdd6f8dfd37f6bfecc0766da0b5dc85be6a3006f20e919
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ee1ea9a8ee13111c309a5144f58e19fa4e3a1942cd1bc503a6508595b88f742
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af05efad599bb67ac45873c555134c235b268ec9099afc439a460c074f12853b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cec4e4cd7ab68d4992e0a0a4a149e8b8cda91974991d19ef84766c2144b43cc3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8b18949fce1103af3eb900295985088faa9523053ccd115191eaac621ed1b6f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2a7e65b2ce6f19c02df23c7bf97fa55a19f7009f81893feebb2fe1ce2a5df274
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de4ee338f12d11a9c19a913b5b59b2bb31b34d3446d243989bd49b396bf94c4d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9a12cfbc1a0ce353519e2e4b3de737f66764ae633a1109bc1025a6d12a64356
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c944f64bbddcb83be6c2dc839abad4354338ed131e25dab466230a75ddae6cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7cfaacd05392dcb624b36f54ccd6428a9f571586443f5694a6606a5b98c91571
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60ce72fa3f437733e00be7bc5cd5ed69041f2c3ec7f30a7717041f49c9a18ba1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d33b71709b9d207ddd1152c256678dfa003c6c03833b0ede37c38c115c5c034c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4fd242784ab72a6b26603431d2c2751d71d1e1b5fda95e3beb6fae7c931de6f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4d49a448904ccd1fb26c9683383865acceaf547fbdd9e1cc3c718eca5e75976
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3a756af6a8ad1417f65296e93c4dafb291de2cb022d8857bd52f36f52ebe3d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c041fe1e28d2379edddfc2c823b59c3dc703f07ec981d746e62d3d107c5c2ca2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 faa22b211c4061af9a9da147cb585c5987ad65192dc53d8290329c5fe7da2615
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b22ff141d3a33e14a3fe43c2b5ab53f85c09faf43882d33eb2550a89fd1d323
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              Msnmsgr.exe

              • Path C:\Windows\SysWOW64\Svchost\Msnmsgr.exe
              • Size 332KB
              • SHA256 89701a1f12c5d3dfcb992dbf13bcd487152ccea3b5ea7c753261b04604e8c8cf
              • MD5 SHA1 SHA512 SSDEEP

              memory/684-175-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/684-179-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/3940-15-0x0000000001010000-0x0000000001011000-memory.dmp

              memory/3940-75-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3940-14-0x0000000000B10000-0x0000000000B11000-memory.dmp

              memory/3940-825-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3984-1279-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3984-147-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4184-146-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4184-3-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4184-13-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4184-10-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/4184-6-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4184-5-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4184-4-0x0000000000400000-0x0000000000457000-memory.dmp