Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 02:39

General

  • Target
    47de61316edbada1711014143b6b1a86_JaffaCakes118.exe
  • Size 777KB
  • Sample240715-c5rtxsthmj
  • SHA256 d86064e831c567c391754d0d4a32b38481742a12586cef34c70a420bddb9f8b0
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • jemre.zapto.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    svchosn.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3512
      • C:\Users\Admin\AppData\Local\Temp\47de61316edbada1711014143b6b1a86_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\47de61316edbada1711014143b6b1a86_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4904
        • C:\Users\Admin\AppData\Local\Temp\47de61316edbada1711014143b6b1a86_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\47de61316edbada1711014143b6b1a86_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3380
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:4492
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:4932
            • C:\Windows\SysWOW64\install\svchosn.exe
              "C:\Windows\system32\install\svchosn.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:4496
              • C:\Windows\SysWOW64\install\svchosn.exe
                "C:\Windows\SysWOW64\install\svchosn.exe"
                6⤵
                • Executes dropped EXE
                PID:3796
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 564
                  7⤵
                  • Program crash
                  PID:2120
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3796 -ip 3796
      1⤵
        PID:2132

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 7dc3556e5c0ece1119329369c3fa7ed864489a44a03c659c184a9ee5b7bd8366
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 21b80abef55e06aeb0ebf1d18eb731fa3ae46777ec77313c06b9d6104944edc6
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f7e74151dee798e9586b7c131661edf986db48b5fb1090cd0a9b588e8194a2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bc3e322d5535c3fc573a8a622f4c6b54fc388b9deabe2eda3b4085a8b5c6dd9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f2fe3005f2601be6c1bb91a3beb2292250c0745a66b19234cbb069e82b3c8f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 858f4714f66a027a06c98adfe6d6cdeb897cc814647c573104196d8ee3cf9a8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eacac110218ab4cc0c881741985ae8e80647ac162c8095ba8424dd2c2f4b31c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3452125b15985e56d634ced289a6d5b36ed3dd784fb2bb841078a98ab46eaaa3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46efd6018fdcdd3005adab4b757d3eac10afa37deb27e564446244c80e20b66d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5bcca969788b4dffc529f749cc20b1185407d904f5e1469e3d17d83b9ae65a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6cf3cc485e2bddbf8c38e662f186f1709c6ee35152fea8ba7b09bfb435bef53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bd0f7a7f2fbb935bc23cb64ff43f2d506533ad245abf5d88fdf7c2105579ba6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 871bf5155e51a0e935a61fe9d40cac783f74671c3c0fff4339989d740853f8ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a82676cd59f44b39eec8250f3a85a8e2f8d6ffef1bca2f3f7562164ec37cd1a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb992329d724fa7dc41246683c21577480c5f30b71f616e3305b288cd1e4fbd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fbe0b9bc36151e8129e6cf874fc30919263cda2313fbb49782ce59525d81ff64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d62dfd02e46140db99875d05d12437312a658ad1c40f6d9e665357bc725fc12d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a66af87f5aa49d0ed640f9389e72a069bfdffba770f0b2503999d787579f19c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db86b80a4b38bab8160ab6b6fdbab3936116e67b9542e56b6bb20558e04b37b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ca52a3e9e9263e1def424d13bf56beac609e9322c509f2fb45d7b0524120b57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a10bd67bbda06e2c172560af0d12f923d81615bdf5114a9036b37ed70fea52bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c609920bf69009382e8ac65038305cbca0da27c8a69549ca3fe65f52276dd14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2ece7826adf18240bd3ffa6d43ab61d8dcb04fd9920718f9777b7853d396d16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3845d39a65fd9e0f40b647127702ac22e5a9f830fa020120e4058d8e03e3ebe5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e718ffdcbeabcc030456c5a1a429e1585174144dcd83f70a4eb571e456f2eb05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b7ced2e2a54c6510986377b2053ce81778c8df382e59de750cc79ae0e9c42b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea4812e6714f02ed0840ef0a51f4b97d74b1c3fed0cd4e880560859255e9b0b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8cef69df76fa24936ac6b906089fc19f70a77b575376a1ad9c4e4e99538b43d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a4b29ac7701f92664a1c6f7dacb3fa3cb9b74029ccf1ab081cc75ad4e0f2a91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6ce60c515cd66c8db96e31d2832dfbe057f0d88602a43fdb5ae1b82418d3959
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5c2adbee71315c7eb28988439fe0bda81118a3105ed6910d5681d0692ccc92a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 035f9ac7484bb3d6a4f03cf0dbb4c19d653bcfaa62572239a026e1af52411706
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1316a0200c1f7d53ac6dfb427e8721272994b2c950c15a5e210ecd2d887c23a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e48b444445c596cb61628da076a6343a79fa71bd0ec2193a0c52940a54d8c1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ccfb572f1d956364e632856c2d2c77c765faf0715d7b16cffeaa29bbef8ab3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52c98573f113cc61765a1896cedb4b5a16bd1e4d86587864b8eeb4004c6aa9fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e6d3bc7c9ee97d55e6acd902383fa09c86a32085a30beeb76260d24ca91de1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 370a9886f7fa0f9bdbedfd933cdd4a1f01f9534e2410b192f0f383aafb1ea8df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30694fb1f530d939ae9cf106ed703c768acd767daef5f93927ad2d6e086cafa3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08047cacef4890e5a7938c502094704ec8e28f2d7e4888eb6e1cd8d8077471fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcea285d02bd7455b91aed1f85392533614c79620f6465f361e081a28e0562fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 002f981b43def3258edce749ae7db0f2b62ecdd1ca5493354e9cf6d1b0136f50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eeb9d7f6b74d054883b5a4dff7e5d83b7ad13db1f3cba751d32d22cf2a8dc7c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab34c65366ee47c606226019b3733ac03aed4fb33fd6df18202cb6ead68336b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24302212f037fe054212e4624aa1cb0a75c1713f866f65d6a7ead40dbbc52229
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f400becf1ca8b17662c7c35cd6c97581ef96c82cdd8b8d12db63fb409a9f0e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5eb40f6c0070332d8d51c45b90365ab5e1520646dc957e5a838d3ab724f97dbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc6db0abfab7840cd50372da58cb4d8a86345aa598f25c2fce99ad840de1c217
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81ae1bf113e49df46d71d76b7991ac121470b0e974367a62aef19871cb2edb61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff6f6dbe00e6da6f4a5991b0e808f7c9cc01b82ad70fcf173a44bdbfbb16eb00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1cb576fc9c3146461c5cd66fb17db02b8846884b9ac61c745570eb392f7adf5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 123d01493b18da0355eb270af96ca4c445c684bf751b5fa54b97823693f9ae93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9a9768c19a2d040cffa46ff6ff4cc459df060ab41db9331832e812c5b1a138a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 896bbfdd14d9b95ed75c648a8542d4eb0d95bdc5204a45e93290a149694fe56e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f0411a355db309d91b65c8afc3f940659a1f1fe87dd487b88b3391d3ccc33d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2de084a3c23dbd3ce3e145bb936f82e1ebcf9ece7c7b19a3b4800b749131cc3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 228903eaaffa85ece0d763edb6d8b116ed86547d8d5ecca77fc03d3ef5903dbc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c084e55cd026d510434c1937513a748186be9570ec03f13acb48fd6102d2ad21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 586495fdb332bd8ea74c116bf29b102171734ca2f74d5e1a9ab9e9edb7031c21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 116afb5d8c8c50507dfc0eaf06d8983a8360ce182c108f3e56bf790cd8467092
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af6a7b09cc523d10f745533b6c5893cc9b0706dc58f086678a3952e32494b76d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8497af8ffe6b4720517c2cf7f8ed0e1b16626edfb8e5d7b671f2221872092fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f402ad4a3938d4cbcbd83f08b68fe689cfcf86bbe5687b2728465f20cadf4c9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4da92272ec5b30cfb992403c00db4fa18a827994f6e7b5f143c37ac4364140a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64970d9530ef293c9ee2d2d22b11a95a66d6403df4153173424c29841f839c7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70ab513ff5848ef88e5a760cff77406484e5487eeaac8821a5a8b7deca2fb4b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dd54cde1679acbcaba926f5d711c7227e82ad5d659371861c12d3601f57bf1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98145d015b9a5abc2eb66383a9544f2812d05cb7e81bc3641fdf37da581f1d9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f9114278596bb9b7f0ab4bf315b5a3324193148ebe5e15ede5361ed3eedc7c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b81bd122711e3f533011a9b2676be48c4841b8002102e16c25e72afe80fdf1d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74645aa4aa03e67ca881213036dba05e19c16a46a54fbc31f8327c02db20b58a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87c571dbe87e19335b0790fc81fad13b95f55787c062a150cd00fd01e921b872
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a8afbaad8b62d04a17ae0ca40de2f27953599450f5a8f2e3048a5d5e8c06cd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 271df148138f584fdce36502bb7abb285fac96d7dc00dd7a9ba672d59be260c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f3dfe792ca6ab3d827ef5fd254cb2314e0483b44ea5449208c643711d93f266
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4c41505624f7e5a51d5d17d9760ee7e612c749fd23b718d8945e448d177ed2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e2cf4d0cdff2ed904994a5124a14047781a4d2cb49399d0a04060662ff90880
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be87d5771bd527303072d1cc70ca53d23ff74d1e6c864a736b6552f5cc88bc2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a9d3496f9c463128adc274be19ae149a4de412ef3201a3ce474d29367a06b61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4814d587d366b483c1722266b5124e3b947ab667a5c8e100cbf14b6a78ef3392
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85b342236c576e375e1cf7376e3e606ac2804727f18a6344d30257d437ebb10a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53ff78ad3441e1b2ef1ca9ed36b7ff29017e64115f182e8de1952b1408cb2409
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f56c86bd83a366f078f5ee0550c5234a7696b708060678e31de25ab73d29770
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88012de8de5a9e18097c61d4177b8d28f6d85e89b7bb503813654e4ba925590d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 298ba818fbfab82d2b2d7de7b4fd9cca0f3bd938f030b9f85c17fa7330d31444
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19ba90e620a4c0500704a86abe14feb63fbe97bbb50baa6e63ee7d2e95b41e7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dde5063d140fac596c0fdf24a1b80c7a71e7d9002ab2fc2629eaaf0827f01a26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 398a45a6a5ba96ec026c9429360356e85e5d27f8716864fc7dff25bfc776180b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d07cf641cc6a947c356428b55b7e437a67567b8a86c1bfd841b4a6e36b3781c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77c1e57c6f9d0c1f1c03338aeaee179779b308040d96a2df330b7bdaacbd8012
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 827da653529aca176970fce759e70e789c855c3d512d4e5bfc5aa9db542eb7d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3093674dac607eadfb51e1546cef1e545a8313c4264d777e3350ef5092f3a855
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a14f6e1a0752bf68129ea1ddc42811e66c161481dd16ef315817c423bfe0642
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd3ebebd21662a74cf96201e7f71b6c959629dbb131003afdf2f0fbecd88b105
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8faadf1f5a4b62e130f6e771db295b87a450d5fc1496d2d31bc0069ddc3c666
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ee3ab9cbd5a980f69f9996a78b7595b21830f8b80ae0db85fec6411983a13d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e7a260e7a5ae5eed7e07caa012ffac904c31a49b0ac82759f6b1166a086ce2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0686d2f43eb765a73549ec0ffbf2c2a9049c3ee95ee6b648941df2ce8ca5ba4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb476229cbff6772a194be23cb75d64fcb340c64ae71c00155a52be7f924d1c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8836275e491f42d8bb1d091fcb7931c5ef27fcbae84552b3faa4aa1506d8c7a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8edc2d7fc462c035a7d201cde2a071838cc2ddade15de192ae5987fab5688225
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 144d23aa542b70b81296f600b8f5e6b3ed93fbee8d56113ae8d67555d0d3ceb5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad0e61a296794abe2186f44d3d84bfa9b637e746bc948c9b8ec304ebf8f18e02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf4b7cfe330d7b2e5394be34528fd953f3d5eba24052215780fbae30051448af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66dd1d63e350ab9a92bd48e10f582f7de3ac9f69405262d7f4cee7282b954f14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f196e809a6ad5e819657ed3b3dfa06b5b4e78b60db4dc53a4fb978c59b2ba7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63e8a28f0180218750d40f8c7607002891326cf71343708582631cd96855e5e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31c836976d3ea202155f2c4a8619a4c6e4165a46cfd806feae90b6a3672d510b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef1bdc5cc179f95605fe1b1b1b5899a453c1d91fb46d8a1c6ae60fee204d60f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 696c0e727efb5db4bb711528983db856002f31eceb2a755c4c1599430b86f2d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fec92bb714cb64669cb5597b3410439276d18d09a29c057816add0b105e8423d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b120dae2bd46de913a2828e7d47083911c77a8e7207571d33fdafec91dd4161c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec5844532e15e3b1048a810e508de17b9d53519d30874fb67722545828c75d20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b217dbc2836d3b77a5ccc81a1897dffd011691a0cc47e62cb5c9b891174f5c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5eabc151257a28d11259d13f3cc649acd7753caf0cf5d223f062d9e0b5ffd465
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c0132ff0d55dbc8521071f417816614319f02ea933b312cf9d045d6f781e12c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 273505054d4fe5aee9e8b9d3957ee50201a47a17c9e676b9a667211013a29cc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 192ee2bfdf48771e6ece4aa06a1ea1a139f5b9e8de02b786153e6c91984dc667
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb311350f11ff6d71fda9c9e6d58c7deaea483aa03c2cf4267f9c92f564fa0b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe014991b4b980226bd8a45743264727d4c5898ee00949f0d88acf5487a21bf3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 310384c5caabbe8d2c1f377f08839775e60ac01515c14576a0acc002f87774e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc587ceaf4b58061bbf878375221276923a358f2f651720ed2f18f9d35174086
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71dadaa646218bc301a63d8a0fd88cab472c5083ce9b2a17edfdbc7ff251d1c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64f6d8286cfebb71c184797099a9225d73cd5c49601f3289f815e38739f8e1da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e9d820f4650ff25db28c6d6bfb359ec58bf9ea9da992be4337a44d040e4699f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59b0490795ae2b99a435cd8731fc7a2289cde0ea2b83209cfe380a5faf438f31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8116fda0877d972bf8c86a45431f2b32a44bc1422e5ff07877ed30a4bb58e4b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9197fc6d237f506f5f6c2655375e76d039f5d8a141912200a6cc3cb6196ff9e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7af6dc58cdc412875994c134d87e167e94ead4a95f7f717ea6ec487045f1a495
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dad117825236ef9ae808a8f75bdfc32f7973985f79c61f2f5b2dc6be8840040c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ee61c1bacb67c55bb9430018bddb5469c2933f3dfbb8116947ee24bb900fc76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5d1fd0c2679e0cb999be46d68724481074ecc36287bd9a2d1accf86001d57d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6fa86975a664c3b60bb23973cd56f403cd6bf68e1b72d9c55272351a95c1ceac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68200e1b261bcd8f156ef67ec3fa7d4c29aff3690595e72b535ec998ea2ae1d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27611a9bb78445b91e4991d655ab9b69811a3d5ddc72edd05899fab17a8f8847
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78e01b90be4ca7e17938059a10738d0a21a95635843bac629aace070e92fe1b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba90294cc93ef661a1cb07652ef7c9421e5ed3218437dfb718a09ba7fa151d89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 956d6ab03c72eda01e157ac1b3649e69db61b86bc8c86c07dd0259a229919d4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9976443ae3042b8ba74f23a98c09bb08fdbb6a7f28b5ac9d0e521e9db6729b58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 393186fc4976c4b4897d61a35ac7e692698841e997bc86c6528a1c8cc96b88cd
            • MD5 SHA1 SHA512

            699c4b9cdebca7aaea5193cae8a50098_1d0c136d-d77c-4455-9382-3336e2df950b

            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2636447293-1148739154-93880854-1000\699c4b9cdebca7aaea5193cae8a50098_1d0c136d-d77c-4455-9382-3336e2df950b
            • Size 50B
            • SHA256 4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            svchosn.exe

            • Path C:\Windows\SysWOW64\install\svchosn.exe
            • Size 777KB
            • SHA256 d86064e831c567c391754d0d4a32b38481742a12586cef34c70a420bddb9f8b0
            • MD5 SHA1 SHA512 SSDEEP

            memory/3380-9-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3380-4-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3380-145-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3380-6-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3380-13-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3380-8-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3796-175-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3796-181-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4492-78-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4492-18-0x0000000000E70000-0x0000000000E71000-memory.dmp

            memory/4492-17-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

            memory/4492-653-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4496-168-0x0000000000400000-0x0000000000502000-memory.dmp

            memory/4496-178-0x0000000000400000-0x0000000000502000-memory.dmp

            memory/4904-7-0x0000000000400000-0x0000000000502000-memory.dmp

            memory/4904-0-0x0000000000400000-0x0000000000502000-memory.dmp

            memory/4932-1107-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/4932-146-0x00000000240F0000-0x0000000024152000-memory.dmp