Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/07/2024, 02:04

General

  • Target
    51090b94e7d3f1bbaa63993ef4a3ab5a_JaffaCakes118.exe
  • Size 1012KB
  • Sample240717-chgqfatfre
  • SHA256 4f75d33ebd5a606d0c3f86c72f514a1f998b45ec6e4b14e4dc5f643ee5245ce7
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • sevdayolu.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3460
      • C:\Users\Admin\AppData\Local\Temp\51090b94e7d3f1bbaa63993ef4a3ab5a_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\51090b94e7d3f1bbaa63993ef4a3ab5a_JaffaCakes118.exe"
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2356
        • C:\Users\Admin\AppData\Local\Temp\tmp.exe
          C:\Users\Admin\AppData\Local\Temp\tmp.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2240
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:4208
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:4240
            • C:\Users\Admin\AppData\Local\Temp\tmp.exe
              "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:1940
              • C:\Windows\SysWOW64\spynet\server.exe
                "C:\Windows\system32\spynet\server.exe"
                5⤵
                • Executes dropped EXE
                PID:312
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 312 -s 572
                  6⤵
                  • Program crash
                  PID:3580
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 312 -ip 312
        1⤵
          PID:4224

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 e11783f603df5f7e2a8cd2633f742ded5cdb4221e22ece01143b05baf02b6994
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 cc41cacf367a2987807132f105a52fae3c12782226314cafb1bf7ec98db1e3f4
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a6c2867b6e8ca2691ba0bc752a0e1720da414e8b82ae43f4955378783bbfd34
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7932fc133a74401e03c52e3008acb807436329def6df5b146e267f10eacda76b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 80f1daeb1cd6dbdb43357e15d1354ab41034bd9ae66a2dec9ba6d8482c0417be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f20f63457f17a0d3390d7c43bc9571226ca45250fb9a2a64180f4188ae56f3c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c604da6720e5bb0eaa10fdbd04b6f7a36c47a6311ab24015df66c8374edcd8d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7c4b60d78d56c9fa3d0df983406b6f119a9baab7f68cd881c7e9e1d1cfdd26f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 055e1f6a183a8696f51aa48a2027ac5df5ec5ded01ffa39b21ea85760e851853
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 291c2e772b4ecfb10cc9d0557806b9425ad1f1d1ddaecbd821235f53c5290d53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b6f7de2c4aacbb812634dd96727297e2b0f8d300ce912f784ae0747ffeee1e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e95a685cfcbbf3d68efdd5225dd25a11e4f84e21595b2f555c179e13b836860
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5fb72753cc942707e15942189c9201bd16572a062e27d305d731668cd08c68b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ec0e7c65b165b58f6b87827face88926e048064229b5727ece97d65ce13806f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf4a8b37a4bea2758219f417f15fd55a56a7414fe29061004ab8f3419817b45c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 339e2cc319c7d6fb490935b8c434b7997ed7fde60dcb52595b123206c856d483
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 00721336d8491e3ff9bbaef082d01d577d4bfe2135e9d413ba703dfa3ac6fd8d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e41e9bdc1a7d730ae3c004f4efa6bdfd81ef50b78d0bfaeb5f524d92a6d005de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1b1857ac7040f38a999e1ba70ca2e6805a24629f3d6af2561679a4738b70cbf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 baedf7f9c983fbcbd62025fb3f8dffea337e3502a547eeea96a05a19be5292de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75a7eecd2855bfcd00f0fe0ab4108eea95e53906888c0aa3a039b6fe04cd10ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2e4918d9835f904067a51cbe6fbfbaac7af26f15749c7dde6da7a6e3b3c001a6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a008df69fae6f14e9d9c061dda7160df25267b4f4361c50183ee4a03cff3d25
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6740167b58cd9b9343ff9b692497dbe9a4a93a86391341a6cb12918d63639927
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a80fcee46578d7b4fefc5b060c6445743570acf1abbd25d414e00e3fde255eeb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2e618a59642be29ed4639cdd1451017df296497179d285b77f9bd745c11caafc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f348375cd41758b56cd3439abf6a6ffd9314fa5f29babe92a527085daffedcf9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 053c0c5628e02fadf8e1689db135a2c0537e936e8e2301474d8b7c8e4168bbc1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22151c4420f45316cca2db3fbdc7b94f71f952d876cb4c17d6128b711a033dd8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e992669cd7f3ee439efc515ca1de5e6a8c4dda742f590393894582392b8f7cac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 471f0f02f62fb13bc6219bf24fc33df4f4df89cf1f22835ba19a77226af09cf2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9d40586c2d5511aadde53464ef0864e87836d1282ba973485d6ea7658ab051e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 007df2fb74fc6bb07a824f8908416d78c1934316d244f06b8ed57d5c74b330e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e27e6b7bbb4d5ffbbbc11061a91f303ec7b81d8b8f18de8cbba5d4366933fcfc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09e2d3bdf8a3a8ee1ccee492618a16234ae5ae290eb6667cc7ef91c689ac26c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b4053116c84abc6cff0304d6e6c2580c73bc7da0cc899b26f83c32fd0b6d6b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 26274683155e2ded53398161c4df175ad27d35d49130e5f40fd346c797b65a8d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f11defd06d6a04d03b1657fda6737188152198eed39fa67467a5c44f2119128
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4bc3ec2f564e0fa09a47001a212fbd91d6ad2edf8e833b1a097d4e2db6c712db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a75ab247a91dec084fcd2804593fb5daa133459e0030c25ee59d0c0d2e3414d2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e7871837385bd7352f90a8513b330348d589898241494661c8e75f5a57da9eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36c0d7fde64345ac82f41a65b2cb2f2156ebf0e74147019bde5de883306065d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 150589c7823a16c42e21dcee9c20f458521746cf082c70c6dd177284f516431b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c1ef5e3851c66524b17926b5c4fe21fc16c3d48196c2b535e9156c698deb509
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bcbdab94bfc9a2a3165cf6d82c463403f51f6688e7eaaa046681fd32b0aaee87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9313e7d7a3ab3e2dc2f7629df46b6590c2cb208175a9957959b0ff312840083
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11768e8de228af76786629026070b29a8929b15efc1ea2c77b22e8ee86a7bba7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4efe97b0a1c209d37685f20e699f074864442121c6f2b8d74341c85a48ce01c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 90da0aa6f894dd9eabc22d3f8e35d7f8c9ffa885500c0fdcc2374ef2ab978245
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 88dc61b1b2cdaff21b543626f5bc2a444c065326b78e458e6e6cb367f258264f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ccf415eb3144c3378851058737e582d89065421bce0ff92b8da6d73ba33ef8f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5b3de90df711b1d9de28a2dcdeb78f1bcc5b971be69a9f338af6774ad5c2fc6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25ad585cd8a60d357f529e1b6bee0aa16353b7ff1b7e13e416b63c1fc3588c95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f77371ef89efc53c24c25f6f98fbca7b944b8409a70a2f50619b0fb169fa360b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5797b476e7b7de929c670190de756b2f0e8b7ab9083eab8171ceb11bf4a46ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69d6cef5ce2c560df82facadebbb24b967aaa2826073c85c3313944b71502ed9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50fcaee94e29b1c1825d16475c19750d05c7af4f4c76b330d3822fd3c393ca12
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ac80ac8d016f5723349f4b67394c38b8dac73555655cc5871205d565c7b18a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85a9920443d4fdeb70d05f611d74470fa1f2525b09d0ee99a7413dac70f9d28c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7474dce8755bb0d39ae98e4a9d2fd82a18e170d3ec21c699552e66b783c6af8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c59da6e5d5e6a74ca327a54e62da25b95031e9773bab7abd78c5f0ed7bdf5f9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 647a796c09a12bed979de97c07228f56b0c87575b112107fdbed3bc8f12588cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 654ccd881b16d3aa63aaaa5b6edc4ba09b5301db2f3bd9774991316867990b1e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 90384040ae3b640ef0d6d5e8a5f5bad55754f2a5a23f043a49234631911f1cd6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93789f3cd832fed5020c7790a0fb05ce5e18d2d99cf4cfec740c2ca6b8cb391a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f506fd8411322402d348a88c9c071e317c8698229c48761205f8eced3cb8b22c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22b4f63bbdd436d805520ec9abb7bed7aa20742eb7b743fa288ce717a2745b9c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e57810b10b6d4735516caafb80ba49e70fde4c841affd96a651b3c311b37ae76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 61abbf6e397a896b46fc63cf7febe27dc0963fad02302155c169ae111bec9eca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 15bda04f3a6ca3bff3bcecd8a913e70039b165a4806938d755f143f75f6e083d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48f190757960c4fc2f9494512cb08194499338aad3f695de4dbc5478ec499339
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f4ea2ad8e16c62c1111c69a92179f4fc82027aabb6eba2714ff46d320749cbe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75663ad4075d3539e6a4c56af5a4d4df1821b9535979dd4e784865d10c265e79
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a6b523aea8304fe8eeb93e0d7cfc206e84dc82b38d9ff7d639fb307ca9d6c5ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 234404be8287fe087117f4b2b5a0243612b490cdc8ea819571e778a20701edf9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ece01f98053b3729c24e4f59101943b3dc31aaea9cf5d5b5d2e962bb592a23ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5d2f504dde94620f5b372b2f095fdc95499bb193e0a68a99b0475682a875c20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2780f2a1e5c03338bb321df3422462f5c5bcf6df8e121ba605d7f86aef8b9a06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a6c83e1d3ec96dee5cdcc6a7bf6fea44aea652ba055c18e13b3438473d03614c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 88f069bd0d2e357a86c745340978c5076c96073bbb19a32eadf5f9d845750b0a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1eb3c59ca33a83dfd77f520da37a9618f81ac90865dff45613a2c6c9dd9f4ca0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a197fa03696a2b9c70596a5577a6421d6767a650f032c98db7e191338f8d4478
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 91e8b59bb73206de5fdf0a5dca3eae266c8f539173a8501d9a4db587db19ef63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a469c76448e052c55063f919e0d029fd56d7a283f70c51d187970c0e0e960c71
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 496273de8fdba7171e1270e9b8155075ce097512a606377db699364ed40117e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7851e7fc312af197f47b1e1cbe08fccf86cadbbd84b773aa723739e626a6bddd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfa6718f57072451a977361bc6c7da3372ae0dd66080f78caa7c9b3dbe9eb0b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 45ac3685621a4faf513392b4becf81889ed11ced1e01f7c478df6f2bac1fe47e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d563a2dbf38a32d1b3d8febf78b0147a879be027d8234163792100176fc93207
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f377336dcfb046e58234cba913ffd125654be3491b7aad75403118a9c677fe30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd3f5628121ab8dcc78941b53fbab4eba247e6a3b929cd35c846e2ef2b3946a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71af196db19f593046f232774cd909b4ae4a07301da2e3a71364ec5bdda7ccd5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 241780c78c628aab40b40f380a81e12e416d7a7d3706345d8e69fbca7c7faabf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f26183c426a76e1106c5b00f587c2f0cfd2dc1f3e71fbbc705a2fb4375341e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1360a213f2467af0d90e476049a0a37d383339794ff74b86bd52429b4db04f9d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 303ba1fe6f04e36c14cddfcea4304a5171d5de21e11e7bc01734446b22a4f716
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a06dff281d798c1ee49985f405811a4d4ab10defee23815f47fa5fa0d15c7e65
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13d6e7897131bf4bbcdfb4436b74aaa773453adf0da53ae508d08878d3eb6da2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a74da4961c68c94d42c5f8dbac154f32479619d118616a51728ac0256454c5e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0f10919abac8f73c6a51a9f98842b649f9405d4f03e682dc03af12b59713731
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c708a5af3dbc65fa49ba337305f4e8e0df82c192563bb9de582467535673130
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55fd0a06105567ad0420d31af0cc3e3428978842f7d454a55971a41c6c1ab9e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4d572961f7d7a94269e05eec41cb406d3b891221d930e578bc0ede648489532
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c036d4458c08bdc17a95ff277a1ecff1b77b64944402ce11701da5a3489a55c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5021d53cfe05d326985af9205f939a6fd091c9eba5fb900e49cd491c9631d7b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7162f20892d3396f1c6e7147b8e2c5d330bcf9d8c4e4374b31733dca71c029e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 301f40fb1f3ff8aa1f184b2f5c9c5e6616d63f48e0b7e0be07eb221acb84950b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd2d829d527a0ce43ef621d627dc93f6ed937fb0a7dc26959be62deef2214b46
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 766d0deeb5462c4556ac5c3f7e822facca427dc8bddbf4bda9751da6247186b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 51cd2fb6b5d4f4a17d118a7a937588ee5d8e8e5246068e757792fd4f888ff317
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ced04ec901df7edd842988573cfaa3d596fd0ec8d1d79e8836245b7bdaa40339
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 613031ce2b87dbcf80ebcbc15bed149b6f1559b27d5dc3dbd5a704c3c35bfa30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d75f966ad0037a81ad2d1194758424e39eb8f343f82598a29127d8c204165170
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb782ffde2eadfddc786ef55c755f84312d7be1bd74f8bd3ccfeb2c711599824
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87966e995c30c686528c8fcf718a383d31a1b533796a40c8fa83afba905c27b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f33131b86b18fa5dcd406f64c22639dd9f61a8589440061423d1579c199b13ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf4acbe6145a84d3821d7360489873b920e3fa7d7eb9c65553aa1f06d4ac1457
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d07cf67508000cf022e2ce318f26d3aea190f3b046c4393c2bb7b752502d26f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4524c88caac432b46a25c3adc2fc4cadca76fc2444c88073cfe6b084c18ec36c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bde3b889149bac5e871077b0f7ad619f3093b8c2bea4ccf85daaf51204f0acf0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f81cf477726159a6f8b6a51367263bb575c977ca6d34f7aea12014db5df5492c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72805b936b519f7f404eabce156f67b3cdb975efdb365d3678ea3306753139f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d68801567bc815cbf51328e5e93b5272d4082127a670edf3122d280586a43e0d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9acf766d63283fc52c47c1e3a2861bfb81113bb3cf9a7017b0b830f380afe6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7251c750250bb186d555160fad1da59334eccf173199b751c52da357404e63c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25e2376fe67ab8baf278ce01b2c98be6e29ddd213a93af733b85660ac3cf09bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4ee76d5ce2c249af646cf95019b94e52709e3d41d6669612e573c89877f7162
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41b992c1323e763f8c2af38b0190d666a42cdf7800ff50582b7a85033ced1e76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ddb2266cf6156200222faaf71acf615e75b8c1695fe4964cd35a1be732f27b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8fbd9802a38edd724bc42f4990f9ba6db0aa1e96eb4fc9e3e25eaee6e9a15e87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a5c419dda97d0447ac5332a73e917ab8921c4a58b9a7a3b112a88b2e62096220
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5fddb982a53d6e6a7a9ba00180ce1668cce4f11bdd881c4b0ee074ec401a2de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e1d64855c67ea791e26db2ebfbc06b989ec9c15e1abf8f6d9bcb6978227a11f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1683fb2ef9e9aad3bb00df3ce3068a3b68f4d947393548f8b9527c1da9895a63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af49d8c756675060a36a382664dfe3bd06301ca3a797f44f35f32983008041a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 945743d664e5a1e8b930008d8393da1bc927ee6f617737782051545a55a8c649
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55509a09df70c4c06c6cc0f6a347ab2b9667bcfb0dbb61acc296c4f57eab3700
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44f439bcecda29559193ea7cf03f4a8862b446e6abba72a118002f2322ac9af3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aade6f1de2e81d5f84192227af1c77e4970d30d2542fb8cb43c6f2033ac69a0b
              • MD5 SHA1 SHA512

              tmp.exe

              • Path C:\Users\Admin\AppData\Local\Temp\tmp.exe
              • Size 283KB
              • SHA256 80fc9430a21c11b00400c2dd6da52ec07d1e7bcd4c8062c7b20469a54c465fc1
              • MD5 SHA1 SHA512 SSDEEP

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              memory/1940-1479-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1940-152-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/2240-17-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2240-76-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2356-154-0x0000000000400000-0x00000000007CC000-memory.dmp

              memory/2356-4-0x0000000000400000-0x00000000007CC000-memory.dmp

              memory/2356-1-0x0000000000400000-0x00000000007CC000-memory.dmp

              memory/2356-3-0x0000000000400000-0x00000000007CC000-memory.dmp

              memory/4208-1024-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4208-81-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4208-20-0x0000000000750000-0x0000000000751000-memory.dmp

              memory/4208-21-0x0000000000A10000-0x0000000000A11000-memory.dmp