Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/07/2024, 16:08

General

  • Target
    581b5c55fe84efb61b26d78e7051e40a_JaffaCakes118.exe
  • Size 1.5MB
  • Sample240718-tk815swdln
  • SHA256 1d05bbf8414da484a4f46d65167ee91f60be44f704413d71cdd5465e054be9e3
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • 127.0.0.1:81

  • ridocsx.no-ip.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    inf

  • install_file

    update.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3532
      • C:\Users\Admin\AppData\Local\Temp\581b5c55fe84efb61b26d78e7051e40a_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\581b5c55fe84efb61b26d78e7051e40a_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2624
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          PID:3588
        • C:\Users\Admin\AppData\Local\Temp\581b5c55fe84efb61b26d78e7051e40a_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\581b5c55fe84efb61b26d78e7051e40a_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2456
          • C:\MultiHack Metin2 V.1.2.exe
            "C:\MultiHack Metin2 V.1.2.exe"
            4⤵
            • Executes dropped EXE
            PID:6572
          • C:\Windows\inf\update.exe
            "C:\Windows\inf\update.exe"
            4⤵
            • Executes dropped EXE
            PID:6632
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 6632 -s 564
              5⤵
              • Program crash
              PID:6760
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6632 -ip 6632
      1⤵
        PID:6708

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            MultiHack Metin2 V.1.2.exe

            • Path C:\MultiHack Metin2 V.1.2.exe
            • Size 844KB
            • SHA256 d058c9531d5a8719ac46ffb6bea295330137f47d797e2299ab2493e91168c8b6
            • MD5 SHA1 SHA512 SSDEEP

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 0158ba3c405b14303aba347a77d1409b7cf3d8ebeacd09f69204f6da58868ce4
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 1.4MB
            • SHA256 200a277dd1f63de821f28c9221db6de8dbfba530f5f385e4ad314e3cb75e16a1
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6b69509f81f53d4c8828ff201ee9016421437d7a1c0a5b9d6af3e20b7e792a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a20d11a3b1c6419efa16f7e308dbce5977df7510c77b12aae858f45746dda6d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e582b8abaa9bae05b69242e85e1aaf38824413221d5421167c4c59788a984795
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 809f43334f3359bc672083a916e15861008a6d67b00dd1288b3be3881596415e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82ab53f633ac79da1e618db6a853e54043927d175a1b131133ec5cac2a98f062
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3912ac6ab3eede09584e8d75fbce5fb1aaaede2180a0905d302faf753ea08f13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce50abe340b96c2d69e570bc308f7ca702da1cf9dcac132840938dd9e5e06c2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 390cf187c82b040ffe58a996f340ffe1143e3427f4212492f2e055271e9102d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3992c54560fbaf5916d62cc987d69d1733400d3e483b144dcc5e4963286093e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3698fbed04945e893f985138c82fea25136b9571ae78b50ac566df9cec83a3a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca4fef2478a612b6feee2e4e3b98f18445fe3fa455b5901ed37565ed713dbe1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72fa5bbb5bd956246c91b2a6ae3f8fc63c2b91033897526ffa34d6fe3836aadb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0050a40ba8c5ced9cddf3e550aebd04dfe47f5f2518d7198102b1cda9b5a9293
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c605dcf92ec119604fe510a63161bcd29809f7a1576b6e2b1c5e034e87048ad4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e4ab80d8ad024760e755049876baf9458166cdea5960f4314b4498f76667b74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2447cd63860173fec1216ec98608dac2eb3e34875d0f520becbc07bfe7484c70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34db54b7560b681a9ca98378494b80810c7cdb9bd3fab43ce9e31f11b9f02006
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 140c0dc0b214b7cda339876629f5e04880bea509b9f9a590e2f1566ffd1be427
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3772f4e75d11de9a083f509fd085763ab8dbd483255eff63fad5d2514f8e4b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4f4de2c12eac44ce16c6df41b1478016856b90bbd4b7337481ad6dbbe305a2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a27819ee17e5bb0618a3f8f2e07471da848bba10a0279a1844dabd3727d3ebe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef262f7310c975432e83131a6a3da18afb106ea08b680bc00cbb9ae8c6240bba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 954c88ac4b02adf676148df9c7cceff36c93e358fa671a961c71d2802fd5f94e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a19de479ed4973370d6d2d890b14a73538a65b18e6c2173762ec9d044f7381d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 377ea2a85e483f74472f50110dc0a9666f016ec0acda735b4a810cc1ebb71da6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26c2808b3ea2c57002aadfe6437e229b6642de7a4f79fca4fa34ea7ef687edca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cc1f35c53113d0983212c2c3f17e2d99fb6e25eeca00b9cfc6877fe2e900d56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34f8c7367355c6a7d7dad5a2eb8595272f1e4e2f8bb684b60a29f54075346238
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afeaa9d0d49d0d0853e764bf95436a10f2ca7bf3c31dccc2b52f2ab2979aecdd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d91e95a6c02d4fecd41dd965e6f014b2cbdf1b55d428709683b5a44073ee6988
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33f87c6c5ea3dcc097401da51e4d16a96ca9095513c97dafe586e602c01dcb24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0baa11b70ac28dde349450c598d17a8bcc1cab4bea2c3ac6b16f27482d3a6700
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d57205dbd8f5f7222a7bc3f79f1dc9fde680ab997da37f197176b250c087af72
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c477305d1eb40c5f9d0f7ee844c69f1c0de90956ae7f6a479a9a8b80fc56b0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 615534cae7078a375920a0d854bef4915d9034662aaac3f5b050eb4281073654
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b61629f5dc7f64ab3a866eb0af72dd829a5f89237cb235b3e773b0a911dbfaff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc4222198a2c4b878529c4a6f628f7893795f8ba6ae424736ecba0fbc1f7078f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48b94a925b021389ce1899b25b326106fb56d6f05394347b890e9827572abd65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6c088b4ea815c58ee9cbdda73a642ab97a818d692c29b5a9ea857d18301d896
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85c554e5456f3ca5b666168723bc3c0ef63e5de59cb14ecb18368648c306d7e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25fcf5f1c7e432db44e2c188730201357382307c6b6d65ea9240a5ee628fe116
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 976c189976f8de0308a6dc9f980d5d4bab51fba1fb8b35ade798293da01a322d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f93bcdc47db66461048f5ec11155c4ae2e72abcb827adbbfeead8488d3fa6174
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b34fc5ff8553b4cc4d7f71288a0dad7686d436b6252829d13cf7eec613b6a50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17b1f063b1fb94decae14d129c14402626dd3e23ab217a4b2aafe9f8e7b523c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76d072da68a6a094d2c369d9cbc15ed6423c259db041875f2af62e0b30bbbfff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76a8ccb376dce33ed53ed8e7bfe4a00fc057b34554c1f14e09fac71d8e810d1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b67bc3340cbe932928ac99250306ec52d577e181e90e59466464bd98dc14d66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44986d3e7c96777be6009c53ba54975ae28f154d4a864172fbf2ae187997f48c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8f7b73d6212ebaedbcf4459238e5a0856f9356fa2b8072684767a1127a9067c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec6f4374c8cf158231b491ddb5d2b03958c54446b90a0698d21d8c753c446704
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d5ab12552ce71ffe79c6e04e89eb40ccb557bbbbcc9bc79d302a698cf685c64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37b773cf7091860873de051d6763d5145e5e373a211310bdac65229b3ecad10d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0105c3ca8bccfc88512eb62d29c2014ad80c57bb931a9ad806df805bd88a63d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f9a74a59ab9ba7c6d446d042e04ea0737c3fe3b9a7c996b4faa3b9fa602cbb9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44edec3cbd2df430eebc0d222899e197ff2d346e7f95695f5edf36e72ec22cdb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f498b2c68fca99d3d67ec87ea53be6948f42993b253192fb1ae6712b7659108
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb367a3d493bdc9f2b7d11e623b8d6a3ad0babfddeffc6a4070763d7399efe0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bdd8e6222a7a379a3f80e733e19c830bd005b58b17cdbd1645c52f4d3ca5585a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b10892db442a76e55b0a5db20410fc0ae5ed50203432481f58d1776c3cd6314e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2c0cf26a646b82cd2b697ae6b364daa3f1d82456acc31d46632bc07b2f912d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9489157d415f760d1f03febd88e2c23f322492b3a2a6f1f59d1dcd388063fbd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6e0f062b536f8ad6e1ecaea001d34c78401b484d5fc008fa8feb7207dbc5e0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 feacc58dc813aa37ce376d6e593caebc5839daef10f00c4e9c20c049ad30fe53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 702a622fb6f4698b2d4e5dde40ba0fb8a90d448a6c1a23c0af4216ff9706443c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b635f4e17925046f7d90c39ec9c7ee3106b3e67f5c437bf2460a0fb8cc80f78b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5f553ae2eb30b00ffd4e8241b93a94b9e32e056b677f8384f9117c637f223bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dbdb631d9e4f12d6abef5710801ce0d41218b42e26c97b4480d6e55276c7b51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f17edcff131cc59217311a4f950fd6fe1d6e127f212c5893abfd1d06120a7d85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22dc2b5c4f2a1f59a878c1f5f2fa1b79f6ef8219eaaa643dcbaafa4ad12ffd61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e7f656d8a5812ba5adebe5c714e863eeff79ab674dafdb1922fee7382ce0e1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b9c45cfde68a0693348332eff5081a4dbf32fbbbb2778763ee39a4c421b8eee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7e0b26aac95a2c52a4b3ee67707bf76a44f73e1b3d176247eb200e43abd6c34
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b8357e73c5518a0210985931ed05324cc5b0b5fd8c767938b8102aa662d0cf0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da7403b1aad0b63814d5f50c108fbc399ce6dca99ddffe23f5f5ebfe08a2600b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1617ea63cd3e341df25d1ac8b6b5576b41b5c5315ff3b84fb1ca235a51126203
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43ab82a743305d88b96e859aed4e408a2e8f3697bf113eea6fefcdbb0c754b35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0904fba0a033e7c1c60a7beebefaf168c1a0ff219e9769301e0dfb54cbba77d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d458522afa6dd58546cffc6d23404744b57590c18610cce8326b862a3a6e1448
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c8d586d751d216de2ff6ad4819fc16a1da819924fcc5204f07d00d36fbcd7f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94b58d05597e93439ff949662671cac3d7aee6813acec42a2459b8ec25b50ff7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 922b0cda4125770293093ef99fdb04a0531dced824cc75e5ac9c2e5c78988749
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1c8f0e9a83f62c7e11f96957d6f30d844250db8f4c36eb916f3afa82493c8c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7ab71340a09ed5fe91d3acb96bfa11dde94f168b2d414c2b431c042a2cf1114
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c3965c75cb6a9cad8abcd8222bc28827dced431ed803210af0048d851540cff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6fad70c60a060998a33a5b4bfb98d407db0af19e37cc71c40ca921edfe1b6b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd71d529d2d0e5c4c8666335def15c77360cacbe95e119a6689a2f6e7ef570ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2d0e79b197f1977bbd0323c88f73426f0a750c7dfb25f0755b3da9f2567e0c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79ca56a5a7a451d8ce1e270507b61a2f571743a1e67b08d2875b3b8c3859ee47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c31fd441a87d12b1b0d1c1d2718e693e27efad3ce2f9c7f645cf77bc315d5c0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18724de3763b9dcac8d2eb3494fbf0ed51185bcba6592be87f4f5e3122f1cb94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93b384b789103dcd06e12e02d94e48eda25f3e727eecbeb43a26a8466ef9a3ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4e40ff22ec9492425a10b96a96155e9a9d57a2bfa2b3ffd55296fdb332b0286
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d199d2041e3717262a9f955cfdb2f0ff475153c276773a3798467c036583dd4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ac36c727748d3a3c94414f389b31caef515a16e9ff54f92ec64deea509e076d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 314703dd95747b2c79232d939be088294515552ac3f7845d3d6caa774f3302af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e344a3aba562b7781769540d4d042de2c88921d2c1c187cdee8e2153b731b08b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38a672801fcd4b853ab4e4f81045103d75ddc57ed0b70379712b5ffff6d966cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19313fbbc8de3f0d3881535545c60a49a6590cdf8a0c1752580af2c1425e8d3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9993da5880f33330414e9a86f5f6556219952782794a1dcbdd454614cd309a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfe3d79e332fe490f65e7e03001231c69bdf2bed4da3abac1eadb88654979250
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21013657dedad6f9d4c69974793ab47e80ee1ab917ae3e9658b29e1dd6cfa560
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 556a9ff3e816d027ea1ebc45c8bd43f7228e9cd65b448fe1f68b51e49d22e054
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3d20432d0ca67fff5f3c99b30bcec9fedfebd28b45b3aa077128d538d4fc853
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90986ea4178fcecc5aa43a205ea4a0e11601965a4e80ecafb56f62dbbe170798
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e692683b8346e18806a4ac84a7f8106f46a70a636892c4ac999f3f7bd730c831
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e9e6dc1b1fa03654a8ff9d9907b3dae9417a6efea54ec1ab851b009c9c2daeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d764f6a0ae055a4ef4247ba896ca9f90feffb66bdf7cf4cd0ad174c6a5bf7af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 124ff709ddfa7b37f99e02293ca8c5440f25fcdb8ce557b5a135732d5a8e6ce4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9609ef73b7158894b57e6a986cae63b8d93d548772386328b09df66afb085fd2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f050d05ce29d9a7bab126a6d880a3ca3a1a6cce0799652b56b2978d6c8b191cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4a11e3058ea0305a54cfc53eb272233873b6abaed3e4fdc73744351b24ffd75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56e2219b85e111d6f4fd60501ea04e8f89e6d7db33cf73704d3edbe30192112c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c59505f283f7a2519d61f9126f6c014688004a75e781d14b1eccd313b759a79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 873ebeeff777634893a4b79fcce69cb9213db4935a0aada1f1f342bb78f1f1f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4878a609a262f4819671c82734be658a3269ce0ad2774f7fb511c30e70dba00d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e5a8dc2f0d81e15dc2927816c4b9609c91329331054e99b1bd56883882ac2b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fb127753bc45792e89cee9f1ecfa8b8a3baafdf6d251d47a2feb806e5ceb3e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55e9601d919c18a942ebe8e537d19b2a4a2998a620245b1e9d77fcba18993097
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f564d84a8056df6058bfb04aabed2b6f77e6f5643f8119fbd7a4203a564c9fc2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3de17b91feff556662516918a29d7844f72187c853273e147b8c34769eaf7909
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53a20696f7128ef46849a85088f5f677739556bbb94ff259a840ec644c743393
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a03ac79bc288d3549a308b20e467d150549fdc00205486bd385a274601a2e8f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d39f121593fef6f8c9d480f5e87b2ac5e5f6d2e31d7b24bbae5f88497b5a1331
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 775616cb059041cfb5eb5bcd78642b377169954ce82c22cd88bdc9f4ea8d918e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cdd70a578fefb4b44288ebf45490b8a5bffcfb5fa224e948faaefc4b94f9c88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31e9ccc5e6cbcc9075e2af016c879945cfd4cd5028ab2d46408281f083c2b945
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d45db29d4795d4152479c55077c36898ad09f0ba4b7842737cbcdf6355c1efe6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1235361b422a91ac2d7869b61cf2d9ad1583de36959aed08b38051a7c27df068
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 359cd70e4e0d098350320e7cd5f25f2d937e4dc267340ddae906d2b70aac15cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0972d127eadfb9bc8b8efcddc236d385bfeb70ea5028510a28e3d481f17b1540
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8b4e8d70eeebe264d30fd9c62e26bda2d5297261fc3535378016bcc7a48de89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e83de7a32d15ee371b4b449bafd1b775149bec553365354a96d07fedd825313
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50747f6650294a974268fdf8f2202909128191fa25a9a70f5b32724bfe5a7ff0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3282d2bb4415b344fcdb5871bada3df58f9608e367c555cfd173f48250ee7d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f5ed6c3f86f1674c504d981d00d9e41ec5af79c0764b6f2b66c6af91318dd54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab54a51a31d60417de52cd641d9bd37a31db15972428275c7db32c0a216b437d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2e1e9c7c4245ec77a441f740dfd2c324c88a39f6d1864fafae6eba924baa30d
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            update.exe

            • Path C:\Windows\inf\update.exe
            • Size 1.5MB
            • SHA256 1d05bbf8414da484a4f46d65167ee91f60be44f704413d71cdd5465e054be9e3
            • MD5 SHA1 SHA512 SSDEEP

            memory/2456-1352-0x00000000104D0000-0x000000001052C000-memory.dmp

            memory/2456-697-0x0000000000400000-0x000000000057F000-memory.dmp

            memory/2456-2522-0x00000000104D0000-0x000000001052C000-memory.dmp

            memory/2624-3-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/2624-10-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/2624-1611-0x0000000000400000-0x000000000057F000-memory.dmp

            memory/2624-0-0x0000000000400000-0x000000000057F000-memory.dmp

            memory/3588-12-0x0000000000840000-0x0000000000841000-memory.dmp

            memory/3588-679-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/3588-11-0x0000000000580000-0x0000000000581000-memory.dmp

            memory/3588-2068-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/6572-1388-0x000000001BA10000-0x000000001BEDE000-memory.dmp

            memory/6572-1389-0x000000001C0C0000-0x000000001C15C000-memory.dmp

            memory/6632-1390-0x0000000000400000-0x000000000057F000-memory.dmp