Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/07/2024, 03:49

General

  • Target
    5eeb31b83fb80bd9c83e47a232c6e4ef_JaffaCakes118.exe
  • Size 609KB
  • Sample240720-edkmmsycrc
  • SHA256 fbc0aed7c1ee2c47d06b0a1b92cf8710a09b4ae1b154fda341b06b9da0434925
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • jemre.zapto.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    svchosn.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3428
      • C:\Users\Admin\AppData\Local\Temp\5eeb31b83fb80bd9c83e47a232c6e4ef_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\5eeb31b83fb80bd9c83e47a232c6e4ef_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1764
        • C:\Users\Admin\AppData\Local\Temp\5eeb31b83fb80bd9c83e47a232c6e4ef_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\5eeb31b83fb80bd9c83e47a232c6e4ef_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2244
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:536
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:5032
            • C:\Windows\SysWOW64\install\svchosn.exe
              "C:\Windows\system32\install\svchosn.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:2520
              • C:\Windows\SysWOW64\install\svchosn.exe
                "C:\Windows\SysWOW64\install\svchosn.exe"
                6⤵
                • Executes dropped EXE
                PID:4116
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 572
                  7⤵
                  • Program crash
                  PID:1624
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4116 -ip 4116
      1⤵
        PID:1112

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 8f17f920809f71ca015e4104e64ddba58adb28255dd68748217112f6ed4136c6
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 7404a05b2984a99b5a810c81c3ca4ef9c397b902fbbb104cf29f06185c164da0
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccc02ea3371fbd234a45ef67c654255db6e281d54d2519a51acf16158c5691b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89312fa7890de9efcdcbfc39bb5ede62dc47daf97efac6efd534047af1f3108d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd1387bbf50c81aa29a8fe9cc3d94b6d9fb4fd0e924fc3eed72b5e9b00ce8351
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 573bbb98641c1e6bec0e5429653abd54df069c7da1b93b7785ab98a69fdb9c36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9eec4f9d1379f88cc8ccdc5eb6aecc72b24143c67c3f547e6d5e6d688a95568b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bb3584ab2a23750f2b76c255bd4e8e3c9b476e061ab68d9552c6a1180584cde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2870b3610585b92dac4495a487e6bac39e377d5b456fc50282767eab41fd9f6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63a83a0524df88add6549bb860bdb521357e143d4c0ce4422261983cd3ff2a55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e895f272e08b3e2eb666894261b063cdddb18052bf91b4f998e76c0349722b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 813266df30b264c029f15e9177e7286fdf26599d1ef508d4054b3045ba434201
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea9d965786c874182c9470b16e4f71b67b4ab0af9ab0cf93002922ba300a442e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76d7af1dbb6c1680ea6b9ecaea660bfad148880dfc889d156bd20d106bd40d70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86cba81a5376e578fee83a2db854856746381f8b7588b3050d316481a3556f91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3999e5f9fb99c86561f30f9112adc6b65acee9265de991c20928a550adcd6d14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4f6cd5bce131efb29b620db6d5b19a2e0e49e1f04b23ddfd9a25d28632ad1eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 498f815ad8959ca440b41f18192bd06eab144a38b911b51272da4919476ba180
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32d026983dc0bdfc37e0c69e4dd9ec10b6d71eb750bc1596b338b597e8da42f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6700bc6442286316d5b8cf21c9ac257aa6d8d1fd172b22f59e999c2c07b76317
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 007a121395067a1c9d83db3e6204384c0f74502ff96dac12b87d36609fe6a9b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7824045a8c7dcaebefeec3f59446ecea456e2ce629a5b3b1b9ccaf8d4dcae64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea36f0631db603473d843f7e4e0b66d6aa2a428df9a455205178c1fa1db5a8eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 698f75b28626f26fdfb5d0824a6dddda6aeb7169164fd2144637c574f8542f3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1051b179bc81da4dcf4f876d69dce73ba066c1fd5add9f25610721d166f5ea6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 652d7d9997f18139be99cd463d0530526e1bc88e0c0623c4919e0d5c223ede30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cce1db6e4c78a31ffb39006e685b08f2720d00bae5bf329041d7c9a6fa5c94f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60c53ff83598764c4ab376231f90058a39ca7e9a688fd69e4d297491f164428f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e319d35ac972d6955707d35b4f36c0fc5e7e79f60cbc3b0c53ceb195b5a263fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ee5970c81c415ad79e2d37adaa1f35c17771bc046a00da0ccb40b2d5ae20a89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fbe4d53e400ede46e1c2c2af12f034747fe6ae2d8a1d4f33179c4dec9f497544
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16cce181b1bf1f4e574d4e133fa15e0da45bcc6aa89a8afdd534d4fa4c93898c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c02d11b1583eaabbf75e12f7cb0b5bd61388c9a1682f5aab0cbc9ac5f9c9da2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04bb28edb10d265128800872004cd9e913bf183ef8e5558ad639dc33eeb8ebad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fca50d050dbbfe6913d21d903dd09dc7a69dc6f3113d089c5d7f675887ef9eee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31ac0424e30c6b1608b89a79d1a71be0d93c77d905f9c60867792c857251d876
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2087db784de7e3716883cf00d6eb21ce2e534e0be2c3ef980839a529adc1a77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6154bc1756c76ebadb80f1b3ad4f27a6fb75f4b0d308d8fd2d2ba6792c7f7c8c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e407c946f667f62993d38285d8422732c3dedc3283906fef6679d65d70537756
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db5e5c3dbd21287fbf733991ab5e5aff84cc350c8c3442b68eef420d0543cf5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6480f67ed918c5eec9ef169f456226d02c306ea7b5609b8b15161a5b6ab9dc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 900592f4b541c379ac9695a9d605cf962bacb96e54d79315b44bbe93b4499f45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad579ee372cd853119b71a201f918dbb0022a77d0787a11c815a0d6779b70824
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4f2c46d8624becf7a0cee9bcd7a0691d1e9cc4d0338513a0cf4c8acdf6de49e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3d3a70b0262be4857db351c87a14fbee58f1e5807b8ed554b1a0ab457dede7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b16b8d771fc8c29ba00a646a00b68c71496daf8e457cb2c14f10ab7f185a595
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64609cdcd7110454333fd275a87c6aa50266b831b11330272b6d41ab7ff73c4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0483938b2bfdd5847bd4e08f4c035bb02c1c1ea41f01cd7e89122c325056205
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba1702ebb3fb921db4f3618a232b84930144938bbdc35670501ca4266ee5efc2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa638b0c38812dfd6e77c6caa642a6d150dd85c74f19560d9885708fa379c1fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d091bffe6182a34f811b43b457e3ccfb6dc7fd7dc5f4a113681421a7e5462e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98b665e9099be3ea634e31067d9d887a1fa9bd90c90105726081c7f3c3552bf7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1fc58fd19682a5e709c4ca38398e3c029ffdeed8a964ee30a2f70da5bcff8b98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d462909f6bd4ff2dd86b52bcfa7c467970edbb33dca18de799468a5e50f634c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6746a0e0f1d9351a4b46439af9823c7ee30276ed6dd236e4e4653b1e88f6a8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 621c3bf73384f44c6b8bc14931e9cdd7bbdb6dbd3e386d52229da4d98241c088
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 286e48b280a88ec577efb2067e10d8372b9d2c8001ad22f8f4f7cedaec8e1d54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c103ac095c0cd97f342e3e0cf87464f85a791a2a2f277d717892d65c5af2114
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c1a90eb8c5c08e755a0024f9e4d42e9051ffcff5d11e313e74727d7058f7c98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3d9d1951aa2f12be8cebb952c6e015a2716c7b77f112a474ff14094e4004115
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 baed6ebf7f797f855070c176af4143903148743b6d0c50e4f5327af91746e6ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c231225c5528c161ec0d74531f6bbcb04ba8f4ee6c9f87928e7749eae5fae66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f74849758b4c7aa387e61f2097bed8bb3502f0c20ab79eeb41f176f3c60747d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2169b78f33f480e9036a9f94b25402ce6634ae9989fe8fae471f83c1bdbc962
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a6b018d7eac76b3bce0bb8672c87e7c41862bcea4e5401b86f1188cb2df82f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e1403474d4182a97773dcfab28e4973fd0340430ff8c8f09235c4d55bae17a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6af3395f2e83245a8730b09d85b02daf13b26bc9f1ffa326fab69b91fe9069ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a89b5fcfa10be3358c68fa0b848f86c20af3ac95bf5798a4e536f1b344d49f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 202229a4b8a337a1c6016b27ca88ac5faa5c79596161ce548eedd1f4dfed1a2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 408867e5c32cef87e3b0581af7ca9ce95ddea5b2cd4e0c7f5b83cdaf5fdce869
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e133543bed9d0bf0bfcd46ba287cb605fadf7d31fcd258df16125e1043779bb0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2f0961c6da0163aa5f1dfb7328d5607d4fe2f703786f63b3eda1c664a7c7e1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5344760b56ae5f61e9df471a420d4336e86859007132faf7e7a186a1e75b86fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52577cb97b4b7c3173a6207d9d78dab180351c97be18e8bfc3b7b8183dc55d1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a869fa0cab28b002e73e73be203cb2b73c840c7a89d0b6a188d18e1a34f322d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f32eb37ebac154d541068b9e0769defbfdda2de56c31048ab16f286f71d71ba8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36d118a629c294d1f99aa4e08fc01cc67e077df71f4107a7f41d0b9d7eec7194
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8093c461798df00c717fc718142f5469979cc512764e8867a81eecbe97fcfbbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1267056ed446f9a1bf6e69a0a52c54f9a64162d45dfdab2fe71f85b4038f3b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f550d0b11e963406e7482b60cc342ddb268fe19f53767ec401c7c81adbe8150
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3446666bf1330d517533dfe40e6fba2cfb581d64955571e5a2176ed947a704be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50332b7d4f84a79c1f87bcc76dde67e1034123a3aa36b0bf88ff1d1c0912f065
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 290802ea2b2786c330732d3a0217c59a2327554fa7ce6dec3d3746d3ea487d19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8161cdd6a8fc2f599a3e348409e0ff12a32df883c8d132c0fe4b72d0be07e091
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa00ad48bdbb5aa0caa0360293c29abdf00915899ec78bed32f7eb70f79a5f28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81000ef135aced099e166a67cd73b47001fb27b5c22d26cce095bacf3003b2f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19b3ff9d9e18a8342f1179d66c8f2f47369e1cb425306b5039cdbe5c9cedf626
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90fa4eb045aa4ce3174c481e62fd571fbd486177d3828c983eb9a4ad0b3618ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8063375daefc5607b87f1e6b232a0ed540fd8bd662228d2fc6d96e0b87918260
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 762897be92bd7581c5db69dd63c37c02a27a529f2dd6a651a716bcf71a798679
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8e0b096ab72b67090486e364b70c97e607b2d59df4995767fb5863a49f8c680
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 597fbf250892fd170824bd7397868ea8a85c97c21b559b963203c18f87773083
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b16070a31cc3008e7432fd07503bb3ad92f32dcea0b1a65e554929d4a29c0d8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60c8ae0b9f738b6bf2d191a506425878c1bae65ba2613624fee241c885bb26d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 555dd4482ba5bbf66121bae5264260a980b137e4ddbd1e0fb5db8a6bb8308375
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea8a03ab88ace7ab3753af447efe8a824f242d0f2f258fa6fa840442e6d1fb9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 562a4adbd6142e9e4bb73fbf8973bae4869ae63290951ea96b7851aaf5bc66e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d17f5fbef1126e90352126be5e6e653037a8d42f399c0df0f7bce2529093e9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac2e454ca4aad76ed543a93c4a2ccf2022456cddf7a6b61c70da17232bfbc100
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ee79597c742d26e3fd4e874164aac8797b8f7b93637803f3020c4fe387f3321
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff6d378448f7eb7668e0db8871e9b828a02dfc21da6ce0aa45317bc84288d255
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02b6c200c8cd5cffa0455fafac22b2f8c2a25e1d4f681ba59e0a55e283748c57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fef67d75f171fa9351d4885483471692dce1e739494a97fd5a88813c615b742
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf79983d950d0f7f3fe379fcddf0e619b3e8f82ac9bde3494389c4ccb844ab10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 efc6794e5dab520c348228e9ce918da70cde75a9af541027058d91655f4ef49e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b2611819f72d487fc6215e89c2c3880ef6136fce9c98462148e468b00509acd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 205ad19866c8336584b3bafd01f792eab226f0a6201d427775e8c43e82213de6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a2fbd8a2dc1bfb873751ca6d2d28013494c48ba5ca981f1fbd1e97863f61da7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9638ad12658512adda5db3f906aeb7b5f3e0a8dce9b97a93491d542c946dee5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5e26132941851cdafe2f881b22c06cdbdaaa59902f11d9b7c0ff61cd090b18b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cacf140f4e6c04b0197c193c617305af10c252fc9a85b4506cbfc02562e13e6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04ab14c1bd3a9da7ce80183df088797ed53745b2905a261fa70b87f914691686
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f49d771889a6a160b805d96f9a6869e59f44e48442bdcfcbc4db53cef5242fbc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9d9d3aae5bea4686a4e00aa17b66c7c9173dac6323f613118d2960e2122e28b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04a0f244f4624da2db2851ebb0c25001fe7ac899085954f244c8f9f1701099b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a51fcaccdbc43f9959bbb660cb46b3e96903869b37224806bb8b10081e4f51e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3676acb80d930846fef7b63fae91106abc9a2a7dbb5f9912432f8fcfa227fe75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39bcdeb6c48b7b6d1154ede4a03b87b6adeca1ce806bf4210bb3d4293a2ad423
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ddb888b4cc7d52e46560163328350996b1f78df75450fc34646e54a18a0d7b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0643f1e5b7a9c49bca4af9b4f9f50fae34eebfa211ea4cac2aa8aa15cf932af2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c5f561b99cf1f3094bc777ed9913572b6c416c0574834d66a76a6bbde4df9d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 644fdf40ba9237f7dfbc43f0498cb16dc57754135a780df384adb80f85d534e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27e834a5df51d27c41f20768272169a2f06101e3fcc4790e44ad17106dc0e969
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23f87a27ce92f375ca1d27cab96ff6fca7345ba5d7e1b22f6e059f452305d345
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3c40fba76e1b1566d4ee5e6381ee95decb1c5383f2da54a8fa3eb34a7390a03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f21a7964e6646e5fe3ddcd55de89b95c8cfe89be0092b6bcae11f36061936662
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b6531cc0b9d66bd3fda8b8f01c7d48d78876515b64225f06cccf974a1127d86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3e3c8238cc765aaae981404119bf453f6fd1c2ec5e0f09ffc93f6769aed1ce2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c77dbe8d45a613dce86686a9fd01392cab42549467df629202223c389c200c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e5d4c259bb93764ce17d8fb43a60dea45e3f16f1dca152b50c2755ebd91a668
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e7845a3a440c4cceaa052ecc51977a029f7a2802d1e50f26ebb16124c3580dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b115ae221b5e5869ddaa8d30d565d6ce424639c750fdcc4e3c1dcc9ac4a26e6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d69111c860333cf3d75dd925c1305e5a97d97973f7e1ae0788d11d836c0b240
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1fa3a554a9b677e2a45534c6b381ee7162337b25a23cb18150b693e409a61c2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f291ed319cc776130a17469d4d74d2f7461e0b5eb0fdab259cb1108975ea874
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3b8389e6a21449a947144d7e78e627bc356391dd9988b5968c0dec92ac213ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4aff3c70098575c595843cc6f73e9c2eff95aa0a4a7fb547f65e31fb24a1b7a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5010e559cfb996a3633b1ad77431bbd577b70f1bebad7550c6318471e74b680
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 542d677e5081ab788c2b062e149ec61a64548a74cb7952573e3d4a48a9388cf3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51ac2a0d7edc0457b3bd064de43ed44a338129d6c9a14f2c1d63ceb9f3326f52
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            svchosn.exe

            • Path C:\Windows\SysWOW64\install\svchosn.exe
            • Size 609KB
            • SHA256 fbc0aed7c1ee2c47d06b0a1b92cf8710a09b4ae1b154fda341b06b9da0434925
            • MD5 SHA1 SHA512 SSDEEP

            memory/536-21-0x0000000000440000-0x0000000000441000-memory.dmp

            memory/536-20-0x0000000000180000-0x0000000000181000-memory.dmp

            memory/536-81-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/536-649-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1764-0-0x0000000000400000-0x0000000000542000-memory.dmp

            memory/1764-1-0x0000000000400000-0x0000000000542000-memory.dmp

            memory/1764-2-0x0000000000401000-0x0000000000406000-memory.dmp

            memory/1764-11-0x0000000000401000-0x0000000000406000-memory.dmp

            memory/1764-10-0x0000000000400000-0x0000000000542000-memory.dmp

            memory/2244-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2244-16-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2244-9-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2244-12-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2244-7-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2244-19-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2244-148-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2520-180-0x0000000000400000-0x0000000000542000-memory.dmp

            memory/4116-183-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4116-177-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/5032-1106-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/5032-149-0x00000000240F0000-0x0000000024152000-memory.dmp