Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 11:04

General

  • Target
    62fa80b136e7caa2b4efe5b3a945a3c9_JaffaCakes118.exe
  • Size 1006KB
  • Sample240722-m6bjfavdrl
  • SHA256 df641ffcbfcbf35c9541cb0b6b6a906ab5d19d0ae4f1299373f5c15d6c84b25f
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • cazador2000.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    driver video.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3420
      • C:\Users\Admin\AppData\Local\Temp\62fa80b136e7caa2b4efe5b3a945a3c9_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\62fa80b136e7caa2b4efe5b3a945a3c9_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4516
        • C:\Users\Admin\AppData\Local\Temp\62fa80b136e7caa2b4efe5b3a945a3c9_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\62fa80b136e7caa2b4efe5b3a945a3c9_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3200
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:3144
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:5160
            • C:\Users\Admin\AppData\Local\Temp\62fa80b136e7caa2b4efe5b3a945a3c9_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\62fa80b136e7caa2b4efe5b3a945a3c9_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:5196
              • C:\dir\install\install\driver video.exe
                "C:\dir\install\install\driver video.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:7148
                • C:\dir\install\install\driver video.exe
                  "C:\dir\install\install\driver video.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:6176
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 6176 -s 540
                    7⤵
                    • Program crash
                    PID:6468
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6176 -ip 6176
        1⤵
          PID:6408

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 089f600c982aaf7938bad50d02499ed216d951abead83ece908ea187ba6e8573
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 588KB
              • SHA256 b74ae071874f4f7a94cd0541f4229516420d4a3142f5a5d286849bc31f97903b
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 528042a8f07edcd02c72866385631da06264ad2f733a4c122a2e632d0fb9427d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70f7edeccaa7ab14ecf997f10bd629ab041aaadc280effd7a6ac4e3a3a821ea6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f300b06306347567c518adf25cb749c91427ccb28ffeb3c0540155da8fbba3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 18d589b637e2fb7e4f767d25219c53b1580dc31bb06ea77e69235e0776051c4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8a6dd411e36c0d72bb1c1f96d010e8b66af7e47f017a28b32b719096a5632e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a67fdcc198c92b4d75692c2808fe5ff293535e0e745b58221fa6b3ef6bd6b85e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9fe8a5421c3bd17df106f57a5cfb222280abc5b5c4cedf6c9a480f8becd20351
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e24e66334bad981514e8bb2a77135be1d040f892ffada20cd496e95cfdda000
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ac5acd33b015a11e5e7302afe78ac010318f93b50c1929d79dcc58517e2d8a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1035c86de83827339d3cfc685aa3179898a0869fd8164168a151e621042a824c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d87cf6b873a972cfa11be92f80991ffdcdb6914e81c650f2a815d1aa7341411
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01c8590f8998f5adfcd3110ae465602f2d90ffccdb99cce40ceb9b71a3eddd20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b78ce4c6f5ba9ab00e327a6583d75ba96a2603fbf915c029b540cdd121a7ba7c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0a57a8224bf35889f1bbb23abf4ed160fe646cc2fb1f0df1f09d6810b9d87c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d52306141629ca62c0d08f26fea67ef5126f614702c6db24150cd1068113509
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b4dff32fb63ec677d11803a9f41817eaaef245b7d85ce474c287d66d6741467
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32753a824efcba1081ddb6114eedcb3d43b734f4257017013eb4fd71c750862b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2567719f5d22b0c6e39dcac8c924b7004fae14fa3b36522b3ddde62f1f72c78e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4d3c76e9ef715c03cf5876de3259e5b3dbd4a919983e617116d8114579f29b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a3a95eab8e928cc1ca75f92342ca3db503ed6092bed47df2a2b747f056b1354
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9ec592ebb73adef480e9c49562d276490e4abc9cf6eaf14f4996c0c162187f4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09d534f6f244a5ba63c3dc200f56cca63da83251fc6ae828a29856edf37e08ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9c843f9be3d43588f144decd205bbc7f4718199088ff23e506d5c811a55a0ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2cf71ad5bc6c9930be6dfa5ff799a8256a5ee7017f2de9c75e587811ad7e8a58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f71ae910117f8e498b3387b5ff7717ae5e295b111f879e3864251e9b3ecba84d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 250cbd2d5eb53e7ee62f6bf8077078a2311cb59afc1c96b2aa8a0edbfb587b97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0d87cf29d2ca94963a8af1d5caa33e449d89a60e1c50fca5f8c87c5d0fa2672c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25683e74e8a3b0aa798904c09d92ce88ce2fbd382ea2538d9c90a00524593cfe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e32476334bcb4c2db7c9f3b20be24454175549b63e608fb834709363530f6e77
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84d021f67d5fb8ba777162ed9dcd0587cc30da4841a2c307a5be174ce650ad7e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2308852e8ae29c6c52172b47d686e88b8bfe1b4fc1659bc4b13711d8a41f22e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 546aae44cb2fed6adad996ec685863d10cd241a23ec7ed6014b6313f709d38f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6959c7dc8287ea44702f8ed37058bea7cc4e0468003a289492700ea2a9dfb2cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a181f6dcea46969bf794e3642e934033aa2915eb747da38828100d97d4f5d67
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8d5031bbdab26abfb04985b9c175b80c0299fdc6e7723e156a26759da635801
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54ae09d04272f5f682a18dd833827c6ebe60a78beb3a51427ab1f83143684b0f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d2e2cebe6686245001a7dfcac24ad995d6a802690f34a4dfba4983b1703d1b21
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7fc95716c364db7f63ad7194972c095c00f42080e8d00e839a1a4c4e651c2b6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef48308b193d65ccbd0d00072ae5c63913811fd5dabfbedd8c2a7c2f9960b3c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 79faa8a246c0ff2c82b79a23d4c6ee9e6a2957bd2768b36f1b5dc2a9aaec19f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9313807c8a150d1c73ec319aa7560d95664588c945892c1695388fcd3b7ffe45
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9be683b1200cbb60b1c375e5d90c57370a98dc0b9731da9ddec01681caa639cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce045f197ae0165e1c1996827485e47101591506e6fcc4b85ff62d99e6807ae4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2be83d95aa63d472d1b00cf94b2bdab0a6703a397459f108dbf13233fe1885a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b76c0b0f1082442f2627f09a2e39c21c0b11be3800cea83bb3e5e880084703e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d8b77d5968b8b2dda3c9b7c2ca25e146be67198aff1b904572d3001e63d0338
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d18c9b9a1288fc9aa0d7f19c7bb4e73d1ee7c953139a80eacbd8416e21d5098
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25c4a9114cac167f7bb71c21a2b51c2e7d5437679cac37e5f7b33d4b22022461
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f7ceec4c831f64996b53484a574a4474b909909421be5f915808357430848a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e84344801045a6456bf938726a2155519fad4dde8e18360b030f95036c620be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 790b0fe1aec5738da3b285e32cf9a3e66790e93f8d0585b6c72654f365d7c77b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c840884914a54fce03eb4caebb10eecad5828370ef01549f2096b2575754986
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 455378c5cc1339b63c305705ef8f7da50252307ed3cf2d55f1f86f3ccaf77465
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7681448474bba88fc3f1eda850fdf4421c496a31fa18284a8df817eeb3c529fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db83fd17b89f06fedebebc4783eff06ba7a8a2c7e5844362e0baf3585d90ca92
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 99817690506298f7c4f0d7694f79fbe93874a4f7959d14c7aefec49c06de6492
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1996a587bb066bd1c0cd70b1b341e67eea510e4c9c08f1e743803dc7270a7a36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad7b1df6407d0626e17f9c1601da92971863f7be69f3ca7467141d13bf75a979
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98dbc8f6615c1d2b64a97670a8a0d68a1a5c64967add3bf4bda8c957fba7109c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cec243002018a7a09a214680876fe9873ff9682d74a5b3b7879f657c6ad799d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 393b0b63957298585969d78ad96ecac547c1445c3281045a883262252f70193d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bae3e99be2c248b4a7f9c7bc864db1036c9c6112b3df85f3827b5c759c20cedd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 95b17a34e6c954fc43562582bc37373c83eedacf8530295ac22b384f6f686195
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24323590dff477e5de47424d8af26a95730be7e6de6fa6374bf37aac3b8b3c30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a041504eb55ea7db50ad2f8093982b74f5e8006a30f7b1297b32127c978247a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9e628be2c0687a582c561e82b0c4d7c2cb07382489f7ecbf225889e66550ac9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44c9e58355265280b0ae2616e3f6f6a32bb733e2f4262b9a55c190037bfd4fa7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce44947faa4afbbcfe6c5a58ef86f9e970454fdcb86c09bc5123bbedf35e80dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bee64061259afccb3799c4ea939c0d1dc8d1d40bd2c3e6ae2848520e8085da30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b538d15e529b6ec4fe92736655d2d6eec54403006549e5fb994806d4437eeba7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d07bc4eb98dd04d4d732b1c4141e7f2dc1c5b9e000d43dbc09246abbeafce272
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e73745d7fbb98fe190d8a30289c2ac50d59f068961666ad11b42e4f6af3db719
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 307ba57b08838b62967d988c33fab15885272bae736ff2cd5e0cced02b25e7ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93438fdf3ad653cb15d0ca6c97d82b92f9a56b1f17b9744462031e6d5a347e13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4aacae6d966917cf36be48f5fba70718e777a3a0c75fcc9d1b3f7dc105daf9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc68d17b81d170d1fe54c1741940d19c0a9ae40d77925d1cd04cb3fe7828ba7c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bfe86590ba7799e2b00c00989fd1a520eac55127ed4e079c1a8f70a415cf58aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97c09de4b9b93882a112b640ef41a5bdc5f0dc5aea84b9ca770fe999b60f104e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d80e3b9058403577a358549cca7064d88ac0ebad77331e44f43a10c259f29e83
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 283a0ccd0bc644944483ef03213d0ae26f1b136fc9b0dd458b4eb25f2f007fcc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8a4345762aa8014b5caee829fc5e7fe88224c68914b021604a09de1060ab66d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2571a8232aba5aefe73776baed5d71d29d82ce758ba8956cffedb5e36713dd5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a19e0b9c2a61ceed2bf79a2f4ea2c59920b5bbd1eb563587ba02009bc26b426d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50176119d1993d319db694ce93479f20beac52edf014d99bdfbfe75b2bd1a267
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa63d54fcf5d11c73345bde0c6f826c6e7a22b8164f7936661a5341d66bbf27e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69b3bf6ea4aaa8cb0d636320569059fb50a6dac2a69082e1e03c62731c60fe62
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b00d9ba4e9923b7d0e07ea7a04f88a9c42fe4729907bd88905deed124973ec5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4b074927d53cb46e474589e999eb74f5fc4d0d502cdc89ae0e233e4d0c806e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3509fe8e6ee76f7aa5db694fa6dd81cd7b6f8f9adf6558737440b1c65051d052
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e15054d0f316630d1157abd2866a68130905178123cd80fd7a5604b8d7be9274
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e87f8d5f3e2750da50521760004188266260c1cc1b6e1a0f0cf354e6253d660a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad748e89239a9e3998d9475a79cbc841df2d2206bf564a110920194e56b85286
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b07bcd0c96f25f86ff9b3a7f9796b6c56e90a721762f0e3824d50769edb327b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59a9f0082953d028337dd5fa07b76b1f5896a3560a452f2c88d76643eb623090
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 585949adb00b1fe0596e5975e94807d4db071e6a9271154fafb3ec30bcf1a268
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4665562ce56ce408e0bfc9679a8350c9a92cc16dd1c14df68714213061794b8a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe394a1ea82d4a14de300039a72ed3430c2daca884f75b6a6a905e5a774dc74a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d2b9895e349ce83da00e7cda5b223e4d3e1a1d5165523cf43ac2610846697c9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c5acfec1560a59028e9f2a899479581c2ac957ac82a38709998e60d46cd41ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba7f7a362905b2cc9d5f82e12e6af8952a92e3c99a2b485842524a57e213bfe3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fbbc33cad5068bc3ec528a57cb10f7e4d9268d063ed6bae004317a97aa49e189
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 18f76beb34bb9ac280b95b3adb15977e617d4793065ceb063710e5862e7683d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f2f03b1f37af5daea2fdfaae60f3293275982fa1a0f795aaeab7197117ceebd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d469d1c751611889b7f10bc1cccce6b01167d3efbd1435c7ddc6d6587fafeca3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25cb470e6873f27480bdca4f244766eca687fe0cf4678e41d8f47e3e6700e07d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6694403feefae2096c6cea936de5119d9d1c75c0ca755a2fdb7f399d76eb19e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10e17d9066c37ba5f210d2b06da04d27e56262c32a67a986f39675e6178e9e95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 537fc002b2b968e6ac10dff2326deefc46df086b87b544d73bfdf9ad06b0b396
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 213cd9dfa848cd46c3b9f808462e8146acfb1d55dfa5bbbd64645bb615f0fb87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a6e894e9185ecacb250379ed803d9000af7dc9ebf41f82799184001a34d4f58a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 734b5baf9380b53b9f0b56eaa0049f1ed43cf86e6642e50f1de724183485b99f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43dcbe4b19224374650b22a50f814e465e85b08c9b0d9c23aa45865757f0ca36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d010e4f22551008b191d1d6f9b6e6287e82e3d234704080d48d1c2499ee35f2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb81b439cffcc01fa0178e360ee1474813a799544847fccee8d83344575362cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e87322de91075e8c15a19f63472b5a8a2b33dbb2653cd30f248f610b73982f4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc8b4381aeed1f69863125ad2c75cdd78ff89975d9960fb3998e9fea2adc45a6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df4330de9ac6a180afa118a8c83ca0b2bd836945f9cd225294b9df8ff5610390
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e895d5d71c502a724858e54e4b153f36a544c7e75f5b9771b4d3e0c34cbda23b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12a38a185f14d92dc30a97a46f6c090b513c1884e1b7dc398af4a47c9eda90a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1a7d37c7f83318566773573a80606000b4fff6bb06a55699d7ee1d443ecee698
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa37ee5088b2f95c4371f0803500126cdcc18f0462cac546a95e61052a382323
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44037687a797d0e20453b3a0f5cdf592bb06e67fddab758fb0ac7b49861394c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a5ee2820ef14e8b2eeaa8b8f807e4827321a341d58b56eac903a99a76e061cce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 00bcb13810d813cd3932ffab6779d8b9dc2af35f8a43ddb4af04c45933a11644
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63d7cb5cc6fd73a0d1fa7fd2da6052907b64bb1381523215015b378e845e5ea1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97e73bb184536ea881a6ddfef3456b13de6af810392b3473d37f18b3ad91f488
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0af884986256857e82c01f096d124b1af25ce3dd621efee125d65e7dd75f864
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f09440edb1a414608688974951d527a80eeaceeb9cb9133413d9b7bbb56b4a47
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0a17a626baebe2499089182935dc606667874f62ee9aa92b271e59bb7ed4267
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cbcd90412f179ec6f0507b7cd823e60aea337de6222a3c00687089bf57dfde59
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1daf5ad0bc30cee4ed722b5d00fa5eb4eff0d52a5ff212918e99d00449d4de1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb6f2481a869ace5c7ea7ad34ca18ae9f45a1caa897c5de427458bca331c1773
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6255cff26dd253a8824f37b72323ce0af903e201228c570efb2b61a78e846ec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b90469fbb8e05dfa33a0a9b1fbb4dd1ec5e609d867751880c8211c06263b6ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dbf843489e53054b413e3ddf51d680b9b0ccfd04a714eb47ecc7c5acd051ce97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bbf39f143b7acc3f18bd047fbfe1fcf51880edb8601b92aa44f9a568d884f9d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1abdda87e79ffdc610a1d9ab3683571e992e4f3ecdfe955e3d9685cfb5b91e3d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8805f49bb8ef9e91869af30b0ef530fc0f52772827a2e64971c7696087ddc1da
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              driver video.exe

              • Path \??\c:\dir\install\install\driver video.exe
              • Size 1006KB
              • SHA256 df641ffcbfcbf35c9541cb0b6b6a906ab5d19d0ae4f1299373f5c15d6c84b25f
              • MD5 SHA1 SHA512 SSDEEP

              memory/3144-49-0x00000000002B0000-0x00000000006E3000-memory.dmp

              memory/3144-24-0x0000000001240000-0x0000000001241000-memory.dmp

              memory/3144-23-0x0000000000F80000-0x0000000000F81000-memory.dmp

              memory/3200-22-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/3200-1373-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/3200-3-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/3200-6-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/3200-11-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/3200-12-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/3200-15-0x0000000010410000-0x000000001046C000-memory.dmp

              memory/3200-16-0x0000000010410000-0x000000001046C000-memory.dmp

              memory/4516-0-0x0000000000400000-0x000000000042F000-memory.dmp

              memory/4516-8-0x0000000000400000-0x000000000042F000-memory.dmp

              memory/5196-726-0x0000000000400000-0x000000000042F000-memory.dmp

              memory/5196-1374-0x0000000010530000-0x000000001058C000-memory.dmp

              memory/5196-2312-0x0000000010530000-0x000000001058C000-memory.dmp

              memory/6176-1402-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/6176-1410-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/7148-1396-0x0000000000400000-0x000000000042F000-memory.dmp

              memory/7148-1407-0x0000000000400000-0x000000000042F000-memory.dmp