Analysis

  • max time kernel
    129s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 02:53

General

  • Target
    65dc27535bb1243633ee28ce8a6c465d_JaffaCakes118.exe
  • Size 1.1MB
  • Sample240723-ddbjastgkm
  • SHA256 80ad5b057e121c68d55181f094a0529d7f5ef7e153705bed7fa2d78999b100f0
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • 2-freedom

C2
  • someone78s.no-ip.biz:4444

Mutex
  • 8V66LS8J1KRWBE

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    antyvirus.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    cybergate

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3456
      • C:\Users\Admin\AppData\Local\Temp\65dc27535bb1243633ee28ce8a6c465d_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\65dc27535bb1243633ee28ce8a6c465d_JaffaCakes118.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3392
        • C:\Users\Admin\AppData\Local\Temp\thisisreallynice.exe
          "C:\Users\Admin\AppData\Local\Temp\thisisreallynice.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4324
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            C:\Users\Admin\AppData\Local\Temp\svchost.exe
            4⤵
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3396
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              PID:2352
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
                PID:3544
              • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                5⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in Windows directory
                • Modifies registry class
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:4944
                • C:\Windows\install\antyvirus.exe
                  "C:\Windows\install\antyvirus.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:1184
            • C:\Users\Admin\AppData\Local\Temp\svchost.exe
              C:\Users\Admin\AppData\Local\Temp\svchost.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:1624

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 222KB
            • SHA256 3593e5486b7a23bc5776f04230476276180d6d526a4778b7836ccb2dd67ad6e2
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88b70cdcb615d5dfbbcbd244fd25f2544b8ffb5c91d9c954a730dc6b7d4d4b10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4298731a4e4292fbf977d747035c78ec3f2d40ad827c54f178c16b52b311f9b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 478dc52bf677a1e6284efa536d834bf318e557a47ad1304b9cc59ab0eb10c368
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db7e9c56e7801b3afeff194d7a2a5e71e970b32fc73f42133e8478b594155f9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f513d625ab4cfefe8d119a66bec284012673c4cb0baa30c9592f9f206bf6356
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83cbfa772af30ee523d5842f5bf2966efa7f38dcf5dff0f4f4e0be745b0deee1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3db8f0d7fda0a0930eea087d51d335470b208b243c415520c6c0e627150c817
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f16d6fcea21e6987a4ff3dc3f2382a396e8a557b361ef77a8a913f2881b8646c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 197630a6f315be40ba277a9ca530a1c3bbdd58a651fcc0f4513335284853f859
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75ab894901d6daacc559809744c74e26d6a49b05799a407ca8f55e3d52ccf34b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe7c758a8929a831a6d651c1df2ec2701a19baa9fce6e52d04a7c5be56242929
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6495080d430378d8b899949a1f0a6389cb628847e38914f21a5a2cfb4d32e1ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13290e6093a12c215b72b02a05d6f7abaec5936a8c6ce89ec355018384de1a41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71f53eca549a7d1b306967d9149f1e1ba7f43cb4a7d035539b7a1168d8bd27c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9297afca01ddb6e23dd06ec841de82200c5ec7c4dd8e4297f1d626cb6a287031
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6fcf3bb2e221388a923fe71cbb0b0ab4d35a975c26b79b43e65445a153e2ca49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c5c5cd9414984deda0cb986c5fa0c9b588c6d982a27104e35679381a028678a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 862ca3585099cb826f264cea15cb12612519a9da33b7673a8588a32a0b01a1aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f03fc336730688d82b568bb48170cd3badcb410e0025bef5a997902f802dbc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 628de05ef82c58b6ace63812916e7b75aae722eb5c362c84f4529de7857e597c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a2fb1bb0ce2c833b20591607ae07803c1871118ce08c083af5bc059d4ac4d5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b20021934dc4d24b05c9e7b31a8e2ebeb38baa467287607da55bfab595f9065
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c6053060f4d3ba9ff8667b39b95b89b8d4e5d8284c136c4a157f23122a5f46d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae725c1a6e53066bcd773b65baa1025f4973f279aba5b8da2a5eaca468ecb427
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04538707aedff175b138cd13ada5ff54b8da8636ff3f3e3a6dd1613e3c4e2ebb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d9a2223305ed68ba488ab4f5a5ded1a21d7c11b92c8365b26bce4b5f3a07645
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a6bb0978250106983a0d67a9cf7663a4fcad2d2f35eeb05944b6981a0a19abf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 850ef8669aea248ede45bb3c0e34ba1b935364b871eff63e6be9c9a5ed86a3e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba79756d15346eeae94ef1cc16b61364d52510118c2bb441eb61681661fa1e55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 363b10ebbbef45aecc85c9b9ddc9d36dc6ed3fac1501bf8add2902acc0331c95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5488b1bf35d1ab38a19a7f50b0fd6fc01998e7df811455159a80305662407f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 461a071b4ff871c03c84cd875bc78a48e97fe29ff0594d079e7f361c2f53b91d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12c2ec3be984b9aa9ccb37357219efaa0573b46ac06aca8dd23653ad55377a3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea6d6e6ff5fb92351e787cc64555ed947fa3140ffc16c7fa33129d677f52e864
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a9c8e7da2c5ff31be7729fe1178b0af92ab933fe9b655bc2a9c0b9de0ff9aea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b054fb7c1e29b6a873d409bfa6ae0dcc5c5787ef17060d71b3712c61211da89a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7955dd1408c6f36da2b9b782c8de22a8eec3177128e4b61ed05e31efab4e7587
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1db8acfa77f4899d214a967ba57c35c23a9481047c39e4091071b95db214580f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30bef72d4ed3b4d32df5c5ae4a0aadfe821cc11dafaacbcacd7a6c97bef6ecb4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a308c32904476d9e482bd4d7d2649fa094ee1462808225f5c84187c1bf8acd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be684e967775d46be301f0104cef3256b31547f0c2eaeb23461490b6121405b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0129fafeaa5b77924d86c9d7148477c65900d2ad6b4db2222d28de259332867f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5f8b147722c62d45ae111da422884b500ebb802122926ee02bb91721a2a95ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60d027d48b5ebab3a6db40b470d92e81cefcebd2689bbcc7c3d4a2dcf34a792f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3c060cbb2d1eb9966a75aa9810113c60334ce8bc51b8f0b5f8b11485a8d4cd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9f723f3117fa7954bb4f28a2498041b674f7ba93e05aed3377354d74b7c039a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9b8b79c7a9b836a2390ac47c3b8b1344a82eb3eff52af604099ed1479d518ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dbb8ca034a94be262b4d3c76cb106780f241013037b1376830b68bc9d56aac8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 807682a67a3cc2bc10ec763593fc7423e034c9e0e8ca46e056419c3b023dda5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c17b7e0debf88414428ce1d83c3a4dce6b9723ed73d378f040cf8e7cea37c83f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ea7d638545b468e8c2c1f2e1204671bde19763d6e6f54bd340a57e4a1d03270
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9c843073e1fa3085f2ad46b3dcca3a906510b246118467d31a0031c7250fd81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4f5eb24021d0d17b9e4a608f09b2fe4d57c6d931e1ec600da4b4b20c5d92bfc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2029e43aac1bac22c5ca1080e07256ffbeb9f28b48eaccfcdc316fe8153f336
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a201f77b85fd49788db0a343bca7543b8b45206b1bc6c5e72786a9d2f20861d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c378029d23551351ac40fee36508ba98f9d50cc8e886e9cb9d7b456f1d86d697
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86cd984938ba337ecc5a9ef5520488db9c6d3d1ecb7915851a27b2317fd10e31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26e93a100cf81e8b884a123cbaec579cb4f2edb054b3d3b37a73945a3e0463c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc6cfadfc3ff3f5ed55223483be9d468bb13593d7e63c97a9cc29e1e43c8ce0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6bb53fb78a82742c0f4204f3421b8f1d08d038ad50ac4445a69e520b4dcca59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ded06ea77559554ffe8b41a46f8fdfa8013af6ed9293af2d0c7e06203f34ced
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50259d773cff30c8a9d187364964fae89a57e1f2256e920b529395a8db725d8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d090f57ed7932c285b064f6e4acd56df583290fcf2b3327848af3149af5e7510
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34a5d42a846b88aad15674f6a034ed5f365e85f14531cb52b298629093407305
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df66fb9dd50687f1d76cd0cd5cf8bfcdfcd47f8b4749e3c43be7f60224af28f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8d839695a8133c6c6d8cce119e5ace232b6ca06456743ce5e2b9c2a2deaebc6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9618f33026a3f3cbd5835eab5f18bf2c39cc7d5a908c8bf1d6dfe197d4a17caf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb6712afece582d5a6ef5187aa31ca280361fa9549a139b37e1ba1c0b4b10dce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88892b3836401cc1e5d5b318a6365c3047eec5ce62c312add84a570c64eead56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cee200ed0c958c5a3024f667d86eb5d42ae9b8976ede6aa97d069472869f08aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7909f7a76472c4b8d8acc5a293cbe71ab930b98fc1923b71fd96055c1474c770
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edfd9a92ced434f689f2ac99f50bd2d7707fbc4b666d3d5e4844d80aca92c32f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63dbbba4725344f853f81460093775e35ef89e22d549b8b32d43713a281e7f20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9d8617c887e436b8890e3c6f38dcb7e67ef69c20663442460d867f8deab2d51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fa96962881a410e6ec93f6ca848582791b44e9c7c62d0ac4e9a196c2c50ccdb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f85b7dae72bbd705f27ecd336c18d0fcfde35bea40647f53aa259cf8e3fee21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a07431c71ce8a363e1945d30624d64accc1cf2dec0bdb8cfd2cfa4c72fd1f023
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54f211e17f07da78a7f445831a2a3ef93a5e056c3d848daa0de20e49d326ecc1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4cad35efb785186418adf44665d4266dbf1802bddd307e3d85387c8b5219b647
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 504d7e8a92afb796cc9b560ead347b3e6209f4f5fb2a0ef6158fe5dd94d1f102
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4674beb7313e8cf158f54ea1603a67b198d38eaf28bb6fdb3b3f88224e6a5708
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 115c3b151f48545e36b2b9e4744e66eafcb3e1eff016674b90bf84f1899e94e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe401fed1d9b1bb37a75a86ed642f0aee929a831ff4839c8fab1fafbe9054f58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7237b245407d44c79063bdc661517e91bb1fa808f5d794758ad4a5419816150b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6eed94011de8a07c888e164e18c89edb03f98cc7ab968d9848070793860db03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bdbe798faffbfc587556543cece3a0e798994b9f166db8fb15779f6487507de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3d75da7b360f3f99d3322f48360ebaf867daec760263ebf6f5681fbb66a379c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9866b555d931a384936faac160177aa63c588f0bc6b2eb00350e46ca859dab0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d13ddc56c1265fc1c9dce093882ebfebe5170708bb56893808361e82f5f6f095
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c66f75fdd4d2c3f8528338f0c9bd6441357d536ad8e09521d69c1aad11a0654b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8339ba172063b5feb30363475a5d12ee1d4fb3ae9c11262761fd29093b9f65bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c24d9d00cfeacd4b7f04485df78f9a8222178e9a99ece525d7654f9ebcfbbcdd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf28970afc66aaa926f7311683b3f6e2591c399ffd346a72875f606ca00640b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67b3f43a3457d27da1f15f97dd173c4b8ece070d8768355606970da6e0c59fad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6619bf4ab2cc6341b902ee57b1d5bb6980e10c15975267fb22de5d8b8b4721a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a9362ef14301aa4ddaa2deee7d3f360ec0241b8fcb3bbab95ee3a3b3421399e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42ba2fcdccdc11c63935f0ebae747ddd99508c9a8bef7e199449ce8caa2bbcd9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc495380bbed038aeb2c493984827695a7b40ead219382468b8ab06f3028c5eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b24b5170d4137a1e9b7b3d8fd667588ae3edd8eced924464617cdc2c70488d83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07f42e3d62d7d1d7cc4535c289c191ac804a0cb80a57cb8edf31dd3ea6d8ee1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6d20f4ed7a8c6e99e043de7ac0ce4ef5d7f757e788a7fd2b77c532b743e0664
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7945c7f70a3fa054260e3f29eb550ff7604d0e27dacb5ed60dfc53a70985ada0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58effdb5e836ae20cace7b66d3f1bc06658b178acc32eef8386a939d15af41f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8238a7bb38690bd20e89704723a4a73c5e40d92cdc9a642fcfbe450dff1c02ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cf62e4f02a584823193569286a861ef848bb9ccc9692645bdad1c70343c3d64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 456a868c64f463bb492b8c04ebef06febf54292663f6920e873f6af260a6f4f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c89b1a9869e826e9c336089face2d2e0965cc9874cd1c3d458315df3c2657572
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4aebd649f29480a23c620e58ad9a0bf021242a7bafd4e28f6d7d10fe5be0e1f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e91645b676e04169d564e7f6a050838ebdbec6230346739bc774ac9ac7c1387
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f35d7c3db13c4dd6e1ab00690b8bed4b3080b52da09dc88bba5db161e2b32fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac95aef91adbaf70fe3ba8fa05a1a7e480908ba9dd5a8813dae7b8640a0c5d2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ce6006227b15d6b1bfb759ccc26a4760d28439f8c84e28f91b755cf46f6556a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80119fc2a2db3283281b0456b1ea462379466d79f979e37d0a3b747298db6728
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b905c2911480b3bd746ef5149127fd18ade5153c21f373b76cec97587378b139
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63e17b7055a85cbcfbe68e4995a45d71c645ed0eb099dffe5e3e158052350525
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2314b0d765f1418bcab637c52e3faf64326888832c3c94fc3085e95c9a44023
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4acf91e38839e0840a426bf6d51e11a0da498667f3f3a2131abe216b42de45b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65b0396f0a649b056c65bf07427000ab96b69c5a393a9daae8ab88aba88d7a13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2735eead012850ea1077959672f3522ba2e64d5e62b887145d0c6aa64d4e2515
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d2e10a88c9b036a9ce90b99ac5a6f55189f7579f302bde849434e6a4236a4ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41b97084c2cfa38d51c40fbb44c90fb1b3058606779496866a467e3f15ac70b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f763352bec58e37a62f81da4217ff14e9f449f1a61e4ba86b90cb8c698ed59df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05ba31fc0561f05826a55a44fc43d44b61d3a3cb8996a8ab73a7b98cdb668bfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 229aebfec2f4b69794ea2ab8f0a83b936d4173ddae19b7cfc6677e54600c3ac2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1dfe27577be708552992b9caf6905c9664d4fd5ffecfb2c8438db264913d9e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 059e811b11f285b0da546e53dfb27699a09e5c89c30fed4ea38749bae042cf1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d0cf456e712501b30cbcd5f3591354b5eabef9713961ea04011fa9a8f511e01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28653e21784cf71d35437034678a619cf8f1374410fb045072719883a2c31137
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bd2971c7f9d1f831db8cf1ccd80233bcc57e4c3912c2e09b4586952cebcd184
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83bd68bb69051caea8d2a6166237421735ef227a248706f9957a659ebc113f09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a0329b5e1c82804aa1c143f91383bef018bfadec5d906c24f0ff8229fa358e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 111ed999435c1f1d432b45b856f5bb13cfceac10aa844cdb2713b5d7cdf3ba51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6c1ff6433f231190fd7285b2cfa15112eff5c5921b26a82a650605747afa4c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e856cde126d64ee97c3a63d7d7fd6d2d6496c1b69a2f8ad39c0a69c388aa523b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 742ca73829e232883e5a79c13c4daa9a52881f626707fc880b698ca9aa7767c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 800ee4bb4893ae3af472eb2187d4071fdad09db8f279e562cb636addb42c8dd0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc6dcd260509269cf154681bb909eaddd170ca053b5cef5a8b1cb8e32244199b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ddccaf7f6cfe97e67c0e34134c8ff143909b9a24b64cb9b52e94ef73511cf6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05a88f411e7722b0b4998a61ae2a560f1691f177d4e958cd482952deee8f6b88
            • MD5 SHA1 SHA512

            svchost.exe

            • Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
            • Size 34KB
            • SHA256 3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
            • MD5 SHA1 SHA512 SSDEEP

            thisisreallynice.exe

            • Path C:\Users\Admin\AppData\Local\Temp\thisisreallynice.exe
            • Size 1.0MB
            • SHA256 bd78d62426bd10f75c3efed2df240f284a38f4ef5b154b19d1561f20010dd266
            • MD5 SHA1 SHA512 SSDEEP

            cglogs.dat

            • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/1624-23-0x0000000000400000-0x00000000004C3000-memory.dmp

            memory/1624-18-0x0000000000400000-0x00000000004C3000-memory.dmp

            memory/1624-1185-0x0000000000400000-0x00000000004C3000-memory.dmp

            memory/1624-25-0x0000000000400000-0x00000000004C3000-memory.dmp

            memory/1624-20-0x0000000000400000-0x00000000004C3000-memory.dmp

            memory/1624-24-0x0000000000400000-0x00000000004C3000-memory.dmp

            memory/1624-26-0x0000000000400000-0x00000000004C3000-memory.dmp

            memory/1624-27-0x0000000000400000-0x00000000004C3000-memory.dmp

            memory/1624-22-0x0000000000400000-0x00000000004C3000-memory.dmp

            memory/2352-102-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2352-1669-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/2352-42-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

            memory/2352-41-0x0000000000F20000-0x0000000000F21000-memory.dmp

            memory/3396-173-0x0000000000400000-0x000000000044C000-memory.dmp

            memory/3396-40-0x0000000010480000-0x00000000104E1000-memory.dmp

            memory/3396-36-0x0000000010410000-0x0000000010471000-memory.dmp

            memory/3396-17-0x0000000000400000-0x000000000044C000-memory.dmp

            memory/3396-15-0x0000000000400000-0x000000000044C000-memory.dmp

            memory/3396-16-0x0000000000400000-0x000000000044C000-memory.dmp

            memory/3396-12-0x0000000000400000-0x000000000044C000-memory.dmp

            memory/4324-28-0x0000000074010000-0x00000000745C1000-memory.dmp

            memory/4324-10-0x0000000074010000-0x00000000745C1000-memory.dmp

            memory/4324-8-0x0000000074010000-0x00000000745C1000-memory.dmp

            memory/4324-7-0x0000000074012000-0x0000000074013000-memory.dmp