Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/07/2024, 13:12

General

  • Target
    6b96ae10f1617fdf36ed271e1bfd6749_JaffaCakes118.exe
  • Size 932KB
  • Sample240724-qflhhaxcjp
  • SHA256 8f2a9ccb905d89c66f270710caf8a6c62499a3fece4a03bbe69c42c713e02add
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • dangergerigeldi.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3532
      • C:\Users\Admin\AppData\Local\Temp\6b96ae10f1617fdf36ed271e1bfd6749_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\6b96ae10f1617fdf36ed271e1bfd6749_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4084
        • C:\Users\Admin\AppData\Local\Temp\6b96ae10f1617fdf36ed271e1bfd6749_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\6b96ae10f1617fdf36ed271e1bfd6749_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3988
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:4960
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Deletes itself
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:5136
            • C:\dir\install\install\svchost.exe
              "C:\dir\install\install\svchost.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:8276
              • C:\dir\install\install\svchost.exe
                C:\dir\install\install\svchost.exe
                6⤵
                • Executes dropped EXE
                PID:8036
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 8036 -s 536
                  7⤵
                  • Program crash
                  PID:7880
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8036 -ip 8036
      1⤵
        PID:7912

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 dc5fc58a61e73dc2ec98cbeb92eba4b7d67c2d56829659177daba650d52b66c6
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 588KB
            • SHA256 b37269b3e1e246d3c889a45afcee5935ddb31441c80c01672086390b95aca291
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c259a527ebb45b760cc366c8386ea2a455a8787be247e44c4cf08abb40d892eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8bc40ebdb4fda38309cc5d67a085738db8c4cfbc9c8446a03fae8646b2d418b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a71f4a2dc3039d94f347c7ef6e06c28a62df69c25a6c9cbcb09e42d7cd6b06e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d45013dcaa84a4250474e7fbc5f2aa0762835853e4968daceb48f15785cee7d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa6a415ae59cea03c6ecb2c7a98bf99ffd8a4165e8a0723d0f2cc45ebeb05a96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed5ba372dc5d551f531955596fd5a6f05e743ae7d2e44a2a765c5c4b12cb2d32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 761eee4afc19b3b4f93e99014285263e09bf07136623460b67ef548eceebc633
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82a444591ebbb505a23b3433ee2c10ead1f241bf8aae0883b04daf72ace355a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c270592cde7fc2a0bf76609617475e08b3fd4456992aa38e734c5ca9e7dff2b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 344d54927f05f62192894b3f7cff9323db7746dedebe51b0b765bc3db949c005
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d47ffb64754fb1173b57d6d1738f47875287bd04fa1550166a6e43600df37e8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36d0adaa9cbea87d0421e1b980aa533c717b63c675d0602916dcd102b1880494
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f9f7a4d4abdbff039dfe02798f0a8bb2cb852d7338a3876b4f6c15ad15e69b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4e8a317dfae8a0803d6bd807b4e2e8845dc4afb9468c7a70f53357d386fa84f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b3259fae9d2a46355fb1ac78db02887fb6307fa832a4428c3a0714dd7c2ba86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e10b3134a9890dafbbdbc61c93709f70e680f6eff86907a7b112925a613bca2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 540305c280cf192b97de9d1a857baeabe3a0006b963ff4120d5d47646df08ea0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ac905003c7fa1135c9664027b21b64056ba02e8a03115d3c319cd1acd76c064
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ca64195f0728fd0323f9ba0e1bde43b12af0be1fd2516887fb0819fd5409939
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f24a929568cba3264e3cc7c54e0360604bafe184d5439264957ad12dae8e73a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5b9197a6e36730b77e9455f3a54e3c4c93935fc3dfae6b70c2dc74c749018cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84165242a28e7c4430c88a008b50daea82aebd81868c589046a71a527315b749
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4b5db2cf66374ec124897d9c671653952fa4428b5da15b0906d0f22de233c1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b64e9094ae2c22651de25241b6df9689cabae46f59f6d85d79864d19327ce8b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f65b95f9b73075e72fe25e0314ab516ceefd7e601f17739dd7b584584d06c65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c35e8610c6760cf49a692daf8bbd72dab07dd61559c438c88a1845081d04ca37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a739ab8b2843a36029a912ba40a1301d7755d2c16ad8976fa286965a73c462c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f790e44b596299abc8bd396a3aa640b1d26a7cb16f294d32692d41c23a7df274
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 876e27da1e3070a809b6b071073970075e7938bb594339905ad8f9982f144a73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83b87557212c9490f9b9b124251b27d19c23f8cf84035db57524cc2ac54eb0d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a29f4847df4266b08c491da04297483230137cf41492ad6d5c71b7160419fd9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 972daf09beb480a323345a116b00a0eca10802d80d65105a2a9fda0cd784397a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66d8845c56a6dfaead14eb053463c88c82613f2481e1b220d88598a84aa113ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9b20b38130d84f53f675efcc7f6b02340e593403031c699797e0623f74c3e9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c0ab11808b15e31b15936dc76a06763ecfc22d96765884401d5ccd82c61b4cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd0c8b70170358c99ac0fdf2cc16dceb2557ef9442b3c81430058e707e6d3fea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18f41130e0e57aaa9914dac1061ed3adcfebdb4596c10728c47db4f71e342aca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49c9788bcd8afcbf63d810ff4ee6c4e9eee5a7e7b76e1bfee3bee0cce8741222
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 782923c7e8eef24f7598a02b4d851a628226090ceaa059d121e2529e54a8ce5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c70e7c704749ddafc83813b591a1eaffb30a047e5a9c53f90791f86956c3b93f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cdd6443b0951aa3ce34c3e2ef702615cbee2706d3b9da4186ee3d19bfaba0d51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1bf19257a5d45befeb748fe213448cb2ceb940ef68df65f2c9c6cff55958fb4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 362a03c0f1d6142b59be84c4ba3685df26f29a8fed871dbe9787b37f84b91d60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d13867d2ea3b5cd69c8d063c576a7a1ff204cb8ba97ad9a4dccefc69526b5e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52dbf5d6fd865f25fe5e3d65391bf62e446499ad3554bcadd5b48228e5d213c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9601c3b05edefdec66fee0a07db9b831e0cd45589872114029faebce0065be9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 391d2e3aae0e9bf62977698b4c6318260fe38efb20f893d9ef837dc53d1e8910
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d47337f07d3137e0c2c8a152f76f0fd39e7e02e239fabdc410bcd084d42a95f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 554e68c441b3c94492b3ca4bbf0b4644e6b0cb0ea3d470ec8d8d9cd085ccea78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 364ae8e5a8afe48a1320d14cc2546cf4ff9484bef9fe33655fa36a6586ee56e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f605ec6565be5f256127e7e5c5d29d8fe17904a7b6f0d22c1c308eaac25db20c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 928f1d98d21b90e389460152b621d39f98a984a58e80655d57ed7499c042de1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 052117845c0c00660b5cc1e2b85344b77d58dbd91aeb09b5c905df69aaa76ec3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e77cb075625433fe32456d8ced29a2799214e50b0c2f1d59477a01ce20b09639
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 757b16de56cfc3e0708b87574425db6b2bee6af9369e01de2cdd5db4f68738cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a274b01dea4a827d9dc01f02426e8c6547dc59fd5ddcad82cd2aded24d8be36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24346019ce97a212554242eb06f46c56996370c300281b4b55e2cc2ac47e2498
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abb27b62b3f72842648dae846154f81ecaa601f3d156a5991680ea4580d11e1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff3fab4b664ccc145ca3080de299825ace1d0b29943a6e39b7f4dfd3702043fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8dc7553f0801e28cc0a68d2ad9e40f66b402f7cb2bf46f190ae8cba3fb77038
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 933b5bccfc59ba986e955a8d6f09b2aef9a1485e83f8b1351fab8c0aad0ab95e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98f0ba517612686b2531bd8ad9e4f4e61ff6ee70216473ad4b365bf034cacbc3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cfec74039cf0e14783c3e18c58dc598e93e51d3a2f29bdb2dfecd53c7aa62e92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0bf370e91ea43a6e7871c69e212095b6afaa11291bb15a3437d325dd225f8e62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d3ce37f7d7322e5a8f9fe4e4d5b2d8f51faee834492a85609eff51669c22bb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cc28ac059a315513c09584eba212381c3ab556ba8d7a3b9608b74d9f508a84f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f02a46a03983a5b60735d8010cc8404116f8332bd89a61469f8c0c831098fd29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a0842f7becb4c64f6ed15e84ecc8663532180f06063c80a324995b21b0b94ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed4afbaa3fb7c6392934b2a97ecc4d36921202081074de29c53ac66d76daf5c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96333329b36076cd363ca8f2b3d6f6e7e6016d39612f059fd587fb53fbb32c63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb166bb55ca05887e8f93aaaf31dbb0f66655864a36c5c0e8f3f313c11b6f2f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5427220126b1f2db254aae0adc79435eb09f735f64a8ee800395fa06a54eac9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 162236715af631fcaa769691958dd04523e053b744c669478507bf9b743456b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dda9b95c11bb5de0d72a5847d208aa76d7442456fddb4fdb39f4b3fcd832029d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 733a2bd1d9d3e25ab2ba16ba1c5654f8ec51dfd46e496e8f3aed21c656b8280d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c80a2c5acabc255efc6514ba1aa9cf3958bf7917d1c7bb0ec09f261c49079532
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0a0b4444dbc783f2006b8b7536fc25c86c545dc3b5a1717588052311d7e053b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1dd0562ed749c1028f43d3ce51ac7d9e3ea46e325f2aae0ece7a49566ea7113
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01e01887a83d53dc1b2669c95f89604dd72e12d1f7ac0fe7daff0346877557d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54d4937f69dd0d896f7980d81f4a2c404423fe7da684db398104043481defa2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e4f48a70fd179ca3e9a10a3c37c80a044fe80681e7221bc6de04cdc7293d79d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62f1f7754cfd873f822dbcf4e1accb84fbb2c2f95b05e343269a891771939d97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2c79c98838805bd4fb1afdc6dc35a6d54fe05d12de42e14cc7a5a2903738f4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad13ae25fb682a91768b073d1c5692ae357cbef5921e139fcf4d3edc295ebe74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06d99e12c0d3ca5c5db81fd59ca6dce0467af44941ec6167400fa774222210bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72fb24ac9d99b3289b5f48b8648a70202530552f084021985e32aacebbbd6721
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e9b087cc80f67202e0834daa39d5ee0ade42588ea0a7d1ce1ee356d7b374968
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4bb09e611fd12132e1683c4c1558167615c6eeb451191223133fe3f27e9ec531
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe8400a2aaab919f5c9f39de1c5105a8eb3ffc89fa6a2cf2051cc41c8c0450f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f6e54f59031e76a29187cd646db8596c5e64710b3a1e8c9b2c9e814a6756985
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9898025f1e48143b247356b17f402e440140a3bbf4ad2f8189a33df169cd44ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 105841e359f77fba59adccda11ed0831bbd3f33fab5f08635ff71e8ed21634ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5482f89e00fbb7d266e6dda072df98777c1b092e1365945d3a8d9a934bdd9466
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22ea5e3aa34f70be5f12e22fc0bc37c99cae1ceed803eb9b4c0550e0477ecb23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0802da1164500e74e46591065bb08fe96aa789b98ba27afa5ba9fe4c4c998fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7b9ce5ec90ce87636abcd6571ce60594d6ea1746125b696a3a94bf83534a8e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea9dd2d8b4e4445e9af626466296cda4b0fb6000ac2256afafd584afe8af4bd4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 794cf1b16f63adbbb066846dd3b55eba9a0cde2505bf8c81c38ffd88c191b4f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4ea52cc3916a5abd4e7dcc1eb24b237431a183071fbe1788b675da6e278485c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 347afe6004706dee53dd8c3a662048efe2d323dc96e5e8ffbac21c858e496406
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49923502d1fea21482fda9a9427b4b60226689b10782a1d94a43a0e898e9574e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 747f27af83cbbf07cdda1a327bf31c74ab041323d650574764ef439577d1e681
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45a686e6f23806f66920fb277875a4c43f6f8d8dd2958ee311003dd64a36d6e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 374868d65916643d6723f838e6c4e41409fc4de684ad919c4a8fcf53b68ddd50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9adae073df8c29c714166c9e5df815f9e6a17e3954dd6e689db65a6e882941bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08b38ffaf187b87d3b5e00e19afe82cfc7218e9ceef388f65269c8b6f5c0c1b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc341dd1027c9107915c941713355204fc5b16a5e66052050846c4d5c40350bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae25fc17aab72a45c4b1f6c09b6fa0bbece664704da1ac5428452baa8d94d341
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f62f72ac7e7c8379138b8fe6a3872e75392ad683277e86e4ca46da36da62e794
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46200d93d002805e03b2004a40309732873fc018282e45c06c3d96992abfb651
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70990372bd70c975939ff4d8a00c18bc1af0bfe67428751e6fcee4c62df0ad4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4e2a53ca4756c18c6a5d7dd966073b02c8d41d0870c0835be5ba0c648548a50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e73a8a119b1316c3e4217fe6043a97dea4d8f65376c36a4214a17bfbf968c55c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71b004b690fb8a16f30b8be69a346de123941552ba91988d0f191f4a656bf6c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbce1b7f882142bbdc94d7385fdf0070aa97ff48c131f076856118052b16cb2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16fd18010bb33a987e3cec06ce82d8563768d71d41e052c6484e52ecafc70fc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a78db5a8869010ecc342e77cb0392233d37a9848a7517c72dd9b936fe3235f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0845e19885d404304612e6a42bb1b3c0ee53355a0e8a629b90543a78d0ca76be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9863421d93b1583c41d921b25120aeae038e82d774e3c8bd1023635158b4d20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72ff8c97864e5839430fd4523602a91cb4a0f22ca3988d831f14c3f6ba362687
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7198e51d191794a3b97bbcfed7de733d2d4d5068962e62a72d5a9caf6b52266
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52b8decbbfa61f48d683bd64bb03b7994f16688b435a9b98f122945a08b8d956
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89f641a8f59fc8fedc2a4687a2259c72190ee21e3619635746a154858e5ef9f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9e1c91a0ecab176ff5b235b32e6de411bcc9af0b3067bfd8035fa85150fa2be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9dcd9094527eb85339954eb9ca93daa6164c0ccf35537c1767d88c8ccc3b9eb2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02491a0cb9bb89e419eb2fc2273312984c507dcac70e445036835e4c58f34e9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09a04d442fd2570c97ad0e0c9f7e79ee4ab1deddec6f0a9a709d2549efc04ab8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a5cf55dd2576310ff814fa122670615aee9c29399caa15b0047eb9e61ecae05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c27f5d911856b12f12a24465d6d814be0eedadff60a94f8dfeb4bfaf07cbb15a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d9f698feccc1faf165c206534501b848dd57bc8ab41bd1662ddc3ac44585005
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87c7c6c1d4edf2b3930fc32ba70452f719e0211524691668e564ece7660ce985
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3ad410c597eec29adddc61f0849bca2044b8f722b552e3c968e4e372a1376d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 beafc883f430d36171c9f3161e206d04327cf13b771d25afdd9979e4d4811f02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75529a3446903093419d0ea0d8d671d0b5fa3dfff7ad22973b537004bbcd1b69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4e037bf2494687263a21c4cc609522e215b4336b9caa62463ddcd1c17f8e691
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d69ea13bb724980406637be108b5ca7808fcdd1328d9b9d4c2b6f11df8453f9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf7dec71ac8a51d04a42ac93dbe525ac4227ea037fa073907e5b9ffa8f563826
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57f2d929dce8c5961a9b754b2ae8f0d8166e8f85a9025ad9d824982cbb9bc0f0
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            EtNDuISBB.dll

            • Path C:\Windows\SysWOW64\EtNDuISBB.dll
            • Size 1.4MB
            • SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
            • MD5 SHA1 SHA512 SSDEEP

            svchost.exe

            • Path \??\c:\dir\install\install\svchost.exe
            • Size 932KB
            • SHA256 8f2a9ccb905d89c66f270710caf8a6c62499a3fece4a03bbe69c42c713e02add
            • MD5 SHA1 SHA512 SSDEEP

            memory/3988-14-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/3988-19-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/3988-9-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/3988-12-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/3988-18-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/3988-15-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/3988-1368-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/4084-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

            memory/4084-0-0x0000000000400000-0x0000000000520000-memory.dmp

            memory/4084-13-0x0000000000400000-0x0000000000520000-memory.dmp

            memory/4960-694-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/4960-26-0x0000000000D80000-0x0000000000D81000-memory.dmp

            memory/4960-27-0x0000000001040000-0x0000000001041000-memory.dmp

            memory/4960-1664-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/5136-1369-0x00000000104D0000-0x000000001052C000-memory.dmp

            memory/5136-2346-0x00000000104D0000-0x000000001052C000-memory.dmp

            memory/8036-1402-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/8036-1408-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/8276-1405-0x0000000000400000-0x0000000000520000-memory.dmp