Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 04:34

General

  • Target
    729c1c038253da1ef9240cf6b1625623_JaffaCakes118.exe
  • Size 1.2MB
  • Sample240726-e7jmfawhjq
  • SHA256 a03030240bdd94d5e0716bb3c22fdcc8a915c870d644d214d69a62073fa3bdd3
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • byatmaca.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    secst.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3456
      • C:\Users\Admin\AppData\Local\Temp\729c1c038253da1ef9240cf6b1625623_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\729c1c038253da1ef9240cf6b1625623_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3628
        • C:\Users\Admin\AppData\Local\Temp\729c1c038253da1ef9240cf6b1625623_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\729c1c038253da1ef9240cf6b1625623_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1424
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:1344
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:1656
            • C:\Users\Admin\AppData\Local\Temp\729c1c038253da1ef9240cf6b1625623_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\729c1c038253da1ef9240cf6b1625623_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:1644
              • C:\Windows\install\secst.exe
                "C:\Windows\install\secst.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:6240
                • C:\Windows\install\secst.exe
                  C:\Windows\install\secst.exe
                  6⤵
                  • Executes dropped EXE
                  PID:6284
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 6284 -s 532
                    7⤵
                    • Program crash
                    PID:6444
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6284 -ip 6284
        1⤵
          PID:6408

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 a4e0b4722ec9d0f3bb0f27bc5b40f10a482f917af3380e7a11ec16298d82ba92
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 588KB
              • SHA256 adb799ae81fd180ce76820c8fc99199a6f4f57bb79b879f4f387fc12f1f992d3
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c64ddc160a46ced4d332fb5f27660573ad36f8f174f59b7641e93545878b2835
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32fc19eeafded3fc8feb8384432f94974ff78c25afbb6d185cce7ff2276ba561
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7d4e635ec3057adca8dd4a42764067a97096224eca00f89fbc1aae800d931bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 151723b1e8094cbfed116ff6e434f582d69b3c19d83bb030cee16dfcee84ab6a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a1928fd7638809947beb334ef38fff11fa26e81869e6dcd6e1250bc701b891a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5adbb10259ed978a8a4b84c9a3a389476af2043677f703f60dbb7721224a71e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9955988353a75ec645a7a31eff531db13ff29f907eb6720a519e7d7eb0b27a19
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8928018b2dfa81d07ccb951b2c5384c4100d829df9d56e3afba0f035189cf3f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e67cd55a5ae82cf90b0d399b425262a418c58be0b0467e44d926194fa32eaf2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71d034a5b5a29fd7b35872c9bfcb852a592a7740468d95061f9b92969c025add
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dddac0cba9b28459736250bd629d03f39b88097173733d86923bdd11dd29afd2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57104715a92279e20abdf28682119775f13e7700f9bce570581c5bccd1cd9cd5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2396052b67e2df75fa8f73c1c7c403ca4b3a3236ef8f43c129243e7fb64d2464
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7992679a555b4b7e5995095e81aca6011451cff5f6030e0adcf0be23c116c76e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58abc987f696da52878aba1de034b2a5806f3add5ed651de2624cce097c649ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 540efafbabb1dd92ef8c51f6ce2f3505c182cc2affb3b95ef2c36a4e3f5a4689
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b223eeac606b408c851a012f29ad12c1985a21341ba69fe012b343cf96bef335
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1e1d62f43a8df17c0238de9d842fd509eb3fbc8720df1df826a506e84f92dee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1bcdbf459cb6f3ffa246bff2eca18c3033e1eb2f383e7cdc70c217cf639da6d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 360d961e199b3a342cfaf156fc8d79b27bf924a5e5a5d379892401b1cad0de45
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d277bda0074062ad72f74635f23c3a1fae914e1301586597c59be7b9b5c8c99c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1fe23e61ff05240116de1819ce9647a221e897f3bd93afc1e2d276591d2faa4e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 79c09948d8b7f4b16a111619ba2993726f28a37caf34cb53c326922308aa28a6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca4cf7b3b2f4e4d89c0ad792cdde35b2d65a7df99f5b25c4d4d7c4708b413144
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a46679c528d0deda41c5b2b4fab38cf8af8314497a453e24062359a78835fd27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5ebf874bd9124af6521974c12c9fde7903185c6e8e8ed35be1f85199adcd94d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 713494aedfe5614a20a3e9b2902eb6a5049f8ac03e6409742b9e65b38141912e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 942cec391c3b8564c170a3c251ffa1ddbf99d2504fe39db7998bced78e88cbbd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c0cfa5ce60efada3be146ba7b880d676b0f8e61d4e7df55f25dda233dd739648
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a920679d166d4d76ae7ece716bfd9773cbf9ba09277c826187683173c96a845
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4cf0c94e7f0efc96166db74d6e806c9d4897c5b25a27f4e05d62778a63cb7f6f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c6dc65a3b7c77d9ef8c99f4c65704ab79be0126dea0044b1647669e4de88df8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c1c275463cf5ff890ffea73c47c89bc8c2af832fe2946225ec7b5825573deb0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 551e5d3a6f43cb671a7fd457e08b40c792a046ebced55e1eb18d85e102c35cdf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86cb450f997c22ca748ebf873e5a4aad2ecc859086a7feedf868b3f1132c2340
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 05e7cb70a66392a9fa03c4417714a1a554b30b7c00c0007be3fe9538ea0abebf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e61fd539ed2d0f8d1c34ed4dbec0a04bd636e98c9771b34136ded7051fdff8d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe46d32b8df501573bbffbf2df4e05f6343202d1d38fc112107c1f1fcbcd82c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1ecddf2853475f61382d2e24b9e12b3ffed6e9cf487d0b71a401fc81c74e464
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c91f9e11523d5ec7501a077921e75ab0d214cbf3dbd69f2fa6b526ff84a8b58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9bc0d6d1eb4c06931c8c7d0f91babd507dd0956a638da6c3961ce95796551778
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87e4c45433c09e63e1b37eee974c39d5a75c2680a771d83342ca4cc0c33fc8c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca112f90886acae3253e556a07946bc4ab01a2a12edbce14c6cac2ec1416cddc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba8ce41220a3d87314ce725e8a7ecafc12b47d838dbfa724ec947ac5a820ebf9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5da228d1cc1a889aa0f9301075f968851df9ef825f4f23c87031fe6c65059a21
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b38cae92154054bb72990384f226ed7f73f45fd4467ad1958c817f1bab5284e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08417540c4ce1fbba9869ce9749f940ee5a4834e60edad64d9fe5559f32255f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf2a69a02e2134f3a97a47d3f81fae9c5b68d3409e2a5aa90fbc6bfc43b8d1c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e29468728122abf16f5710d4541826238d197f3dc0adedf73ffb2e22ce3e6c5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a25dd184e3ceecbf8fe85484980c3b5373e977634e392b923ba667110bc2e4b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 793cfbce277e7ba8226199ec86252b371a0daaf00e810b49b2963140e2e1f657
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46469c689a311c3494655c9c6c5c31786e04ac78a9bde560a2f9e9d5bba5e3df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 346217a6002b4cfd424735986acf2bdff57bee687569017b0c6a1c2012807160
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7bc04bdea6193fef6388c739a78ed0ef24bf6bc7e5800f939293b429459c70dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 352cec2dd5406149075c50b6bf6dc071fb7577f466bf2c783078655d390eb9d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 598aea4ca005498383f859eeab8fbe6c982b23c3c2015513f46eca4a4525d5af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 639ae8ec59d86317880c4aeac84df8a49a153751b546dd12cbb80e426e62c55b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27c68833ba855fc091538697a533e0ca8d32762d90f17551fc56e1a5b802f97b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b83fe23122886bbec45a2d230e9aababb1581ceae667442af153b3b37233d9fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8a3b61ffc56f6d478aa47e77c0dadf7910236530a95ea7932a224bfc3ecdb44
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 334e9d406c65156363fb37237da321357aed4b83f9b2e3948c74156ba9c6b078
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f87a66629a2e43425d1d054399411f68fc14ab18fa0ea205ede8d21b8c2e044
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bee72f7cb4c0d84e2c2bb620bd77cca70bfd6ed45c377c93ceb3ac9f71d53145
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d121ad4a850cc92afc06b47012b4a97eb97d20b45e2a2060d7c3543723d23261
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4d823160e3483d2bd88090c42673447e2728630487338bbede210f6a2eb286f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df6e52e2f775111660be927259fd3047772958ba48174bf0157899ae4c2d180f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f62bfaea8043c0f746ba3223c13f2652ae2c41eeab0d5fd7c5f06d9ec48c6a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a600d62763a0bc677d89b9cee2439f7a1a1b7733c58aa3bdb3c648f18df9a2ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1448dcdca4a6f2fe19fc2535e0ccb9b78b2ea8b8b6b723148b8edcc07f853118
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb0b6d296eb89229ed9c77dc10c01630045b4e0bd30e824763f0df34539ba8fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d0e1fcb057735e6deef2a4a3920fb0fde2a6fa2d6ca8ef00e96173f8e8e160c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c042ebaef576daf07d6bd07a5f8ba70752ecbb337cad0895b991972e31ba6e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89fde7904a756460a7021306e44a8f1e13266c73badc094d6e5ebaec299cf3b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 490c16cf2b5703c3839cf459fe105c51491e6a5e7d80a7feb29d10d2f87e4dbe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f358c2cbf784834729f5619f4bff22d9495945e7a29ccbdfcd2943413c98d516
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b3e687c275d3f31e183c3c6a28df3f0e010118541ecc82241c814dd19206303
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 615e61a9ae84c910ee90eadf942871a5ab448f4a734b378f5de30e0f83cbaa37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97783d29cdecd828bace3b12885eb270e560a81d457c68e93d67dd2458b0bc17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec047da4ef944d665b02c8ae4f1c363c3a233190f7dfca094ae811a5b499f64c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 def25cf60bc293748392ecca8a4d558dba3fcf22c77e86dad3e1718178c4595f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94d8dffad4ddde075c270f079c7416e07fde618304d1466da1a250861fe3fd38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a35f5e7d7da324d03206d2a321bf49f63707cbb51acf0530112fe36342f37ec4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ed95eda80d60dff0ca508030167e17b77508aa99f76aeac6ab058c6d6a26c9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c17f47fb6982975267f250b40ab864bffc7f6324586ff604c73f0d93b5d9bf2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f60d8a699f54b5e2bb0c065b6f85cf68ba0ee3f9a8f7cef20de3f30a783c058e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77408c18819ca7637e3de5d14e1be99e29ecd773192e88fe893366f90860dad1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ee67a565ae10f237105a6b3385f6a6939573af33c95a23c085ccee21d066629
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a846b4abd2dbf539bc625e5116fe81a81ddd6e655a866c29789e76c24bc6ce2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 604bb265d307af6eb16963ec72ed51b591aa94ef09d48a6cd0d2e4c1314ef660
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f320446eeeba897aedc6beb984e898ce056e98376d8cf24089d52f44595ae351
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce09d03d5ddbc6c8571e8f5446a5be64de9758c1ac2f2bca1ba4bdb9d8627166
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 39c60c52081faf703102d2b4eccea719c3e06c64704cdf99ad63c52f426f6932
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48c449b97a1a81439c666fe23b451d70555ae126000a56c5ca68e42da48285d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f49ccab05883641e81c587f03f6cc5a224f33cbd1267fa3498b110aa0fee599a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9a0fd1f09c03cb89f72cef891ab96c5f26e784d8a0f866bf00392b6c3d0da92
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d031c7054cb13dcc545cd0929522b42c85a3c36531fc3f301b03319b85b5ae05
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bec58c7356c5e9fc9c77c11bc828468c4bc5f95389a43c74d96287a43e85e012
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 00f1ee706761460b8911d30238b05662feccc2299286325bb4a7319d0153e3d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69132ec111661a2c6475173f9f503beeb59f3c39a8d251dbb40b58099cf9533f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4a99f180f117a9a15c2f2722d8e2e38a0e12e4d399f45e4df2b3c5bfaee007d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e51a1557a1d1473244bdd489958a74f92c7651d864728ba052480212f2d17f25
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf775d4c9fb447c91e0bb218170d20ccab489748094e763f58141eeb7625e0cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5eceadf0fd841815e997e84e60b67db75d62bcbb420995366091ebad8f258b5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aad0fa93b40c2c9c85a2cffa612e6841f42cd2bd57cf52556ea8212298c7bf93
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 21f08cd307af89ea3484f2de06a67579870344ee2905357d0eebcc64e2c2986c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bcde84b45af322fdac332b26fcafa000e822a5d266d7323b248baaa23daa67f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1bec0d71ea6fecc51e745558ed4050cb7a411fc73a3b372a00e61baf8d271ab0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f31a508add27ac62e8613f9edd73d1ee4abea4cc0af28454f0291613b85ddaff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5addd08c30c5acf2626d24c168b27fd6aad6f6e663edbf6438cba1aa1249ba54
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28abbf8334a2bee4b838b09951b2eb91aba966047443599b41ab584106e082cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60b427bc29445c34891cc81e1fcda433c0876486ebff49b2be16015eac4427cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98cfeb1bbbe5cae70e3cc3edc990b1e1e8c5c1615a24afba9f7398d5df104dc8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dbb47184186f6b9e48c5aad8605eac505c927ccb35da23d32e5cca5637f8c052
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 185976736384f706cf89888d383e169bd6ef9d6741c63d8b959b9235bf056d4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb69f9249115017b380f3096240b97eeb79dc2892306e67687a8a897f9234cbb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2972647eac6c456f64949917aeaa2440dce179e51621ae0ff27b1d04217f476
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 165243ef0a1d645d3fed0197d439ab7c647617e20ffa3eaeb8c6e3afcab0e9cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b41b92c6f985b2a16ba528c2c8d93823625ba3acfcf08476a68a73c3e1e33e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c63e936a8d186b58dc9dcda20421e774df67aed1a8d04f7a4a53269457f53e2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6cc409457f2c04b2d26d22cf50cbbd4e272aa6c422067256ee58723c79a5c31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8c95c5ccfd1b675d87fc6ee80b5e4c21712a98ed3da865ab4f45c8fb2d259d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56e60c49da99e666f5db12d6e7ae6b13e037cfc266652ab7f0499535712902e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6bc4e74e1e4861e117156ed15c57816a7e8275340ee884c7e4428d146231dbb8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf7bca29c6895aff561b1222bc302b360935612923c1b3c125bcdb01b2140027
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 761693091ccac3594cbd100cdcc4f390c58bdf9929cda4cb2d0cca167581a1ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c705cf789fe9fc9cd1ec5fbdd71592189b01f6aaead07b77436f96a85da4864
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4290ccc85712ef8fefa8df02d1a4b269a8223cbf70649cab7f8ace936dbe95f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be304b2aa26eef82f8260d41f28d2f01fc3a51e44f36ed616bc1b9d78645027e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c07370f74d761c0910807bf5a3d5b2261484e28a30223113e26cb6bf10e6773
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 91bfab63abdefb94b092585a6148a3b4c7c2f7637e4f0b3dad1f669ba201dfaf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41db7df88bf0167b6f8300c18c6372090be19c75295194175d140ca3b6564d7b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e37ff931370bdb7fe94e0ee449846733ea79a375faefaebfc0ab17bf71c7f10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30cb282766a0d15fbb29a5ddb48cf0d353cea13293f874fad087e3f6c60299b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e7239c956f39dfe1db0015b317677a99c0aeae61ae1d3edab53e6af6e4c20d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 74af9622660994510c7e9a7b73f8ec75514f6ec0250c505a03ef010b45ab515d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6820c2a03a64d7805150a8ff5b02db6cbf7eaf0c007435af8a1153e4d523d8a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 716cca0164005f3362228a3e0d463c3645b70e059e7ff96200d7369a6b81d39b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e43c758f0a68a5bacb25f56513494dae658276bff81965fb938b52dd1cb856b1
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              secst.exe

              • Path C:\Windows\install\secst.exe
              • Size 1.2MB
              • SHA256 a03030240bdd94d5e0716bb3c22fdcc8a915c870d644d214d69a62073fa3bdd3
              • MD5 SHA1 SHA512 SSDEEP

              memory/1344-20-0x0000000000740000-0x0000000000741000-memory.dmp

              memory/1344-688-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/1344-1641-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/1344-21-0x0000000000A00000-0x0000000000A01000-memory.dmp

              memory/1424-8-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/1424-5-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/1424-19-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/1424-3-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/1424-13-0x0000000010410000-0x000000001046C000-memory.dmp

              memory/1424-1370-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/1424-9-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/1644-2324-0x0000000010530000-0x000000001058C000-memory.dmp

              memory/1644-1642-0x0000000000400000-0x0000000000553000-memory.dmp

              memory/1644-707-0x0000000000400000-0x0000000000553000-memory.dmp

              memory/1644-1371-0x0000000010530000-0x000000001058C000-memory.dmp

              memory/3628-0-0x0000000000400000-0x0000000000553000-memory.dmp

              memory/3628-7-0x0000000000400000-0x0000000000553000-memory.dmp

              memory/6240-1401-0x0000000000400000-0x0000000000553000-memory.dmp

              memory/6240-1393-0x0000000000400000-0x0000000000553000-memory.dmp

              memory/6284-1400-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/6284-1405-0x0000000000400000-0x00000000004AD000-memory.dmp