Analysis

  • max time kernel
    150s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/07/2024, 08:30

General

  • Target
    734d13b54bde3f6413d3607b27339925_JaffaCakes118.exe
  • Size 600KB
  • Sample240726-kd71ts1aja
  • SHA256 3c97ea33df283023d876774ba4e8568cc94c00939b7b9f0090b5f38975ed316d
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • Microsoft System

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    Svchost.exe

  • install_dir

    System Config

  • install_file

    system32.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    8915287

  • regkey_hkcu

    Updates 2.2.3

  • regkey_hklm

    System Updates

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3536
      • C:\Users\Admin\AppData\Local\Temp\734d13b54bde3f6413d3607b27339925_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\734d13b54bde3f6413d3607b27339925_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2568
        • C:\Users\Admin\AppData\Local\Temp\734d13b54bde3f6413d3607b27339925_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp/734d13b54bde3f6413d3607b27339925_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3264
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:548
          • C:\Users\Admin\AppData\Local\Temp\734d13b54bde3f6413d3607b27339925_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\734d13b54bde3f6413d3607b27339925_JaffaCakes118.exe"
            4⤵
            • Checks computer location settings
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:5788
            • C:\Windows\SysWOW64\System Config\system32.exe
              "C:\Windows\system32\System Config\system32.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:9040
              • C:\Windows\SysWOW64\System Config\system32.exe
                "C:\Windows\SysWOW64\System Config/system32.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:9112

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          UuU.uUu

          • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
          • Size 8B
          • SHA256 86012a0a29623ecec80bc65e4dcd3365d6f347173d9400a7984422d451ce83e5
          • MD5 SHA1 SHA512

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 588KB
          • SHA256 f78729b2825868c9ef3198b4e423a6149f0272bb264a29aa234781d729c0bc12
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d0fe0f92ad20bd1da85ce68a5522df5ef4b15f0813d6fae8e8e8771c9d9566ab
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3454cdf3363aaeab0034f33278b465282187ece7eb49bf19e176e7276e175990
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c7563eef94ab721377a5bf005af80281896a8530e890ebc1e0b63c45d1902061
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0e880a88159e009a4478899aaebca40edd0d3fcfc68dc78043f1f08b21d3eb23
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4bef087de32184af1e538e2ece2ba7b53c27f6b6b9d35d1c85bd641bd939fe69
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 be9191f38d27a586baeedc6c4a2b1a49ae154b7b86e2d59c834ffd30ff6ecab0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ff62b785ba4f55d3b2dce0bcf0a28b4610af9e220dcb2935db27f1fca11844ce
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ede7eb04e3b341ff121bbe294e8136372898e685e748b92a9f7efe3516fec2a4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 447cb6e3cc27f24edb203fdf4739a01900001c8cccb27d53ef9ba5882b725137
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f044c0d563bc4f4983d52b4502eea2ec005f1c6461fbcae2bf639799c8f8967c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 77d331070df44ee9758b77a5542cbbbcd6927406a21003410482444c77577ed8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ced0fd0cdcc963a8e847479b17da44474d0d49c4ba2ce6ada4f2edf6f2118328
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c69f07e932d37fd76772c6513d5f75945d9147cacb0d76123142fd57d9c2f5a2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c4f89320733e3e7bc3896589dfe3aef68f7c70763181b73e98ee96728e011265
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5348bae1d535f35df87b9c8377914cdcc970a945522dab29f35283473520d156
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cd03c0283a67b69dab2d7703976570f4596b4a3c7071486b4f77f53a38901a43
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4e5369d08d44bdf3e166a9baf7e00dbd203a20cc889d19427d0281f8d1c244b8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9a9c2314c572592553dd7519419d2da0160e65c8557e597e45ce2e1f5fe44ccf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 48ea965fb7d0825c2319ea86c6d89233fb09643ddac38c9dbeece5cba24892c1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d9f23c1f58386893981135e1c03afc734cfd51840fc22b6e18383d65a2298fbb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7c10345ddf24b1fe284327adbc4a4b58bc903a3727e2bda226d8b2989771c243
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 86a53a09c27f061d550ad6f590a7a3c4fb8fef494be15fb5ece84e1595f45c66
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 108374f6569b6f96684f028f279415d993675a68d86382bc025434eac84be94c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4cd2875f11a12c7f7ea9c34cc6c99012fbe834f0c4dba02f91c78da6ae1d7a9e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 96a5870d0a03c30f64bfb72309ee9f93e0e235ab52bab786c31296bb70ff66ab
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1a4f964a3839b554f1abf12015247a744d503fe2c353d162c8b1d0191b157221
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9207937b1129b2393dae1d9a9b4b5330548e096990640390a40de9badd0c596a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 398a972609724990e2eda9a7f38120fe1b98a7ae06451b9519f11d8c5c68b36a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d2c2793a32409a90bdb21c8d88c57f47eba46b80d72a0db0e5f71bdf811d75e3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 58b9beb0067a98aef96ab077061d6ca9c40eed2e2a21a38a7bd6c63acd04335d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3e11e395cbacd0374375880f1b0454126375b02c2dcf2a64b08f3c7c76c8ea2b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 638e4834a3006b967784734f9c6d875e4d598d453dbbc3b4611b6bf0bcd7e3bd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 25b8dc4f3a2af4bcd718e50e8382a64974499edb198f3c6f3999aaee65fd09ce
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 798d94a51d5da45565244a217a4502c0628a4474c9470129507b3f8a413b261a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9134573bb58f0a0621ce406c45c128fdba19de034720b8f02d19bd72c190c216
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 025df4750c5c1b9d59094b36d617cc81f00d9201a9fb09c7da23908f2b53dfe3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 059128c6d6dd570a2ac89889366d38e7c28c2dc3c7d8f71f98b5c812d4d1cc02
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8580575df8680f7fec3c9259ab052a356ef218611975d7cd48f587926580b14f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 400e6c8903c8100d4ace0c0075e7433b20115d54daff9cd227922eb3176edd6c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7920a661fa674231b82aa21b63e6cf09fee89b50a8531356bd8314e967060d00
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0d217a1ac8f202da43db768e3d021dc51546f2f586cf66a194021f82b51fa837
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 afe2bc0f7cbca946fdd3e05146310be77022fe1cb732ce28237eb0c537e46d6b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d4c6da7e3e77213e8f41a4685bc82c274c84628c1a3928c780a43988955835f6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ab3154830c028f9b0ec3dad4227a082b32e384665942e1738125b0d6ed980d1d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 db1f94bfa171ae637e0054cbdfc75f03ca0264d462c986175d293aa9607258c2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3a8bdd50e64c2b6499b75ac86220e41a9da993ff2dc0a4e78f6fe2aceece5989
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8524065b0108e231aabcf016ca5c0e43f069b418e43df07f95c03575047709bf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c90f3c6ce1deb236245ab207cf7dbeaae7ee9e6e8c18aa65884c12573915e628
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4988d8795d7a8034111a356606d31beeb993ea2fc00169ae90f0ff2824926e87
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a26e77a5ca56448dc7f60e77be24908a5c59b2071c0be344ee74c743385ecb79
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e7ebbc282d541e9d928a4b95431ee597a078d4506f98ebba1194686eaba5e9ae
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 06a64a3006d8f82f4453f0a220c019418b39a74f3099caa5fd902e7d914a50ba
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 64108a212c2b6b1c461b608aaa260b412c57b1798c280f6e09ebb1ec6d46379a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0de16c4c776cd7c2c5d997ea73391234f6412a0ddbd830e95ab0ecbc1e01d751
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2861653e16c69a4d7b271f96bba782e0f1709227d0326dca29b4c8b0a3f22007
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5e160b61d1045597046ce9435cc78774bdbf7237ef445774d3a43da19104c0d8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bb1bc8bf8fe0d882031d181a60284e89c3fe6078a53d9ff07b965db0c71278ad
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f1e11124adb112cab125978ef672a4f36fa7d65a4269234ee110d6c5ca449ac4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 389e4011df06bda1bf8cc826333664b5d295c045a3ba13849af2662ad35e6e42
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0ff8da279470ea7c0697432db34a740c7da2b49193b945f7b0d7d89233cd579e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e0f7dd1f4d51d2211fd2d9a03d99f80cc9910a3d175359b2f508ba1db109fd4a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b02746597df54a65b12a6efc6f9d5b024552f8fb417a9339ae063d5fd34f493a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d31310e99035d78342513dc583b54b6c8befe92dda9fe23aad0d2136b576421e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f226ed3f3cfbbcfd4b9a9d6a17fb108e7c6ea7bafab8c9332efab3bd7689a962
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e0feecf000beb95e37ad9fe2f4919ce8ae258928c5321a9d33e03c6efce7fa36
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b8093184fe3ced3f1db4a015b93d97aa3a6ddde04aa98b7b12acff510a47cbf7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4bab0962423eff3e1e28e1acdd9ebdac83b20faa052abd615ee53ea145d5d931
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a419ce52aebb55ff7a724228815baa429b756387c9abd669de39a48df61ea4a2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f85d0af1132aa8ea1373f7e235280a93baf92a1b503cbecf4e5fd732db0f63e5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c61219a7b803af1bd2fbeb4c439ea191d61caa16e4c64b17a367c157865c8223
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d777a446739e75dc9c7e4d28e62118760b268b7d3d90af6a0b63f4b286cf0a7a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f62ecf3d7f9cb5caca297a96962ad05ea21399ea939378817ed29689412c5b0e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9e04943cd2379942be580047d3a52dbe4243f70a379feb70b57ab3548314aa52
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ab38d3950cadc8058b1dbdea37beda05f35726f279c99b639fabd8b36ba3b35a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9a3a822234197cd3292c393e50fea8ae760a0709cf0a1498bb93dbf38833c618
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 855cfc99e4cc3986dda35cf9afebf9d672b4ebf8d45263b1975b9dfdf37c1fe2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 18cbfc11ef7dc27062c70bb00d3ddca6f7a7292aa306328fef246f25f9ba6e5f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4a571a292b9a236d0f61fd7afc71ffe73bfde2338744faa30cc1ca985acb6a0b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 15b1b5bbdd55d28c744c162ad4b44ce628ebbf84ca8eeb7588f6f250b12ff570
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f96c19045aba65bacf0ccf871fe35e50c4f513b8a4e96aeeb5f7ce88feaf2164
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ed3413e465812ec345a3953c0fc8d0d97b9afc20061c44f4cc31568cff3df734
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9fd6cad9c19b5be426a51fde9286fd0497ac6a0f8122b24e4024de66822bb5d7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8eaf770dd4e1ac11f11704dc8296d0bc8eaafe82490a9780008f94ff213da126
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9a1defd8039189d4d27832cb70f2c9a3434cdbc7f39936442986a8578b6431ab
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 439d2c316964783165ec05d99a90b1f6737b329884f99fd4fa765601345e5572
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 91b6a2d6ada73b014dfc125067dc2906cc90886cd47bce675324bfe8329a905d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4ab79e7b0027edcb6ffdb690232d891284d6963912d4526709f304d883c93925
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9886b78f7be5ca43936d0b60be7df41b9d831b78deba2a35a041d29a70cbc794
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c899e78435a06ac3233556af8da59860e4e1374b7106662feb6faa6259cd81e6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 80a9f6655d8fff79dbf39b15b81f11281d92fcced26d355ce328421fe767a061
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 be64d7417df4578a7df1ca864a822a941b83c103f67dee28f75aa169ba6479c3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 509a6cc4e64340b306dad84e434ac263c7da8120785c71f52da01c4e40107574
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fb2aea7661c3ae709c077ace507a2638d5ef9d7df26e1b5344986811ae6ef0d4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 899757285298cc6192b991ea479695fd5dd02a6e658eeb2c2ce942c77ee82416
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 46defabb49d218ba79f493e0aaec5338f0948f86c8827468a256908e39ce4115
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 aadb14a173a0a24ebdf4b948afc858947b343771f3d9d0dcfdb4e1303b967989
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 76ddae0d7274175b495d0270e33f1a59946dffc0b1ff15f844496ac485ac7356
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c6af4989068c569400388a3e570afd87d1e8107b95b789c8f21122257eb2d13c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 30e29c1be79ffbd846a01b3686c69a43451b73c81f5e3f91635d3fec29f75c07
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f5100b19485f4f48cee4d8733a0c6d843f1abfb0cedf13d5b1264d4271183a35
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3f2179318f41044316ed87335dc8bdb81c9be22970f36cb265749749c8c175ed
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 66115d6cccd298ff65b6e577482a9ea05146cb797cfa36230de10a3ab55e753f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 465ab25148805cdb905ad268f1ecfc1e3be8945a05bde964ca5b6be460102e23
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 71244bb966dbe34549ac0f5f43bce7dead07988c3a6143fca2365bf760e99eef
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 34eae412eb4b81159336c08a999125855547401e8048abe82d967d49d5394460
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f29b4caaa27af9c7a0f8dd57bc9a855d25fe463496342d9afac98e8f1dd27d8a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 200de94e77d5d46da9c1874f0c5d0ffc193015112fc1d5c27955062e09650db1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 88b219aeb171e1973f84f77453b09d398d5388a9e383bf89d1eef224f5fd936a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 aecdd5b0bca79835602e4df7858f69ec7336dfb0f44e0c64aee9357af71051fe
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a29a8573f9b4ea85722fa570a6e7d737e5c1e87227c0de9367b10bc3a44c6506
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a3c0c9d878a756fbc8e7a3b18bf1fa5b5e27a5324fff40be2d09564c5dbf5d60
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f028cfbe8556753ebc1258d0c0401fbafa509403f12841dba9cb67721ff805c3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 74c1e5b01edd21b3b8e87129acf37587433612256172e556a6b6894e6ab3038b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0f1258ee80fe5d6c5a3771017936520c32f32d27d50f621ec08ae9afabb3e9c4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8791d758e35701b50845f8c0477bb29103345a189adf826709efd274b4c4280f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ec5c7d3bced509f8775da7e03a859e6f7f3681faa4df464342278b9988a2e0bd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5da954557b8a9cbacf7d7cdbfd46eff3047c9eee5463f8284dee18754b3f888f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ff3375cd54ef2191634d58d562e64e4e65babbda7698bbde8782ce2350cacf8d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 887f821af0cac95937abbf812a1279bb4c0dd80ec586d0bb720611e733a62e9f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d1eb4fecaf8d5e5517845130008a9be382ceb7149534b194ce3031c4a9a195f7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b0547224d7742397e60ffdd47ca444cb80a0eca31995444fed94296ae5c35d8c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 74190b4b7e07ff0412684ecfa4c0ba2914452daa0958db3b2d3047bacf54c9b5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9e84ed1ecfb77d3acc03afbeae8cd32910d3523d058c1972f6080423b4cbf558
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e8e8a5e5bda32a5f07aeccb8a489055fce7d9a477c76c8816075976efa388c53
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 deb736b3b823b1b96e91f9f121ceb35d51aa20b944ac8c9ae03f3fd0f1aea976
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 00b006f609d111d339236bb5a3eba005a33ed0ef74828d1890734769c7856f9c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8cb77958ddfca68936b3a760f892f53ba6956faaf73425cc3869c8db0d160da7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 52093f9b703714809320a66d791d77b2520cce13f7e51741a34dc38e4eb3ce3e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 30cd7b23f09725cb75fc37a40cd6fd44f4d52a090cf4a1c8ea3f3cd623060f5b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 be8b2170d7d420c7ccd25f5c42a92a0a55cb02738fb366fa95e9d209e15d1249
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 918c2dfcd5f3363c68387e935017180489fe1912e4b0aa208d8471217605f284
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4ecae02b8f6f2abcddb85a359b2e8132da222ba4664e00b8e83c6fb556ecd060
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cc446396bcb95d65e39dd2b3a9ddab44ab0c714c445323c5da5050b64937ddc4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3562d48832497484ce6102abe8bca56a6e4faa6d797aef047c5e159d000de249
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 94bc7d13433f2abfc412e02951870ae515eae8e43d7c5863678bb943b22355be
          • MD5 SHA1 SHA512

          logs.dat

          • Path C:\Users\Admin\AppData\Roaming\logs.dat
          • Size 15B
          • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
          • MD5 SHA1 SHA512

          system32.exe

          • Path C:\Windows\SysWOW64\System Config\system32.exe
          • Size 600KB
          • SHA256 3c97ea33df283023d876774ba4e8568cc94c00939b7b9f0090b5f38975ed316d
          • MD5 SHA1 SHA512 SSDEEP

          memory/548-2340-0x0000000010470000-0x00000000104CC000-memory.dmp

          memory/548-687-0x0000000010470000-0x00000000104CC000-memory.dmp

          memory/548-19-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

          memory/548-20-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

          memory/2568-6-0x0000000000400000-0x0000000000420000-memory.dmp

          memory/2568-0-0x0000000000400000-0x0000000000420000-memory.dmp

          memory/3264-12-0x0000000010410000-0x000000001046C000-memory.dmp

          memory/3264-7-0x0000000000400000-0x00000000004AD000-memory.dmp

          memory/3264-5-0x0000000000400000-0x00000000004AD000-memory.dmp

          memory/3264-8-0x0000000000400000-0x00000000004AD000-memory.dmp

          memory/3264-3-0x0000000000400000-0x00000000004AD000-memory.dmp

          memory/3264-18-0x0000000010470000-0x00000000104CC000-memory.dmp

          memory/3264-1368-0x0000000000400000-0x00000000004AD000-memory.dmp

          memory/9040-1400-0x0000000000400000-0x0000000000420000-memory.dmp

          memory/9040-1393-0x0000000000400000-0x0000000000420000-memory.dmp

          memory/9112-1403-0x0000000000400000-0x00000000004AD000-memory.dmp