Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/07/2024, 11:07

General

  • Target
    77fae4b264c13ae70072bc99dedf3027_JaffaCakes118.exe
  • Size 332KB
  • Sample240727-m74xdawerm
  • SHA256 870b98cb1045e9c098e16f3d957fb5d6ad322cdf21fdd0754a5a9f5e6e4d457d
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • veronicasexy.no-ip.biz:8080

Mutex
  • jajaja

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    update

  • install_file

    explorer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3512
      • C:\Users\Admin\AppData\Local\Temp\77fae4b264c13ae70072bc99dedf3027_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\77fae4b264c13ae70072bc99dedf3027_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2204
        • C:\Users\Admin\AppData\Local\Temp\77fae4b264c13ae70072bc99dedf3027_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\77fae4b264c13ae70072bc99dedf3027_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4596
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:4440
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:512
            • C:\Windows\SysWOW64\update\explorer.exe
              "C:\Windows\system32\update\explorer.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2932
              • C:\Windows\SysWOW64\update\explorer.exe
                C:\Windows\SysWOW64\update\explorer.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2136
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 568
                  7⤵
                  • Program crash
                  PID:2280
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2136 -ip 2136
      1⤵
        PID:3396

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 0b0ce108917f3bbf17362f586b44598090c27822d3149c18c3de7f8438f24241
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 ad25076bf3f0d5d39bb15d229f25abaa870fa9e9f19e4f6c265258d32793f371
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b557b92f1fcec119ebc2317c9c0a5bbc04f5834febd633e6def864734caf718
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60bfe13b1680e8637fa71ad0402e1206be8cbb1abb8c105ef9f9da0de985e47d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6b6927889b992643b6c1418703d83b9f3bde6448f9cbe9c8d0a1b5e9091572f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8efab2bbded8459d4426104dbcf23c4bc68d787bfecdc47ac223415ce7cb0cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d4c5d57f48f23bc6529ec9686d16d2511d518b5a07224dcbe290974d04379e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6d9c1254b6f8cff87e9607c078f96bc8dc4f826d5a7a312f36847460584e652
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80fe1011718e4d6afe7a02317e288d4b8ac94166c5f614dac9c559f0f0f5f71d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6202a738b909005c1694be359575004a6d2771bc5f3147aab87a535e327b6415
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b38f98af394d016d6f95fa0ace58b38a14fb48db01c98b74645e38f48010902
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c248015c19f2aabdb53e0b2f06644faf664cf9f6be58281b7cc39400c6972a85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de2794e0a86c50e117d6b88d49fd8d899b91e841ad48d7580a39c28200a7a438
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73ef42f48cfd089cdac0464781d7ef27f832abe76881f505f1b4444c14b7ff56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fda6adaf050067794842a96da7abe2a8d6d5e243b35cfce877c47b1bcf60f6e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6add51cff862799d782a29bb0388dbbff82a88d50f1df0ff5eb07f0c4be2479f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d09bde1eef485f7415e78ac83c8ddd0c1bbd5b347db3a186e58a4c405d27eade
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a229dc8a10fd71734cc581403c3ba119e99afe211da4817709f49df3b5b17d05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 800d03a65cbb8408abda374cc9d91c8edfdeb92b8e6f639bb6bd8db39dc41b52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f922208174877e9a9d0fee05c65e22a0da981bc01837a6aa78a184070cc80314
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 beb9bc89513bd08fc19818ed0687811a97141b11ecd0532f55ed80187d79e4a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ef60d596ab6d38ed249ef8db4425331f7ca138305b56fb19a303ac27294ee57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adc01f020c173c6dc67461ebfc02779dea3601b398538077358061a116ea28ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe9aff9410b882035ede392d66449e03787bd107b0e0b6d1cfb3ac9002c3a82b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 542671c8e6177e09ddc3d146f57383a2a84f3f76d0063f0ee434953ac180f11e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ade23893ccbdd23e4348701700d9be5d0ed29fd2361c740bcfe87c2fea14ac2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2b735fe1d7ba688db2243aed732a1e2437391f7c9272975f33ef745504ea3cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 380292197041b925cdd1409c28dd53dd3adbd2dc8ad0eb3a8578c609396d6e53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3cccf37a9a731100a50d14c121402dac7da98d1730dee1e5feecf63ff14aaf01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d2ba00ddbd03193d766eff4107577f4c04ef2c72cba22abdbbd2929b57704f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3d5f8cccb5a5b4e462c4f105aeb6cea0a4a49fc87349e59bf5ca5b16bbf3a94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e8dd91dcf77349da0858a6157689cf858c327931254a8311a0fcd7cc00e29f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef1b31560703c4d28a6c2357be5361032c6379f604329b69225b2130277108f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9dec6394a6a3c11dcf768890bdcc197f2dcf3c2d0bfcc4e4b6a27ac9a5f7799a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db05cbbff733edec97876f42a7dfa7517cc696fbeaf48bf666b0fb54425db97b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37c820d918bafd1cc5b64dcc4ed8c1d119e35ce4e2cf629c6363781dfb56ab6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0cb8e646c6a009f225322444fd44ed3393c626397db5d2f4e0bb0c2d89e63cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e146c8c9e5bd83179dc7282ce05240a4517b78371c128373daacb4d87fa2e234
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 930c5f80e422d20a4f9b16d0dc6b391c32e884699b8a4ff599512040cd96a8f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b531a26c448af64f426de18a880311bdc54065cd5376d8963cd34e62fd379649
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c71090ad81534d772cd9f84646318a5b92f5aec6bb69a68092f45f2e058899b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8764435098f3077e74929f20087e5360f6250132eb5708c7cbb655092f49ece8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4f9acc20f86238c2a1385ee777a6362572ed2f513a16ddb4ebc9a4e8d0c2d86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8400f662e700b9de200a6aee423316e6199ffbf472978fb92a61074cffaf5dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03a712d0f6ba360a96183f1befd7d0036dcd0480c366289bfd9728adacb0c21e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 faa2952ec8db55c8a05214277f546ef0a4ff0195d61bb5e24ef0cdcd839e3677
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd125d5f30ce232d2874a02af54f5edffa42c7e5671611dd1f3f0ad84652e60c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1de1e6957c3b86c4ea8afffc4aaa050b0f554830e8164ce7fd242720ffd75f78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfed8cf319a04a81c2c632cea775aa9dec77716bc6f32d274be00cba058ff568
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b01a4e59111182790a2ea8152e57f959d0804f7782bfd18fdaf66d519e30106b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e0e3cb5be99faac71a9fd2a764a9ec59ca07ae33ab7745f33c20f3a38e70735
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d148f1f394885db9d556ef0fba2adbb6dc386c12574959fec1599a90294445f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b03894163845a69e06b0ece7cde462382306467908e6d2276e31b7342c061946
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9fa9ef250104b0775f3dd75250b369fb256012f8347044ee78741751cf7df902
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29588ea76a76ebabb215b01af47534ba7bc1f830c800110f6e6a60cbf4f73ff9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6faeab13210a5ba0da8de8d6e0f2e2a24a96771e41870053b463de0562627cb0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 560359d3cb364a6bdad444dcfab1e64d7330cca5e011b746ec9a39e3b05da22a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 394b882242d96e5379325f15e07c93e46031370ef609856e0f3699f80973270d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d7c9aa27622c4a8c2a59834efc7f731ea099948030de37fdd0c047a3365817d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa7259031bc6e2d9ae9aa8c745725b33c9f3e1f7e7f1466886b485dd3873892b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04646bfccdd255093df6a51be00cc1e88bcdf0ed49e54f12bc6e65d59b34efc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aaf21129bb17018558ffeabfacdfc8de0ed674946c3025d3ccd01e44ab9895ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d11ba31ee3cf780517441a4096f385c5f2bda7add0319ea7a60476aa490ba8ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df3acd777b1771161c3367e2b816057b9b57c9084074a95354da344d58dd91c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fd266f90b85c4ed0005da1d17fe3ac08204e9ad40be1d92ff05755e5dc8b9ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa7da682ac4cf6946b4e4445a713c7416e3ca9b63402449c092a3a070e44f559
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9331935c4f2c06f718e3162ee4ae279ff4b9023f9b8a0090be4a8ab2a3ce8acc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 087b8932409c082bf692cfda1218bd5cb25348a09a1c45a5745545093220568c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c479617bdff0a017eb864956cd7229fde4a915c8256c3517915d6c8f4e12208
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b909f9f9a1cc8d39fde090d1d68adde49ab4541e26d17e9d54df641943681010
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69edd96ddc894dbb9fa4d4ecd8422c85478e812cedfd512d60fcb3390ae61299
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a90d433b6ec2fd93e0079596b8f2f3bcee4610a2744f032fb0e3204fa956e5cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 010fa1be782a69fb9e5e5a00220e1ab121ab90748498bb5dd9b044a13f00aaf5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 546c24578e950fedf5efef0d65fc910cce67cfc405e2bbef5e8472509b0e0a37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d56bd653013634f4863485fbb2065ef11bace1f0fa8345b5a973ab4b94aae0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a2f877e437ec397b78bf52fbc28300328b964a9cf193ddcb8458f1aa8bba907
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 956d648e675509f96dd9fbef628ddc247211ad312ee34bd6cedeaeb4a1550342
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 634614fecb3fb8187939d9d088da72d840cc7a9ef91e9a631519a0e1a48ac998
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99976b03dbe2c4232bcda2557b3294f8e1dc0416689b0dab0a7acfab3bfb9521
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c143a8d4d96b516a04a4675f10bbcdf7bad8df239708f4dd31cd89c83e507621
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6e07db35933f910e8febf758d080bbda481ab8a57f56a6afa413795d2504582
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3125fa7d0e8f3c7561769fc88694fab061c50b4c14a0dc3b0af37a42e4fd043
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07d59037c3c8aea607ec217bfdeeb92754c4806d14c56c84fdf97209a57b3c75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1a8068772da44513cf84acf6e7301a23fb7d4cf6b6c8a177fec7735e7b873d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4b5b29562b6ee2e0d5ef5cc5c278be629874920d8615b4548017a52e4c832e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7edc3bf8bd7ecfc538db2894d481b0b32b6c9989f3ecbaac55b96f6808c6559
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1c8ed124537fcd1103e5118fcffc2804c1ae510436ed603bff664d6203a5010
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9c2bfa2a54873b61264fb129429290360a59e53472c93eadc3ecf3384c3ed01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c7aa708f755c111065167eece1e5dfb27da31b688753f100a5b32d017b25073
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d03a89969616192be8f63a8282a015f708b30b594f37af9b862cf10f5d79051
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9ea625893deef8d1bd3cdb1298452dbc411520542c9e8757fe86a6990702700
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 754ae5ec074277fd055fe1446fcf2e939ed780d3779d3392bab193b0224631cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a1ba846a77d9da3839c317d0f46472869b52cc1f74eff80c9318772a3bd6e46
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 711dddbe23cfec7d96ad86981b81e24c8a8c60e8068d97d77df5a068bb52a111
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95f22031c236e026955f7615e9fd86dd07e6e74cdc7f4fd0993986c88df9f411
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03c3e1a7f3cecb51280c6c6afac97cec3af8a7435780891c79e92b8e2b8ab1f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 beef55e1e7de61c777344b3aacec386b0a66965ef3e773ccc308d045fded8084
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28819e92a497cbf70c83763fbc6f8ff77432db58ecb410d47bdff61bb1f62aa7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b7fb297a4dfe869e3153ec104cb2cf4010bc2cb41f6da0e47301d52e3c480cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e85c759076d4a26edb7ed3356bb8d77e9837d2235874b5a6d2340746cbbef9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 855fc23c0b58c3e5c6276f90fa66096028f0b927d65bee481e38108bcde3d2c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d26cb946be29979dac2b78673a9625c1d09dc430146bec0132d50f1477476aea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 308a1c9b2761dc0185d018355118809a21ea80ec4618d171deeb721f3290f8d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84cc62849cd4288caed2b531f81de396ca0d739d7d0a915bc4f4f761593a3af8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 472845f6a099a343ea75a659036e7c7a491d81b0f6c7bb2eb41f03a0b4233eba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f40f80556a2184b13afa295537ea7184f0701d122c5fdc73a952001b898dd14f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0076596f7750a15bcd690a4a1317cc76cbcecbafd929e342dd5bf1b0bbf10d94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7944c07e3e271be1c4ab4aa68802d79e9bf25817e747f264ee47562d8712ea28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06a6104844b3d27ab41ecd4b73522889bb5c87ccd99891bbb2092758b7a2be4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f32f4b55d9bba086e6eb7911619a80fbe1b4f8857a74f06332e9ec0a0cf3abd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c68e089676ceada0ee8db29c675e234335dd78e96f6cd0c79239766b9afa192c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 717477ce6b1700c20f0fe9ded202495b18b7412582d1012408bca9cfafc9bb9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b637a87cc567f8b5be21d97ae1a64731f7c8522cd5f6c9ca4f9d30e76ae3d216
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0c89ce518b1aac7411c4e26e7cc306a73cbd29ae0d5aacbdb6d0d68222f8513
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d212ee3f19e85ce5209db313371a624fc4a89e134ef304a8b69814a01a35e35f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2329aad3682da1ed25350174f82449bc8f084894b921f1b3c6e0cbf1dacfa9e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be87626e2f67cf9d135641ac1198bf034f6d2986715491a6bc6a084bdd487460
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8992c5620b17880be72f903e3026ffbe7db18c7ca03f10d93b1ac59a37269afd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 434563aebf8eef92db0a99e73a9b2400ed12a408b219967bc26f8115b75b9f19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3007ba03170c956caafa8a83d68e3578a022949ebc606381365550b8a7e38ac1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8865a1d3297aedbd16e9f607f8d9e53fe2237ff5cd998cfa5a3ad754fef28c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cde7d503f4ff08b56601085499f2ed1bbd4289bf68c8b568d777ecee4cb82bde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c177fad73ad44564030bbcfee6e9828ac9884cdbfa96fcba1aa209b603a887b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b54a7e14601a57bdf726a7d6394fa10b33055cdb6cdacb2dc4966752c68f3aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e6e6ad1a94109b8d87be63daae19eb5b5b434d1b8e92afc73288921ff3ae6fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71b2f7ccecb8076ab73ab29443fbca3c8fe2cc5f9057f0ad41305e92c639217f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d1943733c45cdf465b28cf368e8cc5d6b4abe028cc208890324aeea983c5706
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e32dd28179623cccca800eb361086c991c0d638ae28b3bc3b16ec9d71cda21c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9868cbe69f3f9b81e15c5385f55fd6367c3c5f6c2349e0df6e84ace39e8bf76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8cf26bc3ec92c84e85c1d20dc5f6768addf77422a998e30d36196a201b58359
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a001f8eb18bd16a6a72ccc7953881b3c839c6c7f8ed3b84db2471d5d228a1a05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c92b26184a0957761cd955323d99c51ca17a5fee8b4286b18cc28f6e010318d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87ba84af725ac44447ec0001b412d515a56c9eed98d2a95a6e130ed1197d5723
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 456dfd8c417f1f1e077ead25bf07b54e2315e44d7694dd6579158ebf14e08c29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 839f20d9eb2e506b467754b67cb988af460c02141b93ea99dc574c6739d2fb7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c3859ac376792ffe5f4c7144dac5aea636e6ebf8c1eabbe1d434fdbf4d04078
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c30c49c1b21483c47ba127104d0c6d37eb42e456283d8263ecd16216b865583b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63db353b97b5b04a75eca85f6696eabf3659ccc65dd2a15363b77bcaaa9d1e73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6465d6b89167396b07b4859be0620e38bf6738a069b5465288c57ba678ee51ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a1f746892dd51cdbc99f287c1b3bf85868361c496b3ec4c757ba00cad5c987e
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            explorer.exe

            • Path C:\Windows\SysWOW64\update\explorer.exe
            • Size 332KB
            • SHA256 870b98cb1045e9c098e16f3d957fb5d6ad322cdf21fdd0754a5a9f5e6e4d457d
            • MD5 SHA1 SHA512 SSDEEP

            memory/512-143-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/512-1322-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/2136-174-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2136-170-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4440-14-0x0000000001080000-0x0000000001081000-memory.dmp

            memory/4440-643-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4440-15-0x0000000001140000-0x0000000001141000-memory.dmp

            memory/4440-75-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4596-2-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4596-13-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4596-142-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4596-10-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4596-9-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4596-6-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4596-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4596-4-0x0000000000400000-0x0000000000457000-memory.dmp