Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/07/2024, 12:33

General

  • Target
    783a962412e5d5dad0e1275639854f6d_JaffaCakes118.exe
  • Size 771KB
  • Sample240727-prn74ashmb
  • SHA256 ed811d99c0f492029f1e8462a462d021ff48b6e2ea0794a7deaa41289f74cce7
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • deneme

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    system32

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    nazan565

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3452
      • C:\Users\Admin\AppData\Local\Temp\783a962412e5d5dad0e1275639854f6d_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\783a962412e5d5dad0e1275639854f6d_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4864
        • C:\Users\Admin\AppData\Local\Temp\783a962412e5d5dad0e1275639854f6d_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4388
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:3472
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:5688
            • C:\Windows\SysWOW64\system32\svchost.exe
              "C:\Windows\system32\system32\svchost.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:9112
              • C:\Windows\SysWOW64\system32\svchost.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:9160
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 9160 -s 568
                  7⤵
                  • Program crash
                  PID:8696
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9160 -ip 9160
      1⤵
        PID:8732

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 0854c5be003e7158ccf42e52852ab57059af753990069dc04ac26e7a6a6ed660
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 588KB
            • SHA256 5c305e71637229c8672e396d408031ca152ed5e6ce963a647405caf3358cd2c0
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe7fe1049c922fcda8f3e0a2f622032b14d4feff1c04b123850c8c35d4d0c48d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39aaaf2bc4b9da94f97df8a3e0cc28e10d5c6474a3ae95e669bab905ffa1953e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81efde05a5f4e2fea0a0179b20629e857c6af3696b63ecb8df32c3c8b7951d27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 283ad50ffedfa23f71d1a222777f366964b8f7b7cda4007d4b6a922be68cccdc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d48b3d554be7f42d6dd5ddea747bc6d329e33636f5ef8001743e8be1843cf58c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf39a5a337f92f8f8526ba9d0eec46c13ce2844551636390cd38bc438578be1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b69d67ca27667acb1024e37c55bb72bf509d55c8f50917c7b26cea9d9e2229c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26cdc8034ef28bd9ec1b0f431b0e45c230ff8acd77aa68f2782930bee57672f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12a832814e21f6d02abcaa00bdf5e2e836aa1508ceb42cad387facede4b90e5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e7850f17aae86057e92ec54d2f50862b516367882764e20210322f47b44f13b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a6d8dd1d9bdc85c70668b47c86c5d9dcabb1d1c15b62c33d6cccbf3e58d2cc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96a2e658adde43ead1cbbddee720a3a63809e026004b5f2e5c829b2dedceb8d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1277179723a37b862fe04bec53986a27e4b0494f78ce830e685e148b3652ce83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b19c416b9159bfc95f2113a825897ee9fd4d345a32cf724997cbfb4ae34133eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31f7627d9fcd45e806ad7cd802b1e94f6fb70795f3aaf0d01f6979b89a8bcaa2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0857533f14dbf3651df9b7cc42dfddd637736894ef52d7c22d4126d735eeeb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b798f44bf526a298d4f50d9ba51560925ca51f17dcbaf440626ecc95dadd01e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 253197ab69eedc334e03dfd9060c3163ba6b4479834609f7e2f4893a6a0886cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06261516cd5410cdb1a9568705cc3887ba492c4be59f88d835f70c9ab435ba09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0505318d259ff2c3a225236a580e37c7bafd8e6f9a13f0041f1b2b2a3601e7a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edbd3d7f60cebfe4ba2e59864d6a5338a2d4a38b6a0bbc608cd9ee0ad452ce43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0605660d9aa28266a45149afe7f48b0d5d48f2b0bd7df1e7db3743cfe625210c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a602d4b906a41b3c9ba4d16da5c9d8cc9b712da520b097c8b39edca9a2ded98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 272f9a5752b678d76dede69507f16ff092ebe1f48a4b7123837ec0c9acb62b9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 589892e8706dc13c4f34b2d844895b634b6b6654e84afb3b2d1ef1b1fdda8a3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91fb95a8b0529cface117a0acd1248f96eb5d58d28abdcac908ca06bfa6e45e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e27450dcc94297e9ef8acdb6c7666b8793fb715386ac0ffa0c53ce3d808ba19b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 565af4da84fef644bc715217fdb678384ccd481c6331d5d68e437b1a5d2dd8be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e077d576a7553d769358fe189c9591823b167aab03cdc180fa9f6c3111522d77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f38ddd42d176adebcafc5330cdf478a1c3cc63dc4a67f7529667ea65d06a72fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c6bd4d0c3473e17014dd46a28a8b14036bea6ee55378d0b68c8e9525f3c070c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d5dd59228b0ef52679e7c13a1be659382e2b9127a16d7978899bc79233734cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e91b9f1fa6d511720aca676827121310762df428f518e10e82473605c022852d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a3b204d9d6373d9e7b274f3bc8003558ea47f609e56c115174a9a178491a455
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 850edb287bc4a290ef1d8fa89b85cdd599aa3156a2d66054d3f3cfde86777337
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48d21e6770eda9b409dd296b4a4f10f92381b811edf8c30f60e577a9f103d670
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 031222ad996c060c85609271cd07771ce40fc15445681331e72f6dfb63b73420
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7802cbf7afff8c6ad8b8fa5c2ac2427e280bea8c6d8f900651852bf22cc42369
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 378be843639058b612adcd22b1ca7de0555251cabd4e127a8371073cfcaeb540
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81801e17684febeccf29ff138c38a81c86432108ba76ef5f49b3605a2b8e36f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b8e2b97ab6091cec8a2279e040a3902e063aa5ee477d25ee3fb63a5c3adc970
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 541a0ef4cc99e9523539fb56ae69568d2360017810f8293bb63b92fba9897d8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d23cb992a76cc407ffaf3daaf34d8d3fe11272d037d2706d6ae5bd6f05cf458
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8844637826c8c3839e8d89b462d5bd32d494b12120b28420637683100a793faf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcfefd2d9c17896cf83c3ec007c1df38f375d0c30487f7414265ccb7a5ea3cdd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a1699609ed79e57c584b54a6cbce7f98088d476b31b6e25ab381c6c315b80ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00b569c258c64942d4dcb689a86c1319c0bd853eb7843ada4d09c37cc12f0749
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b735ef909821478fddce7a767575522673163975845db53c62b90d4e95f968c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d549831148b23dccb6f38c38ea8d6a5011a5bae291d7338cc1a20812a406859
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3b10bcf8d623d054318320d0bd6bdb4c952f9ed6e3a34631a57d98f551eb82d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1eaceee8a6a03ac61b9f39774c78f4be55474e49fe27bd680b5c9bc7d921713e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 141608802f825c1404c6b986a32efefe8de95ced90f461088dece1833ae258e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e40fa0da74c00cffbac678bcf36ed0f482b05311eb1c54fe36cae82cf0a84bbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 404dcb533be451ba3a99273128087bf49ea148bd2161c5b94ffa5aefea5b6ddb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fe70d4d1fb71ae373d4ad58fed5b4c0302328bb8e34613e1f4eebc9c012caea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5b37c48da104e1134b2ff2f631dc36636d0b17b8a33ba0daa3d989abb8c64d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddcea79d73cb6cfd17f41d3f4b19d6155af6cd2956447c4bdf88844454a5977d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cff1919cafdddb173f96c7ed3a4e74fb5198ed4b3e07c5b34130bf4c1971122f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63f519c59bb69fbeeb818b0c3f1344a1d448bf381df26418d89176e753942a17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48e3e0a9c1e7b18515f18dada5dbd72aa91c1670bcf3fe8136a4b8e86818237b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11a0481dde13eeb726b1cf924574d6b16f77e03913b7ec5fa84defea60afd845
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f30818c3d398748560265cdbcd196426cd1a263e2c5a2a83fb11741e7251af1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccb6a7a8161b9557adbbb3653d2aee69f39b2c84fca2eb34aeb8bd8e0ce9eee9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3feaf5a3351a115661e57efbd720b92b47f4405fb8b7f13a86ec7594cf67b377
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84956c9f698de6a2db3f7eaaec77ec3131298f98e4f4560dbfe87abe76b5bc6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 272ecbab00619fd383c5fc3ea20f338059e5d3e3ab81def19f8eac19b6295d0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e2770a3ddbba3ed5bde2d5813a9a2f85fab7c289736325d82dbec1dfdf05897
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf215e068b48d32cb0600274c6b521b96c0f988e02ace771a9f36bcd36c3bf2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dcb6b4f675c09c52183893fa7187d6ae8001164437d1c7368d4b0115b42e6b21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee600321a7d325aa64d73b4bb62ebe32cdbe1ac4c3204f4953793eccb3cd5700
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aff8ed5e2e9bf3ce27330c8b01caaf91533bb2d512deb3655c60ddbc4b0772cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 544b58d65dd0442aef878db9251bae39926e34323fd384e80ce4c628b8d0c3dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5736b741c2fe66aed714b87620a9b30d8cb92af8dadad4f448d132a1fb815e55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54bda1383cd025b8e1ae713740f1e9b7b7096a38d1efa3250b2e76295c0477a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a689a0d8a72b78a1113193376b56e6263b66b08c0f15a502cbe0d1e9c3f16825
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7e2f9241b1214a11b6f028aad43dac457b298facdac218f306e12ec68c88fe4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 188a64912b357e2cc180496fcbc15031aeb5cb0a6292caedc2afbe8d7c8c86b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 500b5959edbb8c95fd6e66912e1e6a24d568cccbc0a630900c7a204b213d5902
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0da06632f9240d3254dac1e9368038dfeedc55ad7a339b8971f2ca2f9f7900b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a315f7d369b031e76794246b85499befd1cfea3cf54bc268f34d100a512cc84e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d32d2e3a8c99d82b69dc06d94bf665f619b5b2b7fd5dcea121f3d2a87710b2b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 750e604a1b3d0c0ec25d91192a0dc2e2307d70b465342aa8764de50f58253d96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56296cd23b9e9d832f72152eead70c10689215601f1a2c3fc05d61c199bd5911
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6842092aa1ab0059ca2f129b78c16bc4b7a1a23e196103d19f37cabb8b7dc910
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 544b97492ebc2430af9bf3a12389c49296b6de765251b1f1c443171a1696db90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e983af0af981c738564cc2ba81eccc9e66ee9be4fdf23e5b3831184c8259bc6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9290e4ab011909d85d941487d94faba8cc5c8b0f2d98b33e5bbabfd6726aca06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e62b1b9c18b9b518187d2388eebf43b8091e4390fa5079c75be13ef475d27312
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39f4ba2ee96265f4cb086fdecba7466f16cc764ee2165899fde16a98c9d62a57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22989569ceb83ee2d5f9cd7cd2773c4e7f6f6ed76b5cb88846bf582cdcaf6022
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b09e72d88e92bdbc26327f3a45787586f6c3accd902bd645546de98f05ea01e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f404167dbac55d065fa54d2db3b4acac562d4026da2fe0d3bbe49f2ba5c5bc5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06fc8efa30888f57f2a38fe2ae32f83579c79ef99a44a5264f2042009910d13b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42d52d17bd1406ab78eb9c197b4afb1f8e7512620d431fb8a4295d4fbb20b687
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2257b4132a18d13b3c5d2cca8c9d336171ad5e150bf790221293e407ba162581
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c530899790fb0335b6d5dd499b3185693ca860aa0280a5ca8f51328881abf316
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86f144a7fc159320fd8eb3ec2a0e82aee5e692208bf5bab0415e7b557e66e3a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f11fc7c915627300a1b7eb374ef5dd7b9914af46247c2b66f0c36dab26468b1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aeebb2ade714e6f2a1bcd422967e5f0b9e4774401dbe8198709a58ff2355031c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f21e23f6211021c775427c31788d35e4dcefd8438681d0c8acdc77313378913
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e37bc8364bbae8c3506f19528415c5eda9139f04784003e2e260859402399819
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e634f21d26404d64126444297f49af36fcf09434833e1dcf16da8fd6d95dd713
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17a3b231c8752329ea93eda03df165d3d7999771053168ff0451113b07899aa2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfe876abf5c1655228940970475b5d874d0123a742c0be4bc182dd2ce3d4cead
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ddbc252e4ca1cf3c636d8aed500f3a7f3e8e69aac17091a481ad87d40c85aaa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fc9079a431701030971190c211ebf8c16bf6fd09a1ac4e8cd65c123112143e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74f147cf57954ba8d890e9302e84704730d510b01710f4a2589718bdb8e91dc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02e03fae771e68bcb5a004fa7db6774ce59a0eb0bcfd31d7569aeccddeadd569
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b1eebea0c4043b0f645080250c6962ac9f5fbed2d30207615fbebe8e98e36cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd1a1864a26083c0ffd6f0d402b02c001d7f863cfca08ab821100902db895020
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a127dc6846b5286bac7d309d812da16d315c34d8fa0fde3af34caac201e6a2c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77d9b31fa5429f66bb7913930cf1418b443187ad1cffbefd9d7703dbdfaaa60e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20707ab26deccaf5003d908fbfbb665f8665940195db8f47500dc86c08b6bf98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79b805283b53998a7b89a102622fb45c2ac3d1a1dba4352497a38e21271aa353
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7856f286afbd24ed8e5a66578b987cde727cf6bddfb865993fb4eeb7dac5ec34
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a2bde830b6594fe20b3f32eb8cb52a8dab6e4aa40f7f4332b68f7b10ec5c4de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fa83860ac27c7c723ec3126964b7a27b8a902272a852f6757184ff14049a39d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 407b8983f44ac1293205ebf187ee63055b855940d63e3455a1752f1e88522586
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e88c9a412c7a7ee4951e6ee6d142368181e4be046f79d0179299f445287d6b84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02ca5f3557dc06227a4ff6b5bdd7ff86d6b229c4640e6954e3ec30a3ceff6cbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eedec197789ef2590c82ce21afaf6c552773b60294c76550f28cc7210ebbe284
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9fd26e9d1b8350c091d36afb20a24279cd2c40018f0dd3e2f75675c6f247f67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83ca844994ded9c4e9ee66904f9072d5683d070d32220149ec018c2c80a15743
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4aa379d574fa204be83fccb4e30ec32a217a71469e325b66ebb8904b9654866
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c5d9c2b9d3b65dec8e033811b5f7fa796c1522cb67ff4315ef2f1f1268d6bf8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad26bef8f3c80d70d37c4eea58ef97ef2c2bb536b56e7f5a7f1be528a64635d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60b4eb37e6ea4710ad544e298b066196b6529ecdd3375b6002a4126732f1985b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 275fe8d46f0acd5a4a64976bbab245fd95043754403d7ec69353b85bb638928e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23c97687b937ff332f9015efcb368b7b4a8ad655d8344a8c80ca84980529537b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b89b4ab1493207068ab4e8be24cce12b3bfcd824a65acd26b1e4b3822781f5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01dc9dd8d30d42c35b090520d13158e08d3813c61cd84d5c314afe1263ea554c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88f1e6473fbfe7f5ba67da744935a900e34505bfd7181df5cfc7a13fd940d506
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20a3e7dca04620a26569bab7b3da7b30178ffd63a84c434cfa487e9c090739a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61d66214ee47992bd1975db8616c6326fbc800247b944f4763e94fc4c31078c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03bb22702edeb61018b6198cd771cf85feace0720d026e60c5f6e9f05dd83004
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acaefc310e3f16fd4829608a123e3cd2f3873745f049e005b277cc5174fa8b85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e84e597967f6d0ec31610a467fef1276e697693acbd109f519c0843eada04035
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41a1dda5066ac6f0eeb4145c302786a6519f52384945dff136fb7db6c68e9dbb
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            svchost.exe

            • Path C:\Windows\SysWOW64\system32\svchost.exe
            • Size 771KB
            • SHA256 ed811d99c0f492029f1e8462a462d021ff48b6e2ea0794a7deaa41289f74cce7
            • MD5 SHA1 SHA512 SSDEEP

            memory/3472-30-0x0000000000F70000-0x0000000000F71000-memory.dmp

            memory/3472-1864-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/3472-697-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/3472-29-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

            memory/4388-18-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/4388-14-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/4388-21-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/4388-28-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/4388-11-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/4388-15-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/4388-1371-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/4864-2-0x0000000002290000-0x000000000229F000-memory.dmp

            memory/4864-13-0x0000000002210000-0x000000000225A000-memory.dmp

            memory/4864-4-0x0000000002280000-0x0000000002281000-memory.dmp

            memory/4864-3-0x00000000022A0000-0x00000000022AC000-memory.dmp

            memory/4864-17-0x0000000000400000-0x0000000000466000-memory.dmp

            memory/4864-1-0x0000000002210000-0x000000000225A000-memory.dmp

            memory/4864-5-0x0000000002210000-0x000000000225A000-memory.dmp

            memory/4864-6-0x0000000000400000-0x0000000000466000-memory.dmp

            memory/4864-0-0x0000000000400000-0x0000000000466000-memory.dmp

            memory/4864-7-0x0000000000400000-0x0000000000466000-memory.dmp

            memory/4864-8-0x000000000040F000-0x0000000000411000-memory.dmp

            memory/5688-1372-0x00000000104D0000-0x000000001052C000-memory.dmp

            memory/5688-2318-0x00000000104D0000-0x000000001052C000-memory.dmp

            memory/9112-1404-0x0000000000400000-0x0000000000466000-memory.dmp

            memory/9160-1405-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/9160-1409-0x0000000000400000-0x00000000004AD000-memory.dmp