Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/07/2024, 23:07

General

  • Target
    7a66fc9d32462a7cd7922a1b85878c1a_JaffaCakes118.exe
  • Size 547KB
  • Sample240730-233wvayclc
  • SHA256 989b8d09dbd7ac7326acc6e2a5e0773e05f8ca2f651be191828edc1357e387be
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • fakerafake.no-ip.org:83

  • floukss.no-ip.org:2000

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    installz

  • install_file

    avast.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    avast

  • regkey_hklm

    avast

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3500
      • C:\Users\Admin\AppData\Local\Temp\7a66fc9d32462a7cd7922a1b85878c1a_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\7a66fc9d32462a7cd7922a1b85878c1a_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3552
        • C:\Users\Admin\AppData\Local\Temp\7a66fc9d32462a7cd7922a1b85878c1a_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3224
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:4064
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:2948
            • C:\Users\Admin\AppData\Local\Temp\7a66fc9d32462a7cd7922a1b85878c1a_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\7a66fc9d32462a7cd7922a1b85878c1a_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:4652
              • C:\Windows\SysWOW64\installz\avast.exe
                "C:\Windows\system32\installz\avast.exe"
                5⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1472
                • C:\Windows\SysWOW64\installz\avast.exe
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3328
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 228
                    7⤵
                    • Program crash
                    PID:1960
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3328 -ip 3328
        1⤵
          PID:2648

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 12ee533e381853260f10190fc90e56db9bae373bb1078341665aacfb1a951c15
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 2309a7bebaa5b793e517706c0d8d97130865205173af6d4382fbf84079a1d732
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5c31a4125b79ef2ee5468ea09cf9efbdf7d729b1122886c9a9f3bae3fb4ebd9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 498da53acef0d4c1e507f77f8639d0e7bd77568308e2db0c36d077de84f97d36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd4aebbe6bcfea7ef3c4adab18e92a8eff411a1be6e0f52272a56fdfeeba8a41
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9164aded37a8aa7edcd8455919e78407d45dfb374e101d65abf5c0c8db19324b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed5b839ea3e3c51394c7456332afd64cd4e261a0b0d130c9f0359ac86472f886
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1720c145a5d8ba67e966e46560a314460809a65eb0c76a3daa8b8da84b054f8d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 751b703139e7880b0c59b06a575494a015076564af8e6307ecedda1fb80031e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d731fad4ed8dbe39a3f91deb07f50eb5407aa309916478ffa7307e7ee2e535e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1cff4ca18e0b0eb6ae9c92e2d7702667a4a4e81f79ea1246602114f7d589cf5b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cefd4692494d2e212433af1893c6856a222b793d59c8db7ad6151c4d19815d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7ddda0bce9289c3d947bda985971e0592739cc507e7c8a3798c863b51ec18c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 452f1a574e22f9617cfa685ea8b05bd7f46db221d2a3a83ca2e9fa074d612a02
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a5d782a020f2358a6169db43d260d7868990bd65e1da1565175f3c9f7e18968a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 80dee3e21d886cad675183e58456bc9d3e0375345214bd16d94c87742499761a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c98001a89f5d10d5dad19a424e4a4550bcef3050b9377120fc1f4f32f3b5dd7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c48fd47d9d610d42be9baa82ec2f6851c8e393b6740317d8520f4c7f259f357e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 659076f27c80ed28ced228eba9efdb23e2995b775e5dc5bdd369c1aa5d3b6f5a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2a3d85d84a9e2d90ab3b5f641a9d2cd3ebc28128bcb0d050837e7a07c29c67b7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe0e97fb60b087811d40690df0205d7ed77955f36d25168dd3eb17ed7d4883d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d97f3fc2e4e9c0a44fa74ee6c60d00bd0f92dae9eb4f1abc9c5f4da041700969
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60e742903e52a661d5847730c07fd0975c37aae0242c0c5a31f64179f6334ec4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 405f80c8d5963dc494c5d30b3ae56e25a2389f03cf635694ffcab260c3704af6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b8ffe3fa7e6ce8851225d19ef0106c3e9fac75a8fca04247b4178036fab1d2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70d79417de4c95f279a01911d81b7bcb7fb750df89296641ead3b617fb46ba1d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33347490f528714c5bfedee821cb60ce04067b17626f57c3737ee4a44f802b68
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 448846b0a1b69ffac25c714056e0ccc6595d9c954feea5972b6cbeb1628e21bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ae170cd9fe5a0b46a607729bddb9a6608f23579ece8289a6f9ddfc1cc7f2477e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 68b63f4f0d7b423173eb87ede5dd60d98a7fb2e8acc4a44e999687b2d681968f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ae716619ef5b78873de7cd3284abe01d4e08aa9845848d4d72ba511551ffc8e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ad3a713045a577e48b33bffec68a19ece17f7e805e007496968f98f4940fdd1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 06640f2aa65d1304949efd18605aaae31ed3b6a208968ef166eec13e0641c61a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a33d9d2a6b732554f80a710845f5806aedc27965fa805fcd9212dc65cb9b3f94
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3bc092bd923bb92295c5fac79c67ba86a2fae4e93e211ecf6ed76c49a6e07fd6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa0ab3b5907b7d010930559a712cce91fc51dfd609df618930624717c426ed30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a94870ea6189a402f181943e0f0d2738f600954531f6fbd9a611a82adcc26b0b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a139c4e57af2570cf441624bd9a3db79b9c23fc878a27ababdba239743d100f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba7aa31cf22ef8872f44b1b2026f55669e83f75704a1a2ece8c025de207b7b4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0440b579cfeddf32eab18c0b8789ed98e012c0b3b277cf8bc12eae31e8e9743b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6b309a0efe7fe649a8549132622fdf5184c410bff77fcb0c6bcc9b4cb0e46c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58dbea05656b13085cf33d029a29b6c28bd20db062e940feec631e496bf6f96a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 070cc87d837662c08fdf3f95f31377d80f5018442861dfc3e52e3cb4c70dd426
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 872b94932a9fc7b7b8bab5f3d558fe71d1a74089fce4ea611f7516db8d074f3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a23cd95c862d60955f22767ee124cffdeba6eea147bb641f6e599f9db39be96d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 377cc7e595de34ef454005e3b07a25f68bc089ba060ab324c596056b7d1c64fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c5ca3b90dfd06d1d1d05b133bcdb94f3a5fcc0519640cd68aff47e3b8292cd8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c7cdf55978978d964f4847aabc9b7fd4ebd52b5d6e33759dedb9e2c88e246fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a765c1da82e70edc6fb37afc8e074e7ce27fd15eca6fbda317249fa1e04273c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5262662ebd69b282e5592feefc65303109e1376cb98581406624c4a8c147fd74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5cbde2ebdc8c6916c1c2628a8b814d19780200ffad706c2175e896487a24eace
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31466cdcf2e132fbee0eb10add4e88f304866407f38d8b3c0779a682f2537362
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 074345268a0814bf95357cdeb78456bedbed3cd0000af7a928421a7b1fec445f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab6ccee93e55a4c3a3d472f9237e8d1238ec1d056f46425cb692cb52e565caff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6051698a5bf4cf66e3d4741060a151a5863322b302d6f404bd69c4be444f7e2d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6be13c344da77f2b879bd0c81de1c017b24d60265be8e7c2c1d8f8412e47baad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e48207de7bc53967c56115b9dc7387bea023464c9123db8029bf6cddd4721ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9893ad4fe8be26f7e7bbfe0002dbd53cc993d8729567661cf69234a09c5f491
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d642ccc0391486b7b632e7ada6d0aa87a773e72d46c896d8021953f0c21a1582
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01da910bc16545e379d84c4a65fc016037f91492b8d9bc05181d2d40e85a3b55
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31f8cf41f8c3891b66a76013fd74e85961183f403f2f9a52fbc745df5680c58c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9127c76a31ead9dde8ee0d65f2ed936cf96c6c9bc254e6a7d64d6a3fab4a39fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8400ff745ace3e0b5d754d74b412014686c0e230840a19817972e6a9d1ee498f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b729272da1c742f2190fd18955ff35b0c767c0f6f65fdcebc18adcda8a3cd7dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f457f495428e8b0a5d6f64fc2e53450f14d1deb6ce4a7c9c34aa33347f3b1e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f1a9baccc10313283691a5dc033893aa3a6ffd714226f417362b8e3b3bf6e94
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed48de313d95affbccba95e9305ee9de1673359e662d943126cc47638edca7f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 447259e4607908bc16f97436be7338b4ad9124d357782412adfa2c711d45ad90
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c985de04d8d5d59bd63ae0fe3625ee965f1dd86ad51eb42bb93210d514bf0a55
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f162a484422689b228576526d75b619e9f12adf0ba30acfcdf88db49b0cde2aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75e7d15e998d2ed180058cceb02c435d45d5afb31bf45b86956d4567b54359ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c18205883ed4c9b17acb45a401ef0fc91d3c66267fb9b743b457dfc34395d61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 969a4ab6ac7cf5c3293180658bc1290a41b83d93cf23c6badd47c6ba68316804
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ab80808b8518d3be222b56ad5fa89fe00999502a1a55a5c1973130538a48ea2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2fd9d24aab2b20f9e7f36213a8bb08ea2949ff2d7a10ab30307a6915951d6f8c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08fafb8a6b86689af67c13ac7a9713f391ad40082f25b5f2e4311f3ed09aac64
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 839411f5776c80ae9ff87df89b44e1e8996896b9dc4a091de99391c565c91cb5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f0b2f20c7a83c771419e7b9d3285dc63f6b1a1e6db773c3a32f8188f8fb0655
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6aeeeeee58c2ca972eb724e00219b171d423ebe30ed1160cb902585018bb3c61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 130473cb5f19f727364f494c8dad2079fb81270dda708e250ecaa8fc8b52eb5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a926a5ef621e21bbde370f8bd436ea631910d62efebfd84b9a3090637b9f73e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13d0d90a9dbfd80b7f38ca2cb40e1ae8a2c61955aa49b7c6778d227a1d20d15c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c7a018d48f2cc96902562927c957b208cbdc971da20a51e959aa5a237be1b48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aced4865a61c1d35174c33d3b2516ee199c0e9bdae3ef344c9c03735be29b75b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09d2529c8460509c54b78f513166c70686c9c9bca68a84e9ce713174b870a5de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5fac9de27a384d8c070eebfbc80d2b92641256e1db66e41281e9eb1912aea00
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55ca63c072f5f4a2ab8ee6d9c667732913cfd2dddb621ae70cd2426b5f91041c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db39b7abedf5b26bd050135e31adc42fbc46264b1d8fcf752a7b5fde58aab513
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dace3ff1312c8704a0ebfa0f647c42a7e37b7fb706fa09c8229d425bbaaf365a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f644ed2475ed1e9fad9c7c1f9f31822851d5e66531843ae6d8f75c2491e65734
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e7741c412d2f0048e145aa092884408fa1f415b6b9e4ebacc73b1051316352a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 26943862c021832b6aa78d5512e3d12b0493a9d2dcf89e27f3d8657143ee6654
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b666197da8e63f538f9ff9f9029c9f8bd8ced4a6c1cdfd7632046726da4e319
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 04171c07c4a093fd691c6d9fe93d82aaf85dc430da059c28db32b2d96b80e469
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c336c7b319bebcf27c67a3c433a748547dbb787adb5d4d2ea6b302734be23eb8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2a16659615c3b465fbd3e6c647644745ef25c45433399c23c0e57328ab549376
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56f780034b3fa0d55ed554466de376b647ce3d48d66e0e6a61d5e86caad6920c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27f730efb44339260a96184bd0fb7f4552444fc777bbb104d1d29c9e6e1d282e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f61e6619e547cc1861e02bd794f32b2e28c6e797b7a03803e51def346057ae50
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 840fe90ad39184d35e5113120313b60829381c9af0a66f5a86cff25ce00380b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 23454a4fbaddc92acf7f7f1993f649d0894f13a32d6930f4589338d8c7f04173
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3b4304eb268f8fe88713b20708e5ed22f4fd4682b00ebe8387c6bf434292e3d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0110c9c7a97369f5539d7575a20cfbd75b88998ed7443acda668534cb494de3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 21871c87e999bb565a6bbcc8775d96940320e7d85be7ac29906a5af46a4f039a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1c00514e77a9e65a0fb3ec9ef06dcc5e5df182bb58dd1d5a6a5f4085751b3bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54cb5378db8c121bb06b0a1a4a5868cb5a05f3a6998cd14b636a0c64836949d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f6ec2155e978a0d15c356b996a229d828e8e13f2b0edeb53638c8ccb653270f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e31f3767400fc40c7158f27921c64d51e41ff4a8adb1dd366f74a9cad078982d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a4765322263ff7d361b56e08099a1a19bb7dcc8321cec5b1390a963e3abda2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44c28228144bb1345fd16dc1d02bab6fc40ac2923d0be8462046dcb15cae5355
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35aa28b5788e0f40820a593cb046d8e568799ca1bb791792f99f7bf04e6680b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc3cd8ab0a93a2956b1c830927102692ca9516b9bee4208821cf6db5d3ad6bc4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29a5d08a4df8da907b1cffefdd451ed838fe727922825fc60f78038cf65bde27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69087addc9ea0ba47f2d3b0e3eaab2e1d653d94028143e696f3cf069cb78b935
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab8b613f25e9cc9bdbd220cb1698e84dd4924df1eadffdd37fe8df83b4c46a22
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 07c61a1d7229fee1411e8d6544b62a6cb848bbc8be893d1047581eed8ebb1169
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f3d0ac4c4ea15f47fe596a84480587fff15ff3f0387c2f715e2adddf202e890
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0649f8f6511ec87dfaf288b15bb44fc93b0dd6709119e0514ee20df5a2dfacba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b8be36357db670fec0a5e954caf8fadfcbf65c06842d252647daf0f7af55826
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 95dad8c01ceb40486299ca82b805be7419c394ff5671c26106c7b051f9d12e42
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db8a05b9613c958127921a29df63ae4b0217b8757940836ab0f1a0a0ea7e6b75
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2e4d0ae0e90ded269fd08919bfcd2d4c828cbfacb06b9625a106c3a70baee292
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7374bb2f8f93f3f966842cae8c0985aec6aa9d9f52afdd71d16072bb52f82410
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfca232f8aac961d4ac1e0a4866e626418a2ca616c25928ddd863b3169b2ecd8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d0f895233f659e11d7a0d8daf2f58bc72dc369da6e298b1fbe8ac6ba2dcdcf66
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1987bfeee9b821ac36007094dfb50641001698bf87fe18ae48180c42311999c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0fa1b2fe9a818d09ae9a9ed660517cd7baa5df683bfb5017610fa3a1437ca51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af2e4e06d74f3ca86e063ca31e71637a96f0f46418b09edc8dd826f4032f84f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6d9be645b56aef549422ce29554eee2192ba5dedce94dcc5a84d0f51a3d155d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef436b53e9eb660f8e5915e33dc17c64d7db219282b55adb6e677a7da24ce015
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e88261a446bdae1ffdca836d0754bbd8bdf712c5b8486c2bfc6be19638ae64e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71b78ee00fd5b6822283a7767580b468279f8b005f3a8b1777c801428538b695
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f1288a4ff66b184dfbd18df51fde7371c658e620931e06c3648efabc924c29a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4600d0e672dc6c85d34c79b899ba84763542492a8cfce728308f9c106d9a337f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0798aeceb19cf19fa539bb76b3fe6bb28102a6e7eaf52df5da6f8eaa8f9a8f19
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b6ac319a1a3108e61c9c61134396f44880daefba44b722b85e9ca89621f7777
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc0cc56385ee8ef6eada238d94e5733bd6aebe0447f8b40987c1dea9a3d13236
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c0d13ef8dd2dd5c0fa372077eb62c6a5795ce5e57bc2828a11d83b0b69d9a200
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7f2054d818256c4c554234f6d257afa249911a9f6c9607ab9201d2682b0821d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d4a5784ebcc63c121b76ff02eaeb0f90c66656277f7bb4135d5c72d9f6cc07c
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              avast.exe

              • Path C:\Windows\SysWOW64\installz\avast.exe
              • Size 547KB
              • SHA256 989b8d09dbd7ac7326acc6e2a5e0773e05f8ca2f651be191828edc1357e387be
              • MD5 SHA1 SHA512 SSDEEP

              memory/3224-9-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3224-145-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/3224-70-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3224-5-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/3224-3-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/3224-4-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/3224-2-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/4064-1009-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4064-74-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4064-13-0x00000000003F0000-0x00000000003F1000-memory.dmp

              memory/4064-14-0x00000000006B0000-0x00000000006B1000-memory.dmp

              memory/4652-146-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4652-1466-0x0000000024160000-0x00000000241C2000-memory.dmp