Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/07/2024, 19:41

General

  • Target
    79c8e0daee3300b7f476d2de1d84fd5a_JaffaCakes118.exe
  • Size 292KB
  • Sample240730-yd5glazbrf
  • SHA256 1a77ae595373089eded9d86edd1737762844f0269c21486ba40645622cb12db5
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • marcore1s.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    ctfmon.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79c8e0daee3300b7f476d2de1d84fd5a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\79c8e0daee3300b7f476d2de1d84fd5a_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Users\Admin\AppData\Local\Temp\79c8e0daee3300b7f476d2de1d84fd5a_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\79c8e0daee3300b7f476d2de1d84fd5a_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2464
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:3968
        • C:\Users\Admin\AppData\Local\Temp\79c8e0daee3300b7f476d2de1d84fd5a_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\79c8e0daee3300b7f476d2de1d84fd5a_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:436
          • C:\Windows\SysWOW64\install\ctfmon.exe
            "C:\Windows\system32\install\ctfmon.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2660
            • C:\Windows\SysWOW64\install\ctfmon.exe
              C:\Windows\SysWOW64\install\ctfmon.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1540
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 576
                6⤵
                • Program crash
                PID:4776
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1540 -ip 1540
      1⤵
        PID:1560

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 5ab3b40afdeee64ff2d9ae30c50a835ccdaffa5a587f065641f671b9840935ec
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 0a1ccd933dd99002a4a9a9363c0a5f4e2f85fbed9e80104f195a6760bf84796f
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4951786cee53af1cf8a4dcc1d8e13199a33cd756491f143c63174c550bf2f67a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08fd8d30cd7f85bb6d8e4ec45c285144fbded343a6ade3478256bb256884113f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43006ddf9e768c6986ace7365058e4c72e1affc0a0a888c9c6500903d803c271
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55b3d6359548363f613d36788fbe34837da31b4773bd67e6c7f014b797a60c3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2299c03ec704a084bc3a1d302f8c831b5429e66558e1745d3ac5de9f56eaa17d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67a1a7cbb316efc8b178654486c939783d8956b14867f15455d59b61214b4a6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6202380cc6f3f7b54f08a4ee1b1fae170474f1ee49b4e1de789038e98c61e6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cfe6f32e9a48693791f02d7bcde77464e62963ea3c6c753dbaeff67a65c3fda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da07da7131b5b03767e00c0e077906d480741f4b49d81316af8064a04da03325
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 281974259384045b27e905395b1adea1680b14ff683b9a1136e5ca8222869007
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da65b50ddf4b4989a9cbb785d1521e6828e1d11c6bcd9189a67659d82b30ca12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94a88b9f13940d7fa1f92ac50cca2e5e6e90a26e2b659d74af444a4d7e53b6ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0f1824cfea4a816fd27b530ce2982d65a1d0dafb7aa9c5c27a02134dd23fdbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e3363c895e929063a63905ae248d122ab05ecab873223b12fc63beee09a30cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f0b0a9fd0f4827534e956049f32d7ec9db1e127805c048194697e86b046d471
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed5c668e4003ecb1288d3cc29e9d749f63b9f767491c25327787723c6e65db1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74cf39f2758bd7688961ce5e30381c10fd173462f728cf6f1459fddca9c7d1a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9ebf87983cb101c87c6cd50a45dc4f99f982c127f79c5c63bb0021f354ebf84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00a02230f231b2d3a217b258dce0fa0952cb071576f02fd08a131e2bba2ec3cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac52ecd93b8ccb0b7ae71e71ef6b092067fc345044f747fc3ed14c373612a604
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d170f9aa58e39b17d722ec4b05810ac8a6dfa90d8e41d21b24684661e6372342
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ea081f6441948f3fd4c3e160bf9c164c37b1642015e4493a233a3fec184ec4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d580ec50e2d727cf25c76bc4633631e72fd7803d7250b9d26c8c2f9ae65b7a3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3aa2c7dfab3962fb455d697a2526c264a5e93f1390a3200a1ac16a955ba253e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c2d2dc32d568408a7299fa7be101fca3ed29cb670079ba36a14ef73236617f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b29ecf639136a1443e57cf1c31792ad95dc948c850e8eb35e42ebc0c775e4e47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 851650736292d93b1b4d312688edb8205220c74d90fb8464603ea8606e343461
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4726624f87fcb82cb105c5f27360f96eebaadfcafed915ea097282e03fb9d704
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a04d23e9ce8f9a94336ca397d50d2e5b8be88cb3a36e477e6b3f1ac837423b03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d95d65fc0fc6b5abf0eef5c4c9bcac159de15781c5033495fb7f4e5e82b6ebd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 179ebe05b468ec8c02bb3574e9ce23a64343aa126e34890ae30112804f395717
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22c28aa2fb2b2050747d0f596cdcfd0c1c13694af4685008ceb6ec69c8343ac8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91a3d70002a3af122323bc9870176ff1213451ac77fa77bd76746084dca182e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 176b3cc10d6157a43f8a8e82b5ee7e1f8ae6b893a709d2598d7280f8fe614cab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3b0117687bb6ed465dc2bfcc0026f5f08a0ac915f762debc8b35cce534dda20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c401ff5419e43dab5b6d8ef9211d029d5c05d7b06a07bb4bc05033e315c5e70a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82b53b4e82553588c20fd2dcc3434943aa8411bbd5f135c22262494ca8f02ffa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d47780a5aec38c9f9c81bed49f02930c3ba5726bc1b58045be2092693a0c68ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e053c9062a6434d848cd8e064bd807e5ccaad9090eb6e80bec0bf4fa4f6fb4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89bffa2c63db076f3f54e02ae7be43dff0228eca85bac9929321856c44ca8827
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edbef097486c63c7510163b06333bfafdfb6395c96812def5095b7318702de98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d2ac7ab5cbec32b09382271ef501d3a12ee437104171b088e6ea4743002abbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e5d088799603d5ce3d236ae62ffd014dc3692a185931742c5270dd945879053
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a40eda940826d7ae9f232b21445228fd77b52422f5fd73292c1641e4b0442ad0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d323f0501a90ec9e95fd52226b465fb718c1e94f394eeeb22d21dbe874d07878
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 757237c7f13b5d7d2d015f1de85d72ec8d1142d362d1ccef1f2841d789a149ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4041d763ec7dc5f235ff03658019e3b152a45ab7f7a3b617e04a694ce1d165b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61d11061b9c6e63c073b5159ffcd456da9e94856a0ed0049de57047147fc72da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5adbb49c70791cf65fdd95333df6ee99466c1fea660de836db7fc86784c96960
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a122ac5c766f226f555adfa2ce0a2fc8ad35d8fab67ebaa4a5af00e3ef74fff2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09626650fb7bf0a7575d07c37652cad6a799f56e3b2ebeca705f8ab0eadf7817
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2270896f974a8ea51c4272d9eb1010e28d7b573f7f8de8d51aa0ffd29028ef0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c38dd45fa241d053b658c989a09809e02d39f35c8e82cfec6d0012e4396b4672
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf09bc38ccac48c3205034a553dbda8fd793121c1c050b8753ff89afe3fa520d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3582e9b5044ed23321a4f81e97805c6a6df7456625bbefe10090f9d85a99679b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4dc24ecacf9938b5623921088d12f8338abe43cedc022cad9be1bb7040f7f972
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6fbfca9f44b65ad8c580298ba29c0fd2f903d9dc5f812cdbf76ae120b099404
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f60efb6a94254142bbf67b375e7e98b59358fd61a928d984c90844039ca02b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4edd1cd151b1fc337a8f2e72d655f8fd8352fe8dc0eb6652935345ff05107fce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93fb20d883b9f095fef873805351030173839b08df29bd8aec5544c13c7a74ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f953209ee169947736b47d57343db5bfacd52a708929cb890d594e2a77db55e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 903d273533d04ead12a2cbe9461e01933df73f6cac08a407e250b3f4abcfd560
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd0a2f6596afef3fa4095416d9b8bfd6214d75ff8315916b30c19ce903c785ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0dc57339d345ab691f53883d0f2c3516131aec31eb04d6aeb843d8c01d7278b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27da7c2ccfdada51561afd69c8ccd09a3999891b35e5fdf9612ad0e0e046c8d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e1964402e5c38a2b032826fd2ec7b127f6bd933b9612b72e79e2e957eae3bd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f338b6d811271f42c3f829f5f8165583f5b709fc982732188d8d79b5d51dc01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed8c7293acff81b7e7564a7460c89d8b2435f062da995a3eedd49284d1c360e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a29d194393762b6ad1158953cb8dc6c063064eaeeb86e5b1c4ffc42cd71dbf15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92556049099d50d1636a626ce3d5d67ee7d0370453f0153967e97e057245cd1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1ecf68b7e589751f6b42ffac1a3c72e51af25f209cb04606239e668273da226
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dacd0b32da908dc05fee6ae5cbc9e8cb9765131e3a50e67fa9bec5771a2e1080
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6f6fb829a5f4650e96ca39b48577d2615b3a41bad5cbb294742e574fbce9a14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fd9a0ad6e3abdb1e7d5361372f7ee406c7e9aa2e96d21fe8dc639cfb28b5966
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41cffc1d7f0b142d8e3e37c737145eadfb3b32e4620e1b9b6c9145939ee7811c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63f09d8d37512673aac438e1322742ebd0eca0fb47f4768965db46975aa22cc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26e1d5b11c63dcce13690f63c4ca35578b510e086a2c26f03dccc23f2ff56696
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79bc93bc4a867957cea90234030825e454ddd32f333acd5d8eae20d273127864
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70db68e5b784d0e53e6bc2b703e140d5a8747d563737a5e03733185ba53a5df6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 747fadf9c8f3f9d2b8a59ff32ba64fff794c63d5e756865aeace6542b0938e21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d0abf1777b40fd11b97089cf8350d738436d63acd64cfbfa1cb4719f562fb2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb72fac6bd5910c5474e749e682e1ede844441b5d1d42ea2ce992280533406f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d68432f2ea52b39b7ff1673c68aa56410287ce08441d2dd9f1964b0c0c9a835e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ae71ed257f39e4f240a020c3b2152e2fe9fdf14ca260c7edc781e56d316006a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb3f048353af4b1ea18f6a27a436ebe239bb9c948d91867dff1121c819a83384
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8275a2acf2b625e19222fdb57036a6bc8291991e6cd35c27f036980201e70b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f5b07d233134049169eff5b7b6ea3ef8b7553c3932b5c47d2c8a6acbd630004
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b492e332c380c1c34fca36552a4393feb0e539952188669688e838fd3c527266
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71c37c6bf6857ff6822f39f2030e1e4e467ee325abc2e97e8303a39485a9aa8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0eb203a4b9f6e10f6446ec0533946e7ffa59e5e22f531a4336de90c2bc73171e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95432643d1d139c739e04dfd98ebb034c71a541999b542a356d51e8d3c425955
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e87145ebc40d100d80f05dabe5d865b94504634f35fc765565f375927ce215b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a06644f7463e530093ed786a8c7f7b91b082ff5d5dd1eaa77a823881f6972ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2282296feae131c4675566423769619dd5370139286649539247c9b9fe632725
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8c0356319023a4fe1720370433a0fe0f5e815a012cd2b92f59199b7cde365f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da1c8dfed8952aec8ab67c985a27f278820366d4f4722614237f1ee1e352d421
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b91a9792c9f1dceee80fa37d19d81ca288c0ad203575e50bcd82c6ffedcc2c35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 195bcb84b82c86d6858f8dfb077b346d03ed76876d0391dbe69abe036a17f066
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7cae3b835d867226963d9a2ae68dce3d78d1249fb0b680be9a65de0455be871
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2efa0cfc9b74a779bae8bf8c3968f5833f41ccad594fec4618f604e68988c038
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edab68454acb2217e73493b22d88efd70413e9cf7249a0308cb03aacc6933ba5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 468466d6d944fa88464dd7e4d85a6817421a7757f13ba0d7acaf50ffc3615c05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1cf43c5833d897b2557d31baa91afc31c23feaf99abceae0e749e75a0672b204
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37717362cc163a5a1cb3c8b0c7771fd73998ab61a3e6707dd6489104a1b110ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adc4d07f47c7f7305ae911ed94e9a2ab44657df00b574fa59a4f621c6a6b6d43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b399be93eef0dce9897bba36acde42c138233d96ca8107e386a66862c5b60174
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbd9e1c59bccb7106acc72672ecddd13076ecb248cca003b85bbc1c36feefa39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8e19848c37ba5caa9b3cec830c94bcfdaefa83a5b3196d4b7fbf1b364c96d87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78da2a1e3a83760a25ec6732e09886e8af1c4601b5c30bddfb5007624531228f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fb33c9d95b62482457afcf61dcff2d1f5219f38ca8d3e0bef8ee0bc31cea07f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e2e2dfa7c5ae1c4176d1e8ee9d0fc4718e089bd637c334b08304abb3d7630d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e99882390ceb17314e05f784357cfedc5dce861036073a4a980cbc4c7af94127
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0686e284de557dd269ac205e747ac3b1d38c11680d45bae04e7fea43d4adfc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18662fe25844076032072fd942cf6ef55dcdcd2ebc2fc599248743a17c06bd4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 148a2c746e1973a7c7241b16b572bd6935edb70141ab4d171f0613ebb2cd0a97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f006b575d846404cf97cda6d51e5cca79c27c385de981ccdb9ded151fa561fab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8dced1dd5cbe7892b3927ef1c4d1fd238741fec341b2835788a5c2540a6f166
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1f1581f6510657d94a2fbc9afcc49d74c0e752392aa589746596c28316c3cc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0f9cb67ce555aef9dec9a2cab55c70ea7b87e2138bffbf23bdeea83cd0811c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7bbe4352751961e8d7dc7286cdb3d26fe8f08a85a858ac2f7a8e26741aafd3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16bebfb3c88c36956bb476c5a19160cf479eb77f0c85ca608cf2da4a03d36d8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99623c29c5f4f7b3eba11f77ba1ecf4c73a07b9ceb46881161507b5b2068262e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1dff751f0293ea46c2020f23930759e5474de45bbdf469b269a14721a8fc238
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fb751e3391a6cc6c7dea38e6c70c0a05e4f6fa01e04e559b1e5461bfbf01e32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08c4a66efdf1556d26a411e4eed9d60e6ad06daec2e856661fff6181b91048c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef6327d7f803231192381359e2594a76e5b039b4521c5fb12e31142e1a54b791
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc6bb007692d5e0399fe5f5441bc8330c67116f394289e0de880795fb8f85e5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0a9b1f2883a225b74ad24e36dbd668799860e8ab1de01aec116989a7ccc3333
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fb2493221ab6730222bc64133a40e680c15e65e9e3bef101478f36f060bb32c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ea6d9eb7d45913ee56ea136ff6a1eb80d6a16cca56778da70de02ab201b8bcf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c78104d3b564e55a6458cd1ebbc4c360d4fcc86df663e99bbed96f75eb9c201
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 faabb5cd956e581a35bd8279e5678f465d097a7c4a0a2f5dfd66b04c6b33bf6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 213b0b3ecb3b8cd8cc4403c685ef6910276f54e3d9008cf9792af5f10b176453
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9a9a008ba9d788e0dcf268f0487380898f6cdfeef36b1dc5ed104d0d8813e05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9d84961042e736efaeed1f08e432a5c07c7448c2fd152395a4e1b7d00829b30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0cecd522752394f1e99d82e21d6e1713a727e971f2893183037657be8f783254
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2200a3d43eeec81fd0a78a2b4cce146be7dc5b54daa0c778555ea6733724d846
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eca0a43c1dec5e42f0f7f3fd30a7d05fd8b4d693714ab7f211c0a59dd6223389
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44dbab72142c1362fe8f0d347bd20417a4eae2815efff83aba00012c56187983
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            ctfmon.exe

            • Path C:\Windows\SysWOW64\install\ctfmon.exe
            • Size 292KB
            • SHA256 1a77ae595373089eded9d86edd1737762844f0269c21486ba40645622cb12db5
            • MD5 SHA1 SHA512 SSDEEP

            memory/436-37-0x0000000000400000-0x0000000000404000-memory.dmp

            memory/436-18-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/436-19-0x0000000000570000-0x0000000000571000-memory.dmp

            memory/1540-117-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2464-2-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2464-10-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2464-8-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2464-9-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2464-7-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2464-4-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2464-3-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2464-13-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2464-17-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2464-82-0x0000000000400000-0x0000000000457000-memory.dmp