Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2024, 13:39

General

  • Target
    80b0280312037ac71b5d5c09fbd7a42b_JaffaCakes118.exe
  • Size 894KB
  • Sample240801-qx1czsshll
  • SHA256 30cea1f01845a3e2ca86163e575f06796d62c37670f2cdf5dc279f5b471b2ef9
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • olcayto.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Acmak ýcýn uygun prgram yok!!!

  • message_box_title

    Radio

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3504
      • C:\Users\Admin\AppData\Local\Temp\80b0280312037ac71b5d5c09fbd7a42b_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\80b0280312037ac71b5d5c09fbd7a42b_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2892
        • C:\Users\Admin\AppData\Local\Temp\80b0280312037ac71b5d5c09fbd7a42b_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\80b0280312037ac71b5d5c09fbd7a42b_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:680
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:4720
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:2936
            • C:\Users\Admin\AppData\Local\Temp\80b0280312037ac71b5d5c09fbd7a42b_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\80b0280312037ac71b5d5c09fbd7a42b_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:4272
              • C:\Windows\SysWOW64\install\svchost.exe
                "C:\Windows\system32\install\svchost.exe"
                5⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4784
                • C:\Windows\SysWOW64\install\svchost.exe
                  "C:\Windows\SysWOW64\install\svchost.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2892
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 576
                    7⤵
                    • Program crash
                    PID:4584
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2892 -ip 2892
        1⤵
          PID:2340

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 59df1e8abfbb9331c4cde48b16dce026664a1465450164fe986a3b2b76fadbc6
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 8dea97834bb45fea177b66b9cc4bb3870933e93962c62cf926db3ec47b343df7
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3eeea8731eaa326153623f690f0bbcd3ec4e6ae69b1cfa1769efa3e2ed9a3b7e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 561e3b9831fa98a23e620937478d67a1ca386483500fdbdff0fca07ba70f2902
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24ed84935845ee1be2414bbbb0a2e0f64aa566d42911771e23e1c960b36bea7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee224c1f15653b4200e9b799f9b9010dde93b5405918147a0729593f426bc21f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 37d5f098d839ba625941b4643ddfe9a910aadfdc62672c23dd6888d52accfcd4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28bb6d9fa17cdd2396c02c2df15046cd9255fb0284d8d334b1b346f75f2dfeb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9356c5b37ec88aab6a1ca86137625c670e21876d41688983433b969a8cf0cef9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48cce043db34872c3a12725b87e5a756b7148238681deb8201c7ab3878347d5f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ff807aed54b567c7737fad9628ff196f235dca736ed0689c150fe648b4d2a3c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb552dec78fe6e90a141a0372310f29acf9ad6544eae7549da721a17dd369548
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da26ef206d60fb3d3f2d2693620d71c949bfec99c7151023a432f55021ae92e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5da62959878620e95025fd8d11fb0803b6d9664a2dfb7b346c92d2e7cb62ee8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea8c6adc05dc0785e424ae9d9fb4b8ff7c11d4f30fe6225c400eaf80600e9983
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 629b1dc020ca6967ec42ec35bad6a8505f98cc61a6524408f398c43bd17b22b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a558504062d597cd9de988ea0375f35926c0b882cfa93479fb867c2ec29b83f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 faa403aa31b3cbbc63e65bb206c75cce543a0a0f49eb94382c77bd3580903eb9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfa4a6172a32387699c9b58ebbcb881bbcc2f788bc0eaf3dcd05dae387c4481a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d98b167e7e6c3c794377087287131bfd7db596d5775124b0a56f731c731c759
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4c5f6d0cb49106681e3496d613b27d2bd211405c25413e81d62f6e728c93bfd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4fd7913f6623e7f5b9c97a9c1fb935452c91bb316990927fc60235c2d14f2ce0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8100058b7b0d5480607587b7c5773fcbaa62a1d85da11494d3bc2f3f18c4d033
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc96b524cefe122c09968ac4f4d627a6371c438bf090f031c48ec7bb405bab67
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f5a3d78b7de2f6d09c0f148d128a41f7dc41d915c0915177164681d1bcd6f5b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f18b1b3a317f8d9a66ff6a3487b42f4d00d542e3e2b07d66bc001e2d17a3e294
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 461b2e8aa43a132a9952be4a98d980e5b2d4d613bd88b590e1112058ac132e3d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a12d2ec61dbac6a48603828e02dbd0551183dfbecaaa9cc4093386a7b5cd3172
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f1593156a4367516c97177357954ab87f2260e58d25279adcbb2f6c3365b829
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e427ee2d4b6b200a3ed000b04dd4df3d754895382ae523248fa281fa1c48433f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92eff577e2ef72cef1c4b79ffd73105c7164bead21e4b695f43e49c00c630151
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50ab2ea585ea305f1a13a1e910341592d0b9b00f8551efa91c52a883294ed064
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9155be0c75b44d8cc275e72f6c0e45843db7991539a397e5668aba08173a188
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d85ad87c5b694f370eed07e95235a7c9f1859a26baecd7fc904a48ff2a88c99c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3d0895b6ae702e99d85ea4482cddb04187349e90faec059a2042083a5b4c00f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 000e505946902c884f83e81be68e5858d497bcba4dd42b20fad4684ed982d7d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 716d4c537796b0c09a9e9aa3028d06caf2f303c72e1ef614491f2a52247bc9c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c18b9e13d1c23f47acf7f045e6746cbc0beaf29059e55857a39079396b38ab41
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f71ef0b337c043672323c3f52df9db3a3c36ad00d4e994838ea9219c50ad3288
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 feab0d4fe25aaffbbc3f5247d04a77efce8dc42865dfe00de36b240395e85a81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75774f5038ee560672e740afba70cf1b870b812b62147ccc7b91a5b6e039cc5f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a88ca398ae93df1d626f8be73b1c3551c1d08310a273fe41a738ab4950065dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5cef0b6220f57e0a16eafbaae6da6aa91cbda293ae3bebc8541c38a262559ae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56d1e8d81fa102c077b1fe51993a533ecf26cffb322dc68076eec46f3d22d8b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc123b399bd9acd5783807e3d33ba669c93d9ee22e2f7f1c177bff5fe385a528
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0e277239999a2179972992d5b574165e63d693112970d61b9f605174611bdb0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30427c04ce13b7840a92f3ddf4c2b7c582e2e90ce10694f962da2c4f9c82ffb8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c65803889b710249f821187b809d24ebab5a7c9273a846d283a5d8a07fe1a0a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a811364604a38c61458e8548f482f1274cd45fc78faaeeccf42a8afad48d0a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a9115309634f1e4b55189b6d7a3e225e6531d1c4b50a9e97cc571fe1a87ca82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 faf55285a2d98474186fa795ef5d70bfab04d0485c0cbc37c5ac929839a04d32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0fbbda994530256e2a2b4615a01068bcf1120ff591b15d032f2c2330b54542bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc778a8edfd38163e14d05a8e8d25c8d58df29f06b58ae38a2ba9b27f588e33a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c6792da096f4133b0fbc99e81b02333eb7f4b00808ebbd8af65614cab2d86ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2db746c9283557ba9f32047ee127b2784687fafba15d90f96c23e669f4f573e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0d0d436d28d882246654de3518192c0faa9dfdcdd89e52d46f1405833470f11
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d3552e95057b4e68b21e449c1feb273683696c331a7bdeaf752675598258e956
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d2abc272b31e283a785dace5a0f862ccd82d9045ce2c3850fabea1b8d547794
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e7640af4db189121ba67c0455d7534ce10d022810c87b1e0074f9ef145022a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2241d63a6239e50aa117231f22504397a86a5cd3fa0fe3e1c4859e3904587c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4ec42e076195e13a5c62e8c64a646b78f163c8a6dde0d5928e7bebf795c70bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 614fff417154e48b2ac98769e227220085d7c7f58ce9665cf3b3f0e20feaca3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a034a5f7c859f19828da0b1aaaf03412a031bec710567fed55d69796fffadef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ebe6d65087511caa98e13b4a388e21f11edd0cd21fc149c1717ef4712c96e06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cb4efd20224a301b5b10ede687806e2592bb2facb65130ab2c2e1f2f16539090
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56d8b10e90ce72b8e7966eec6513076f5bb5c9dc5dfcc2fd7771033a22f126e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca74d2204f05bfa8155682e03f024e770d3da6f0a219e783b1bab180203a952f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 022f3fa94d0a5da9e99f1da16872fe96fe91f8442d20c2765bbaa35a48186c29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2ccc2365be88515a5b50948062f48275efca114504cc6fb6f76c90bdfd87fa8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25947770748acfd4abb5e9b5c7b671ee85f8cb489cb8110ce227e6788fa25c3b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 07afa8389619ae2b2a1f6ff858e09e5bfe93319749e7f87ebf68b3e35f180ee4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f272a9f478372edc4185df5bc8d2dcf33eb549e9e4d72270ba5479db4a7e5cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3bda27232ce230bb820fd5dcde546d6b79d419d2cb121771fed93999e7205dca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7785bb98401cb43dd87b33327f8ac9c209d64df41e49f2bca7241b513c8aa7d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44b09924c1f56c99f4d37013dc632a0060e14bc7e2d2146fddf9f6887c50760c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 965b5031e9598586df9644244e8271a7fcae89a7b27821dc283b82f989788a38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8542d440c87d2f2b0e6de647238b86243aa7e2490b59651e7a89084395798fdf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f99731f30bfeb76779a5e2d45330c098dae327b5c2030bcdeb4df94c8d0fdf36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a42fc417ee9f4112666e85dc1c3f20e9cc3707872adaefd36b38f94b3f20f2f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c96b7ac819490694bf49fe01e61d911206dc3818bc69735fee9e28da9d357c29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 74a2c7414795ab56ea42048d978783bfa44f625c8d34d4acb9b881eea639cae0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b280b6cf9fbfc679799361ac4feb8562ef50706317e6faa1c7bf50e3eb92e1b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd0701b0efb9c7842b28506a57bdf0aac804c0bc47a6c77fcff7c67a86fab874
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d33ac8142a127404a036c79953fcf6b66e3e2caea1c914b7f74191e567989c7a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d08a8fe4b4f4de42a0de80f30af622293545ffcd6f78f868cd0b36848e8715f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30f3d045e3d23c03c45efad9509c55e3120dc85c1d0978a45ef9cb21d7f2ab1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c16bde3da932bc4fd3371bf39d2d64b9870138811af42c0a5ed6ce1a0e733bf2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e9d2a3533ec9e307d066a9db88ec803888b793b2e59f100d7d031739ff6920c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f039ce408b930ba130038246e7f8ebba0d1a533cdbf09c5598743d36cb01566
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 910f99bf6a61872d2372d0144fc74ea5be4ddf0977885f42e479dc1b353d2940
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b82c5a9ca77591ee1c0ec628b505ef725b2ba6761a1405af928556dbcb146d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c59659a87a0090b54094af7d422c39dcadcc15172d8f172a66ae140cc2c8a01
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 47207a800ed15cc6c2568bbba1c56f983653dbf0342d10e092af0be085218a2e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3406a02a9d38733ee31ca943916799057a7f9e0ae6d3fe0d33ef6054fbfc86ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7be21273a8d009d102485fa205f4c1987afe11b79a656e8d94b372edb86115ae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e44cac4fd520fa1c69d8e5d172c3b0e4d2238dc9bdf186eb6f1a9d79afdf9950
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50ed49f98ce4b3ad3f866a96ac8b653d2e9493649bcd4d91c4fa8fdcf7c74bb9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58db30b39432b925877ff2b11c0ff73728fa34a86c2d20039f36fdb4c17246b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 976640141a8a30962589c4d538b2a9e84ecc550856a190316457c6e22cd47fa7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73ba41982396c56f2129997c783c6f6b721b986762f5a214d9d752365348c607
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc0512d25725ce1f9ff7cc8c3061244ac043c93786706855302a260ac78a1cd0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce6e9e089d4143502389215fb726bc6a5834391b055b3e5e9a4c9dd60e9f861d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b6b99e5bd56a5756e533b50c7ddfcda886908f9a4713858dd823bc0c33351e1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e793dbaa45eb610d2de224d6cfc5a8610bd7cdef158c7e26cc263659208fc6d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7359c44a4819d2d358e9e0d8b572dec40ded11fa814842fdabed7f80a0aad3e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5efecd24c013058a4afb20aafa5adaebe2521be065bf4176a24818cf8cc1c972
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3026f5139aacd4962694b66cb8660fe5a87995bb08060dc1a2e94391db466003
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c3051d1ffdd3e8a308fa437d06b30451bf6ad7805f55b033f8d88010674e8c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a197ae9bdfedc2a8bc196fd2c8fc812dd3a91191652e7360c2eacb5b831fd246
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b90a5981d567a08e22eaefe606243a15cb2646e00bd1f462eb812b1af76af7ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff71d676cc68a292ec8dd5920e216f2d48a9f47fdc3948d95e997c49419927f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c518a15734506162451c7b17ff4b8528548760ea35c56b4700416a496c5abac7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2958aa5ef72d28d19b6aa929c6043b1e4e8428f63a90344a96628d175aa7f76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec294a62665527e57b3de4eb5d4f6006644291b34a02147e25478a1e1b1de820
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54773c4931f3788bdd620b8369971f0a0ce235051a2905b23344a8967b9465f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7ee936de17e708acaa97c2ea68f6ea9062286425794f817d2797069087c393a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7eb87626d59527b463a8045d805db5795748a636bca0105c742062a5f0f2325
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56c2aef242beecbb55f4048922ee7923674cd018876647824f945fd1de473dff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2fdfb8488f2ac73c11681a1aa85bb0fd78267c442909d968294ad490563efbf5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9fee6950744975fd136c307c664ad6de960d4ccec63b6385999c5be48b7bb31b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f074aed994eb7a48fdde1cb59b6145ce135946a380bebb524a08b87b0ec775d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c70f00c0f5a8c36d3a6b714ca01c0cd642c2fd924bacc606e46963dcb12f0d48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e8244c507e5f503a078649e2ce3c7722c9530b2f918c5eed0401f85fb18a092
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a4bb9062d90b72ada5cc2f9b6a769e8e21f9d549876838539589782852945a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 74d456cc444c95e6300eefe19017be83e40c03e1546bacb12f23aff616d13252
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aaab1de8f4c787734c06ed7889fde680828f213af8169bb3ef9e694a75eb1750
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13829e14ba0e8a5daba1b52777f20278dfc028d7277d237f41b2ca303157c0c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7ef3dc42b9445804191a862c4b41872fcc8a93198ce2a279f7efe8cfa4c9c7e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69fad4b3c6d50aeb2737d440426136dad9da32b389797def0188a4c28cd211d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d20516a60b8284489e64b89c4486e9d512c0b51d0386cedf635e60f577e8c81a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 91a4627a446366fb8138b8047342bd766e1dd4e976a592dc56846bb58dd8f80b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 000387c16cd40f3fd85a29e3b1edcbea613eddadb05b0dd1d0b180469fd10f50
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87a4098791df868eb70445cd1bb5d192643ab61890b0f9f7b15500090196bbfc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b9c59642bc5148ab7c465422f99c5a7df57680f8c1817a7afa0b176ddeee731
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 453f46974be63ada65e73e2689957bbef597eddb5f61b85b41464036a1a88ca8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4a2e1ef23a36fb75d54e63c29f7e6aaf913072ff2386a14f98802ea9a6334c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3dd473b5e1e58edfe1a768f0df0a651fb924ff3a28c41cb7bb3220634c758680
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7d34567c63ac139f8507b5911dc0ab5969d91e0cbeaf1dccc12e382ae7742b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dcc1a4de1c9b590526d3dbd37c10a5b4d783a2c724a30be41960c0a54adec99d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b64428094247969282019e5dbc0d7b47a911203af8f6d53bcf28ed856f32786
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              svchost.exe

              • Path C:\Windows\SysWOW64\install\svchost.exe
              • Size 894KB
              • SHA256 30cea1f01845a3e2ca86163e575f06796d62c37670f2cdf5dc279f5b471b2ef9
              • MD5 SHA1 SHA512 SSDEEP

              334DC146

              • Path \??\c:\users\admin\appdata\local\temp\334DC146
              • Size 14B
              • SHA256 3caa3c1498244fa7cd649911f68daecf94af6b18eab5d5783c69569c6f89f03a
              • MD5 SHA1 SHA512

              memory/680-18-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/680-4-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/680-153-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/680-7-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/680-8-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/680-11-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/680-15-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2892-10-0x0000000000400000-0x00000000007AE000-memory.dmp

              memory/2892-189-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2892-183-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2892-0-0x0000000000400000-0x00000000007AE000-memory.dmp

              memory/4272-1105-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4272-101-0x0000000000400000-0x00000000007AE000-memory.dmp

              memory/4272-152-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4720-20-0x0000000001500000-0x0000000001501000-memory.dmp

              memory/4720-19-0x0000000001440000-0x0000000001441000-memory.dmp

              memory/4720-420-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4720-80-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4784-186-0x0000000000400000-0x00000000007AE000-memory.dmp