Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2024, 04:58

General

  • Target
    831f10fd7102fcff8088fc815bd0a1fc_JaffaCakes118.exe
  • Size 737KB
  • Sample240802-fl8j4ssang
  • SHA256 e50de2afde8a9a4750f80e8ca01bd06a30200c969b76088686e1df0118f92afb
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    iexplore.exe

  • install_dir

    install

  • install_file

    maintkjhukuk.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\831f10fd7102fcff8088fc815bd0a1fc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\831f10fd7102fcff8088fc815bd0a1fc_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Users\Admin\AppData\Local\Temp\831f10fd7102fcff8088fc815bd0a1fc_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\831f10fd7102fcff8088fc815bd0a1fc_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1544
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1256
        • C:\Users\Admin\AppData\Local\Temp\831f10fd7102fcff8088fc815bd0a1fc_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\831f10fd7102fcff8088fc815bd0a1fc_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3584
          • C:\Windows\install\maintkjhukuk.exe
            "C:\Windows\install\maintkjhukuk.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:32
            • C:\Windows\install\maintkjhukuk.exe
              C:\Windows\install\maintkjhukuk.exe
              5⤵
              • Executes dropped EXE
              PID:1720
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 544
                6⤵
                • Program crash
                PID:4876
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1720 -ip 1720
      1⤵
        PID:3744

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 c92c03b9b695b9b5b8d0784afaf215e670eece1a4404ab99a2ebd98983ad3f90
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 588KB
            • SHA256 b54491cdb61bbd319a58acbdfa3aa6b5936d212af2f880bcc785a36f1fb7aa03
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57902d1d0c7cccfdfb1531ce632a01561f91d8e0735f0a7c718803f08601efd4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41489905a3ae5eba2a89a101bf26e23d0d81bff6dc3eb9976424f0632009e4b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 017c4c133d5e95ea70529f40c3811f9b15a2c191f5ed6b2eef1d7afcddb3a5c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31fe80e82fa53d37ecbd71b3e92124cbeeed20acf0d0ac9e571297e78960fec9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0ebb4fd9d79974372bc4f2c4aa60864b671b62cc31105e7ea49d6bf877ffb83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3346d04d1b793a8cdbf2d299be28bcb25542110ac5e6c578757b3fdaddbbafb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10905fb49c40fbfc33861eb5534dd81263032c9c249ceec1e38f0f9717304d71
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2add0675bb6471ace3163386ac556754ccc863c175e4d2173cb61904e9cd3082
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84e0f6ec764b7626ee064a8442a763ea7fd9b94495d17cac8ab774c3f7f07b37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c52f65b7e6e2d47f1059ce9e0c63e17f3fc49fda3f7b4ad17f73387aa4eb8d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e8028e9bd507aa846e6db54e18fdbc6f30c88690e1c4b57f77a982ff3a2d4f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3edb1146c1df395daa90c7d6c629234d591552f2f66cd05f515104692aa55e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9cf0973bb24eb5fca47f9f1211649ecff98fef45ad6a54837d0cfa6bad8a934
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3cef53153e5f1c80b9085a2aa2b6d03332cc4525bcac6772b80b3e540e1d950
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1f7f1aab0e14d5babebf4b64acdfc2142f12e3ad3251c88873cf9c4ea2a056d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e161db955162801a47337163fa5afe5dc28b36a128b5f40ce2ff311c2816cbb1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ab72fb8512f20ad073b75e9a3eac266e33c6ae9aabbac83df600a69071e4141
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d372885ef98e2d6ab83ef5b49f9d266ff67ddcfa1b02926a90f35cc6b1bd88af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1371c01ae30874aa13f4495d093edc673c82456f068ffb7e233dfafa25ed65b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ca66eb88162a62944b303d5c3277b68b1638bf9c63a5fa1bd860d2d742cb389
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67ae9f796ece41a525266847b9f3acbac3e20a6bbb03df4ee1678daae5e3d6a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d6afb503a703e8c63346f726e87004da2863ac1b36b3ea38be3b850f6c98bcf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31aa0aa8535398bb172f95ec7434e17177f7c345f46ebc2058cff3be87a27c39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1a686d95998355a14a64da95365eaf14940b8ce340f52b33fe8cebd06b024fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fa03cf3aa1317fca76c68f856dcd40e577ae4392e1b61fdaa4984331582acf8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60d0889b41367b9ec84bdf6378edca8f600dbf0ae83ee35795ef7d63189cfc38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 122a6783928c1f4ae13e85bbd6dfe5237ef4d46970797c5a788824c8fe725a42
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a9fd0587809040c7a10f8a9f8887ef003b208fd082b55452a587d8615882391
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23b0f0dd9f7ff9af2d234ccfc6a6c65f9025ce4ad3a35d7bd8b4f5dde23ba2e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71d7f7dd47118a2cfc46c62150388e24765cdfebbf06a7d9f3c181866fbc863b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1e7ffd05b05d919d67025c7e493c831f2e0fc577c9f5282f875c7f707426ac1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8ad4b42c8a5df6601e19062074d54823275a67a6400f9730a1183fcd0394018
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a6bbf682c138c6c9492d680cfb6eb62637409e68f296682ac880b14b561ecbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8a422707a51cafe276b1fe5ec98d2864c3c3f809b945cf904bdb4fb6d0ee973
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93656a182f9bb15f63f8e2f32a9139baab2f10ed79139fb53bc2add0147e03ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4becef324132d546ba16f9ec44b940804cfb4114d1a72892fe877c7ed1a17fbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e57156441f1fd7dac203feffa8cb362538db415166d5c6dba94feff2c1aa1c7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 406e0d71f39c49f2b8dfb9d30d57c834884631971eafc95ce6d63d541d25213d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05e0f6ef5bc420db88bd81fe095fbd629bcd95b20e03ec3f2315680cad7b887a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 729348fa791cc82ac9e1ee2c850e1158736c53f753a2e4b4ca0b3a76847b809a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41b9af5a462d5ba9ef04d899a879aedbfe6c345f2402d5005aeaf88ca8bed9f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67a00164905a3fc4be396a94fda91dcfad47b817cbc2bee2726f35bae9c692ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4be99b7a1bfb259d2e80f58eb3e2e334fd2bf61db535a978351ef14a87658eda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07af6d40850f10ef698c120ff637771ff4f643c30945ebe40b7f1e358c4f2a07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93a30f6ab6646dda16284714d8400c40930d132670a31b134cbc510cdf76cd60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8985273549488ab794c021346857be5f43527bbe0e5d43d1ff0945362a002b24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a61cfd685efaaf94eaa74f334b271c570f89f22439d393a485df5a0f17eb73be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3bb7780bd41ccee4eb5b42d55f0a223582d609e128295ce69c583505fc0bf1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 302f40f0501cbd2ad461fd70461eb78c9530b451b74a523532d6f592630ffc20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 177376fab24b930da25fcfa4ceb34843f1a64f50d6759e4de6e722ab8b21602d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71cbdfc8a3d68e163e591adb17fa28b164bf7fcc6f92e222c3fd65183f5308cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5567dbf790d4fbb33224a437c45c41d7ddac3a7720e6cc1054be373655de1435
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fbc35d66fe8d4929ec9a92cbf8dd7dbc6c96f53ca77aca9d711ed8e37dc776d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 535bcab0794fb8b8d177e84c6a429f608b362f351f08300a4a264715091c80ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d1c46fd033f711cddfb1ece38aa37ad32d04351d4439460dbde17047657fe35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf368dc356d8f08d1f392c2a93a138aa36b27bf549e7cfb1fed1fb2c266c7dfd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2360fd2bec0b380800815256148565c68eed5802a662b4308842e4883f841e40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20780ccef7b39b4825ff89f6c8dc156fab96655c8e19f9d585f3aac403f4dedb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc31293567b0b935b96f234f13409891d432d34f1674d7b542bd4113e8dd722d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a535483ea80a31dd02fce810c8f74966a5222b65bf00e9b694a2b1dc0ace6359
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06ed85550793f68e8b0a92328a692347c35327a1958803abd193c4bed4447ea8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4684bbfe48be731e1014d9b58eb3e69af501343a42bd6e4dba72b40f22129d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0cd18c28c2fd472bc41a53dbf605b01c2a3554809cfe2c21eb39e49ab7a4796
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6a643ae4e9cecd1921ace05edbb1669d1e2b770a2ab40d86a54a28c5e00d368
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a916473067f955adab6fdcb75292d406b3c667a81ed30cd357c91d42747f86e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 213a7cdddbe75aa87623a63370ff6691788577cb77e99a7af33cac7fe39d1e20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8978942f30d5f0de16232c47e7dcce61bc481d5559224abaf28832029b358879
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c148d0c3906bc5e0ec2c1ed830d127308e8a877a3f053ab0e9cb505aa6d33271
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7bc20ea29df02a4efd9c674f45584e3e1944d54bebedd2f35542fb2807c7110
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8513765267daf8f12b1ee2c7b6860468b3eecd4024e287136b959495160cefe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1056b9f6c99ab72ba509925b641613de21e6d656d4c7490556e79c65b02a72d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b676b46bbbee572a668ea30f882f33d940d6adffcacbe2b9d141dece0544bb67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c4d11452c73b1bb4f339bf4f9bb29c4a6ce764af04737a83a5051247763db30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d02cdd67112499763b6777a3dc56c1a6b4828e085f0844bb2b4a5c852948968
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 094fc082f12d2caa1b0c8bb9ba6b81e7ac8ac8e1f5ac1cc614398680b4e040f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d01a946de3b45d7b6df202aef8a2d91deaf8fa04da8bacad345f1af21cc98b42
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e59d7489ed1ac7786a6c3e1bb269a103536f18ca348269c774535f9b6131990d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 879b38d6bf58dea7c5c9f2ecc12eb31a7cf0072142ee2573e78febd2c90298b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 268e2be6bff1c0f3069308107d7464e7eb875e01a15be4b3e6f75c1621e5b26b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d3f5c90c2b82424d14a481cc918629562346cfd8b3031c0dfa4272498df700a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2748ddee2e64e6a207c24af1b50ebad10b4ab5be78cf13deee7d56519a0d48e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f77dd947860ba72e59bba45210406e01fef7f667e8b9485bcdb6ce0a4b5132e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd622ef6653490145cfd27c29f36f386ec444bd18fff219d854537c6749ef30f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e640df2574e451c665e657bc83e5d49e8696790f0b1cd698b906e2407c62a8a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34e928801d7dc5dfe3b12c8b8d54a441b0fae6fc4229c810d4e3fad7111450eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9221b8b16a2cdb9ce4fa8953609481b158957a6acf3715b4f8f72936bfd8df9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f16c5babee67e391c9931defb4d20f5d214ee8ec95a611a1a36eae3a404b0857
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb736a97a69e738c2a512803181fa3a83d81e460a81c4a975e5609e587182649
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 051b5de47032ac218d3e966a6bbeaf28406e71a59345d64b500cc3dccc0b146a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d59a91fb224e81d0b3875325378516b219ac690834b0d2025668355fef7a7a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8de530ed42569a25a8d1e1252bd6df57059df8382032ffa052cd6add98a87acc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 729fe57841198419e9708f67a369964357e5ba9b012c09f2a54e1601e24943bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92749c3e92586d00b37518722f7b60553cf488f2e5907cdf115b8eb5afaa2647
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3edfa60c4e583bd63d9253c2780455bf35b787799c66c4216f85aafd94073bfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59f3a1abc4440369d1d3d23ca28bb5966318fa219baa2cb8ef5375cf6158fe0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56f98c0d5448d95a3d86d94187271e08a35ec319bf64bd4807ccab69ea9d0388
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afa6b849e3b2b0bb8896a0e64b9fba1ccfb1b0c32b8f071c7ca0549d7f01e3be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01bca2c2c591e0e65b0d1d861b4da922c610f6c0455d603081946735e17a2525
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb5d9c9b5c3ccade6eae050f6b5dd581c1d968d3a3d703f23c756b058006e96e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47c2a90c097b3fdcbcfeda69dd59575dc3ec8475e59f830c30ebe2ed180dd8be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a75e097b6a6d9e5578caa884cc42c3e58d6c4062d1d405cfadb779f1be85a4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 440272bee0bc4e1a4020af67f0edf1acbb81a565044cff24d82c87c09ae52aa7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ae580a1e22644145e3875a34fc7b5ac367faf519cc17a5a8187f8aed6dddb9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a1d8d08cc482da60cb09c82cf8f6f0fbcd47ab936090ea3ffbe4934f905f59b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d341fb762ed07a0e0ec4b5a90e21944f5598a6894989cbc0f7cb3aba6ea81fdf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75515a6aebe46f11e4acd129fa9007356b4be37c8cddc80925dd9d6c3331e64e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c32701db30d5fb7ea7282a7a469f7ea6edbd7e92ec22bf9fe3d5df92102aaf79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ac59e4ada50f679c3b402d4ef2801cb6114a002ec1fd102b2167a9d90925e57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc548ab9ed93bedd1b6c3aa86c99b183b1926aa4aac8a47d47020b5cb7c362d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa192a73c9a0359cbb6f2628bd39cea9b343dfa8d70f2e0914df06e8ab53161e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca2e27a60b4764fb87d8df439a98cccf76c2a474cb4dfde7539bf42961d77cc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23abcf8d82a5b13c5d3474a24e20e239860178725028d6cfba0b9b15697d9f50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07d9b346d94418404a0e9b4eefa2eee576e9425fa80c4014762b8e594cf9cf94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec999591627ca0adfbf38927b3cb0b4c625e1a2a673f7a9bb7de558898527a0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02301e0598b56627a138d4e5b93211f501c82001ea2a9fba0490fd80193ac404
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5d4ce936d5302e578e4fa5efbf3ef8584877d7ed272af9baedbf51c66955150
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 057d0f3e2e80c4372db5c2f7c0f3174e30d967f24c10cf74a2e00aa77a5e8421
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1cefeae9f11419b78ca797ea4f6c80f913d497ea9852fd545aa3365f621abf86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68c888c9e9c4755301b75b75e143a90155f1421ba89ba8c13589a9cccf0339aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22fc2d03766f0712c2043d2a32c713ebf2027f558a8ec8a632a3bec455e30131
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec39611dbf17b2f764d39bb7a72d2022b51b211e0ecd511235f41e062fbb1114
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da88a874a50914252c9958ff3fbf99c5677f6ec3bb1afad2239ce1767037fad4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8763551f60ec8836c3266265f605ca07f51d7804361e9f8290a219a46c09026c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23900cc846f95ca447c1a8ff1818a5ff13d2e056cf411562df6ef2012b54fc53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c8262cfa084a3a7735a274206af17bbba9b12b1ed53c60284299bb2787700bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fa833402ad8e02d9eef64df9b15d41207bb8ce8acea4e5d0be06c05f40e4151
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a994436b9605611a67ccc399ef88b7db26f2052b62d279e15e2107880b8c569
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c65e0a87ab256335e7b4308f44973c01398fd71777ed0851daa3288014cdec8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66caa7a9b4a01e3edb189534741f2340c8440e2d572d51eeadcc8bc2a65311f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b74b88ceda73568f1b2a20ee56131ee357f9f32d5bac757b57ce3098b3af2e20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6d1a2211e19e5585ec16ce0ed646198921defabfa06727e0b4e10aa752ecd77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 654cdb714af416f9a751eefbd0d396ec391214872a453e7c0a443b32a1dc59bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60c627adf43bfcf9dd9a5bb6ca7a6a883b8917416ba4daf0bebfde7ae8fc216d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe277030ab3253cfb53bb458025d67d634a77bd3c36f85299d8015f943b7bc41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8a18b605c8b78514f5b17bdd7bc7c5c5b07e9b90d4d6735f55c5dac7055e7fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b18ef1c63d2df47c1433f45cac51a7a84524e8f991714b1437aeee61e9f81911
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0330f3f14a20361d03395f314efe48a81d28417b1ac119186db67a436987c76a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd01be82e2799bf45cb5f62c9dbd2980f723f4b79542b7fd404f3d3fa694c5e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d13e84d90a693d64653cdcfb3eefc0fd70de7ca25a0d7d8104caa03db5dcb1af
            • MD5 SHA1 SHA512

            maintkjhukuk.exe

            • Path C:\Windows\install\maintkjhukuk.exe
            • Size 737KB
            • SHA256 e50de2afde8a9a4750f80e8ca01bd06a30200c969b76088686e1df0118f92afb
            • MD5 SHA1 SHA512 SSDEEP

            memory/1544-8-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/1544-2-0x0000000000400000-0x00000000004AA000-memory.dmp

            memory/1544-3-0x0000000000400000-0x00000000004AA000-memory.dmp

            memory/1544-4-0x0000000000400000-0x00000000004AA000-memory.dmp

            memory/1544-5-0x0000000000400000-0x00000000004AA000-memory.dmp

            memory/1544-9-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/1544-15-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/1544-687-0x0000000000400000-0x00000000004AA000-memory.dmp

            memory/1720-710-0x0000000000400000-0x00000000004AA000-memory.dmp

            memory/3584-49-0x0000000000400000-0x0000000000418000-memory.dmp

            memory/3584-17-0x0000000000580000-0x0000000000581000-memory.dmp

            memory/3584-16-0x00000000001E0000-0x00000000001E1000-memory.dmp