Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/08/2024, 23:34

General

  • Target
    83ff169c787ce0471897dab7410a62be_JaffaCakes118.exe
  • Size 897KB
  • Sample240809-3kstlaygpb
  • SHA256 d974b105b11cdd474fdefcbf8c68d05007917e7a9787cc2f69eb6df9a526e72c
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • hackercioccolatta.no-ip.biz:2222

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    windows udpade

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    123456

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\83ff169c787ce0471897dab7410a62be_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\83ff169c787ce0471897dab7410a62be_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4304
    • C:\Users\Admin\AppData\Local\Temp\83ff169c787ce0471897dab7410a62be_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\83ff169c787ce0471897dab7410a62be_JaffaCakes118.exe
      2⤵
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Users\Admin\AppData\Local\Temp\83ff169c787ce0471897dab7410a62be_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\83ff169c787ce0471897dab7410a62be_JaffaCakes118.exe"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:3040
        • C:\Windows\SysWOW64\windows udpade\svchost.exe
          "C:\Windows\system32\windows udpade\svchost.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2740
          • C:\Windows\SysWOW64\windows udpade\svchost.exe
            "C:\Windows\SysWOW64\windows udpade\svchost.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4972
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 576
              6⤵
              • Program crash
              PID:3248
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4972 -ip 4972
    1⤵
      PID:3428

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          UuU.uUu

          • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
          • Size 8B
          • SHA256 edf8cf04523be265cf374c8db331e57ba055b3001230b91f0009786818cd3b0a
          • MD5 SHA1 SHA512

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 229KB
          • SHA256 4924b652d416db85b9dd837d468d6ec07f0ff0373eec209462ff76b844696c16
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fa14cb39ac865ee6403869ddb43aae764b4ee6b4e7fd61bbdd4f95a5b94ec273
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1870ad7b79b69963ea8c56287d1b7c35e9d229f3aae048e12bc2905a269c9e33
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 06aaa971c8511f4a38f03bb23d9c884442990130174c527f579dcb36991687a5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1d68a4bfa06b5a8cffc57fd37b5a55a1d3783e6c1f3ff97e2f3538ae2164fecd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7745b7b32484b0e2a1d8f8307c28b72d3b364c839dc6271dec2b754c3e2c2d01
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c8310bb00cd1fd2701731da1c91a4102a4d139994d1f55362134434655c7eeb0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 afa149a9def5ee6077af85a957dfc0e451dd58a06dbbd0126075180b9b161562
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 38414e26d0fc1dd89cf827920ea9383c587f05f5fbf67bbcaa9a5ed4575e493f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2568d01963aae354e619fe77712068faa3e4d97a97ff970d440a7a6bdbe9e965
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 06d9392e5df558b2410504ad9fde7ffffc1ba356afda0b03286ecc0418708f77
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 aea49466068cf97069cd48f20d70c1de262acbe169bb5681eaf38be2bff98f6b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 006cd464cebbb02fc5b18b24f7c7b1b7d614f15141fb678a401839b8a55e27da
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d13d919f0ab4441e2b0958f8f23bd11721fb366722045d4a65216e188206fbb2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 48a17029545fc410c3547cd5f742f45e2dd953bee5ce442cd095f5a28a18e83f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a5ccc8a52161a59eadca3d103dbf7cfc87000fd46c9c4c85099fccd1be43cd6d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4b79516c7b054031108f5aef54dfc13cccb391ff9613eb241ec20c2687923f72
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3e936e0a7cc7d8a9b50bde26f40737ea59210b24afe90f3ff1b63c7270aeb488
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1007b81f14ffea2bbf312bd476b87746d4a619c222b1be977394424455b603b1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 90b602ee38c45d7d08847821c16137ab3256819d8ac08ca3cafc2560edb35673
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1645698805006c906b4ca4ed4a669d2458f7d56456032095d3de9a81d61a4f77
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 20b747cc8359d4457c7d30ecf05f996142238fafa8e29749ae78c88b9e4bff1f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ff4bd730264a436f240c1c4963705b7a1e86dbf54efbdc9aa8f371c3c91fdc33
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8fe9d396ec7d931fa6c7762cfb6c538b65ae3ef5d880262fc62498942de7904b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 59a03791d18f4f75a714c781fa9401d7775e3756f449dc591abc85349d2e0ad0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2538332e9c5aa5f76d537fed2ed306e0d8a26ffee01fc4bd9cf4bf7200940ce5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7a7a5168249c39dff021c2dc655bbd8f6dce3bd998b20f447c19d85808abe7ee
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 84390a90baaaa71c7bafed6554a9c60c3590a7ac7b7ff2a7de6542c213221560
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0844636d531cffc0dc7d6d0d78ca7e191b85ba4ab09d215c93c7b380cf421c16
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 31ec6507a891bdc0fc59fe800fbfb98ff7318734e6c3f34ddced23fe54194146
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d2b755c43682c4a4e21ab011efaf1dbfbf2a9d340266253c1a4376903da5d298
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 441de8a8b9d6bbad90b66a6bdc01e1a2df9d125f2b94209e6d7d947804c3c58d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f18a28c0454a1926d0ba73dcaba43a2fe7cb1224501a25165d3f16d1d2ef8a4a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 62c93b6f6c144417ee1213c81eab6688e8a1bd3d6fef1e2d8d757a4456e31b2a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 04fd3f79daa3d40ce7bbcda9b9dfc88b64a67e0095b69b353a6467b7660b09a7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 594be9b74c1b55aed91ecf80d662a70eecc00c2432d47ee57c28dc9f2110deed
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b170acba068fbab8943a2b8c8474bc1cfa12e1931314d4d6ee78965cb67abd4a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 46ab4d16d89e2452f43e787bb674c324efd4da4dd74ff3f3883d69515fbfd2dd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2d13084b50125dc56268032aa0feb969a1a3225e5f7269fa6b957397a53932db
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3442eb680218a4af46e26fc4df3901768461b4ed110d8558e88900b80a5f4ee1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8c5e02211eab86c7701588444beb05e07685d26db5b1a313074a6932fdb563ac
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0fd3b72ffdd3c085c0ceb7900d1783afa36537cf4635149a5da47d3e04ad7023
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6ee16412fa72d5c1d35b5b4e1c5191496a1323c14099d630f75c4de30adfbd1f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 36f7f7315a97951b1780b0fba234b9d312034fbb4c6ef216fada72458e5e3b94
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a23cca8b698c10170455b4742fd7b11057c12786284e70316d8fb692dd8f64b8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2ab45a8e8fc956af55fe54208dcfdc81e4668922141a7cb5b7709f2dafa3ebe0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d38f8943d5ea1a30d2c9ebd7928a05238df451af03f9a094a0d994445a5790c8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9eda462a7f3d3a429d2b3094857c0dc93cfdcf56f14cde5a79666c8aa4d0eaa0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bcc771a2f12cfa648e373d6b1af30882cc3fb62fbea57c03397a1ae9f712c68e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 35fe8f8c02a219f91955c5917c1715ded824dcce79c48596a4fe8f46e9bee4d7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f9fc3c25ae61096c05e763701e4d6be7274f210683d390f12ef72522c2d65531
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3c33d692bb0246c0a09488eb72b12053f7cdab5ccddde425dc37e121bb6ffe9a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6970dc3f497fa6d312634eebeec59a30b7f1c87e25455d102bb8b5c462827a32
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 49d5696d879ba6edc1789a78309b4526bde19c0dcda8ce3040a3183840f9698d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 db2ed554796a638f918d2f14a04e9d83a8a9e014dc02c8e298ffbe1b5704f36f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2726c6d237da498fc2d92c6c16504c8982a46963315235fa98d178d228f76703
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7337e4aadbff2b329e0258769a89723c7f0848524470818927d908afc583099b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4d0eb1c1a1f3aa5a17ca887f527eff66cce0dbf01a09ce8d13d06d12ba483447
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 594967b44ad9686df86b29ee57f7da10ae7dee3e5340aed9668840d28f0a5ea4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cae55108d19d248200f626116c58e35a04ba854fa5fe0e967df7258354213aa9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 80d6779b9d22901797005a294db276476b92f9c1e1dd611d292474594108e0f6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 caf3c567c81055cd4aa593fcb0363b43519240c803fbaa9eb26129cab542a413
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0554dfe109bcdc24767438be629d406fab0d4f9963370b675d2635df93f5a62f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f6c46b199d981d5d3f931df33bd00bf77744f1f1c6e4dec80af6d31d54b96d8a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 39122fc4e6f45b2e19d553b2eeb120aaf0c07dbd60188cc64f8a6846327e2766
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fff388dfbeca40339cf6af0e88e466e06f45c8243892d1d71791cf23b8e08d62
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c3d92716a9718cd6e9dc95ebe7ac1584572c83356f13e41065bbb84c56990431
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 af7fe57ea2c419441608a1b7bb8323830ce78c9f7c30f138afda46acbf300111
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b2eb8625350946a101f73639fb5ed9f8cc93ff569f685f1afa2ef59996c710f5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 752874c96c71ca8cf81d717b81e06bd9118f30133c65dc0ccb40131e971d5972
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0955872e9d4ddd04bb055269efc0d08fc3e698af0add46a4eb75219f3c9cd9c3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b4f3da48b1f2d7284fb017d660cfbcf6c78698ba03d85b63acc23fc2fa6bc62a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 96649a13d26b28db52ae515f13dfb1a6c94eb9c11a83883377a39298bf51b5d9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b2c58347a5efa2ca5a77e5dc1dbb0ea58ba67ed61002d37bf713c03f3b12a5ca
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6faccf04c2e57d27081cb21519b29cfc85adb515235d444d89fca020be35a3c9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2cd70efca80e7c58c8fdddf3c1423e13f4a7d408b7c5aeec98b6e1732cc02501
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 700a9bf7c1ebabae826861219dff09c6314799d116800e0f08f2ff077b84ccd1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0c4140990b0378a982924e3c014257aa2f6cf3ff759a5138e306f64f32a0af3b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 72c28759fde219309d4df0ac3be5e0c980c88581c9af3c0b955377e7a393844c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 44f8655a78a1890bda03e8b12c1738cf20623cda2072d4622dc2cfc05a249510
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4206a6b631bcf1efa7b04a3afa372d2acde97e45b3525580c055ca17bf6592a8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 381cf222bae45a3de6c3fed4c8e3781478f72168ee9848952f019a388ef23d84
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5cd871046308801b334edac7f9188c9547efd985d0e988261943057c325e1e1b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fa693e48f61141b8b3a2d47123c7ac3b60ae8ea0ba7bcdd570474f8fa8b4520f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0ee48bf9936e60976c128117abe58483e867b776b7e61c67310160eaf190a3a0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f9bca828e0d4c5ddf4f4319a075057b44123adf42fd267ac38ef35a8cecbd483
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d5c99338c0760216f5fcc5a003a07208b58eea52911aa3443288004218304af2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 410af954df57e31f6354f667a246f445760857b261a8b63a8abeb178d4e1604e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ea2c341b5a78bcf160b22ee45243475ad3b3aeac6566c0efd8545652e7d7fb94
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 70be4f24923c03ea86f87c250600160209ccc9a448dec5906ca0074a6f5c360b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f07b5cfb57faa3ace529d46f8e3d8235d0c5c11f547f811aaf4ab95d279af198
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 efe8a409ef808184ec10194003895220ed9609de8a36618220beecfb074aa2af
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c5203741a76c05fccc9ecca5aeb791b744572bc365b2418212ba910dbdc1ab50
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0a8b5121369c011c2c7f628f7bf85f8e82991a8618915990494e83b93e92771d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6d45227376a7fe651d00db5ce49b6ad45bd5a550289547f4d6a81db09e0408d4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 86646881393f6fcf754d498ece9dc2dfeff39f8c1249bb6d004ea7ddcfeac79e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e1739ec07aacf9cd968ed82ba617b47e4673576a0b74f7440be66c5524ce8bd6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5f09a36648d66b18aed71fdd0dafeb791654419ef32c04be8b68142e7086f520
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 22f9255fcf08023b9671e87bd4aa3355ce7387de81c111a4581621cc9e4888aa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a60ccc7be9eab95b77977c847717c4d01e878844bfa6747097416439b4d496b0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e6efb9b095aa27ca9f82dd0dd8bb881ff04536d164e97ebbe961a3fc96e3b5f5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dabb7e1324a15b21016241a8e24437e31e7cb57dc278fc00058d377209a0505f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 db57b64a84ebcfaf74402d9cdbcd3366657c9ccdf7823cd018f415ff5728a92f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c6b39fcbc6144e65784a9901c0b0621067bdc378a5f75385b63e3b9ea966e0af
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d367701aa896c3873e01434ae80436297e9c9258ff01d7f4d64926e3ddb23753
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5206150d6c38966f173a63913fdbb3d9e24ead8801111acb9987f067c263678c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9176e04aca68bf32d5f4bc56630cc83c183fcd804fdf3fcb6999bcb11e6c170b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3cb5f5aa0dcd4fd0292d9bf0ab3b6ccbf322b2fca59233fc7ed37afaa941a1b8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5dd97ee8a2bf7bc1476f92e3772fb7f1d7ac9469855762fa644861f0524f909c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d4bb9923aae55a81082648202501f23b9e8ed449cba4027ad29d88668234286f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c2000a2aaf07ca30c11892c2ae0c68fc0bcc13e33e84f5f679ecdd118b20a690
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7f1d1066f05b5ec7723ff3adea67f918535654b95b0b9e40be5999ed17439c62
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a486a3f9a686c44ece8aa8e14390b87f103a49c15390ca7a32cd134467fd0805
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0156d7d9b410407b99b0ca39dfa9a3c405a4d0c805cb7c464bda72272fdb904e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7eb757f5a2c4e346bdcaa3f7216f37c8cab4be16b8a63f7c7ebfca6fedb39153
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1eb0d951bd0cad3f0d3eda76f48075cfa94de0019d8348dc7d34251210fe9cb3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ff3087f1771c85c95e5eea0551e78ac4f4e71d635c6c6ae0eb217304320fdceb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9daa2c34e73fd03ea461c995210dce8677141ba8bf6278c4d341cabb23c870e2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 52abd792dab652810201ee4f6920003068482b03ec23550e9fe0888a24c6d147
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 83844ddc31b71157e569aa8ebe16dde3187bb46fc744fdf94eeefa2a10309b7a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d6bea93343f787550c234282a81cfe106b005cbbde76570e12d5a0e1ebddd017
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 69299bc003cea498e3bb6ad93622cf479e23900d29246dc024fce16153035763
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d0aa86925b467e5200de0cc235014a84979461cef327c68ccb4dafc4bc6eb158
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b31de0c254c2faf75ee248f291f1bb6ed7877164379577aa14743a31ca37169a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 23604b048ea338c624cfb9cd08564a93d2718823dfd53c514d52f9d4a3686c74
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2847865c61250f8786498857b84782fae336261ee17b2040e145b410a84eea4e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 df2ea99baa9eb964ac3b41dd8059aa3ef38d875c51e3d4298b35edcc46d9222d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 04afcfd674afce8414a20f066fa80d25b2856e8eb1c5d1742c527b240bd12a37
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 445287a8dec62b1b3984693812252415b531580f8473eb7e0ff3106ca1a82542
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5c95c5e5da01e23e136fff82e13ccbe3d109e04bcbdb82c8a75f3ed46dd589a3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 49e330a80538360cf4bd89bcb46fb92d79ec1e937441ca32a606cd15a27303cb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 401292a50abe7e738f2b5d8436918e7854aa7295126452dff2cffa473c4e473e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5f6783cd473c31e0a3ebbc714fbf11b89f73a7b600b8577948e36fe70cc89cbd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 76b1ab86f17603f1cf321453ea3c03b3166fbfd8f12585cdaa5fb36ba242ef77
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dff519f7b442a705fd01f93322670b17de811c8bba08d7e93d513b37bf137b61
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4b6df456f6bd0eb603c6cb88b8fd8cf01db0ea488541912442a02cd90829fd6d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c81f40f72643a6f3135992814e94c9fcef74d9f7f51a446997629e3f1a5a4c7d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dc7c73a42e40ae421673bdb2068f9cb938a17bb39f64ee17c4d041f4fbbbc691
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 25137de79de81b3be7e70b9991496a6996453a88c73b5204477d844065c6461f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c602821e6634b78185b585aa481ee16669b9a72e36ed8de28871bd03cebbafc6
          • MD5 SHA1 SHA512

          logs.dat

          • Path C:\Users\Admin\AppData\Roaming\logs.dat
          • Size 15B
          • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
          • MD5 SHA1 SHA512

          svchost.exe

          • Path C:\Windows\SysWOW64\windows udpade\svchost.exe
          • Size 897KB
          • SHA256 d974b105b11cdd474fdefcbf8c68d05007917e7a9787cc2f69eb6df9a526e72c
          • MD5 SHA1 SHA512 SSDEEP

          CAD86D91

          • Path \??\c:\users\admin\appdata\local\temp\CAD86D91
          • Size 14B
          • SHA256 829c0a194c903d4ccd8d002b761f962866b1b4444ed689b89cc5b4c6613f9ce0
          • MD5 SHA1 SHA512

          memory/2700-76-0x0000000000400000-0x000000000044E000-memory.dmp

          memory/2700-6-0x0000000000400000-0x000000000044E000-memory.dmp

          memory/2700-7-0x0000000000400000-0x000000000044E000-memory.dmp

          memory/2700-11-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/2700-69-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/2700-5-0x0000000000400000-0x000000000044E000-memory.dmp

          memory/2700-4-0x0000000000400000-0x000000000044E000-memory.dmp

          memory/2740-101-0x0000000000400000-0x00000000007A6000-memory.dmp

          memory/2740-110-0x0000000000400000-0x00000000007A6000-memory.dmp

          memory/3040-12-0x00000000001E0000-0x00000000001E1000-memory.dmp

          memory/3040-13-0x0000000000910000-0x0000000000911000-memory.dmp

          memory/3040-37-0x0000000000400000-0x00000000007A6000-memory.dmp

          memory/4304-8-0x0000000000400000-0x00000000007A6000-memory.dmp

          memory/4304-0-0x0000000000400000-0x00000000007A6000-memory.dmp