Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/08/2024, 19:52

General

  • Target
    876f518593fe265f0c067800c31f7307_JaffaCakes118.exe
  • Size 308KB
  • Sample240810-ylpfcavfpr
  • SHA256 f56722b8df69ad725f3cb80e69c44dd22218bc8618db5b8a443906f26b3c419c
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • veronicasexy.no-ip.biz:8080

Mutex
  • jajaja

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    System32

  • install_file

    explorer.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3416
      • C:\Users\Admin\AppData\Local\Temp\876f518593fe265f0c067800c31f7307_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\876f518593fe265f0c067800c31f7307_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:512
        • C:\Users\Admin\AppData\Local\Temp\876f518593fe265f0c067800c31f7307_JaffaCakes118.EXE
          C:\Users\Admin\AppData\Local\Temp\876f518593fe265f0c067800c31f7307_JaffaCakes118.EXE
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2492
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:3000
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:840
            • C:\Windows\SysWOW64\System32\explorer.exe
              "C:\Windows\system32\System32\explorer.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:432
              • C:\Windows\SysWOW64\System32\explorer.EXE
                C:\Windows\SysWOW64\System32\explorer.EXE
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3724

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          UuU.uUu

          • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
          • Size 8B
          • SHA256 e6157f1de77c1033530301db48c16604d32f15f32f3a841f04e4cb399bc51106
          • MD5 SHA1 SHA512

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 229KB
          • SHA256 1f092f6d67e3b671f9738430eb81a55d1eec801803d49d20f92cf907a9047821
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f8a8339473f69024e3adc323682ff1bb3b295081d875614eb3069217e8010479
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bf371af20c2b5a40389fe0c027dfb177c268a85b06525ebfafa68567abb2eb99
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 968f8df816a673bbb0b345f126b6878cc701f0ab10404656174cde04a160c3fd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f4a7246126c6353975811919adfeddadecea4934f9335d0f5ec6f7d71e6e2fa4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d557ac72bb0318f3b5c0aae05c9a783c9cc7e241e64e32d1029258a910eb4b13
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a5c82a6d8738a43741a79fa7608e2d40d3a9ac7dd7b5503fa147755f664fb40b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9e671769718e6efc9c073bf6a600fc4deff3c449066b2bb04e49058b1bf7e2c9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 da8fb806a428db2db7b909a525c42b83c4802a62abdc32d8d6550ecf1373758d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0f921a9e3fcc6d26249573d5fccc00cb3f1ae99f2c23a6cbeb65dd4dded620c3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 50cd5a5f393f4c55862dc006b5b6710db0e0de23adac7dca76a7f3b4f28490f2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 331f69ee28bafd85b29ab84e27cb33affdc0917e941978afd9c8f0735fb1000a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 037939aefb948abeeae9deb8b3ec8e9c2ccdcb29462c54c221a33b80139715c0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b9edb02b5e360951c00de25a19a6458952774f7cd33627127cfe347f8959682a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 20b449bdbc4d42dd6d21ca3031050e5127a594412a1245da78c5450280b49a13
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 28eb7ce32fd9ab93a04bf3dbe202e86d5f69408cd76bc95f5630a83fbf697e2e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6634c5bf8a280bb9d173be9c86c901baa5f3b83939ac2ce621034ba1d9797c11
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c59df3238f2c1d48baf646aed2c11bdef9953b5cda5761d8e9d2a08949147edc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f2c55a8e1221d384efd9031aea15c4690398faec972e6623ddfebb6433dbff0c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 36a2f34788c6f86652d239024b172823aa2d522cb360f00885cf1db426085cf2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 26520d2676b7c4344e0b0cb30ad1c76501e93f38448b6cf5aab483041d6abeee
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e7efbf90f64cdd64eadefba4d16c8755329b0477108c29554db7cfc8dfa90fe9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ccb7daa38470140604a41e6f086d3adf302c6fbec99c4ecc206cca30f0b2d63f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ff962b87d4931ef9b09f3e002e9f98525cc73b676b631edd1dc3c4a9378d54fe
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f0199011ce60e8804d97d9bddca8783b5656b70e70cec224e38b29ef94a96495
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2f5ed1cb3dc73628b7d2d0b5e39a6007caf0d560f367d4323b26cb13278baa54
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 86c391482e6b3dea978469951c322fab93625f75db3083037d0efa10258f024c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a2ae03b047a1ac786ef4724904a30e1bbff440d620e233ba09559fb9ec20c782
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9b9aaf41563322913282d2e1df5a62ecd7c9990ffe33dbfea7614f95c7f2d3d0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6840d4ffe84c629afdeb932fc83a3331b86b84830b4ec9ae34acc9351a7329e4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 aaeb934ed5099b68553d35383b8cec92cfe506892710c4242084c4ca09edd073
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fde9b115cf47c60098a3608db83835b7001eeb499d34b4e1e943aede0282d87e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5102fc8025a5e9f1753318c3f289ca37a8aebaad18904398028c98645908d5e9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 91ba9a0d0c5bc9b80a58508c5a31c2bf389fd60c9bb9c81cd2abf338b27f4eab
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 85a37a1748233dfd3ad4a0bba5176c18706fa0bb474c89eebca54996a4d59ba5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 adc0e576bb4c35308959a8c181c1aaffbe63f378946588ce09c2de0ea3dbae9e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9ac85851ed934982ce5a8ecc421bf116d4d9be307491e53fd0ed44a3126eb443
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fca63f77f519004620ecda0dbec0f1ca2e5b74ac3271848da3ebe5536228364b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 384461f9ad958731d7e2ddb2540fc553c67b1c9548f5cc11f442fd22b478da90
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0b66451cd4d3f3aa57519006860870d9175a1f93694d42aaf922b273df1170dc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e1a00bacc62334475ac3a42052929a4a9d5d89db499684f91a6a949f5e806bb5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 52c86e48679ff274c23061891f0bbc60d8075176679dcba7a65a9537fd885cf5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5c4709b5112f1b69b0391fd11a6e424ca1f295f228b5207c3a31798b20ae6b26
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 635eca37164c39bd25a9ba1ccb33cafb4bb64da64e44ce705fa5bd778334fa3d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 409c9344ae097bb27b8df47c1d7aaae2269f788b5d872f5e47d09f50c524449a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1e2483155ac0bfc5498ae80e967d8c20fd46280fd1d8d6150b19c88308d5b7ad
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d59fb2b43fb598a5ec2c9c57334fcf51f7280e2c3440cb6a785460aae8650c95
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e951a9e9d39d0bfe77dd61274dd8c9397077b49a49207b7514b158ac84535320
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4bd43eecb1b8dee00d15951ca648c6f3e556c6e7c169e114efa47b4e8169298c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fc3954439c87e3a66828034af469d9272213104a3bdf5e495d8c1ea03134525b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9e4db04c26d56b65f6df3a41b644856efc61cdcc8bf2ae30db4116a33a5a2003
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ae01c3a55c4a64790a8f884bca742901a828d6d6f9709a184ca1ed358672c119
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7335ce6000dc4a4dd9bc8be20e59318fc44098034e5dbc3778acef19d006aa5a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5e9b91de74724320b11f414e0d03ad9c3045b4c7fc66db89ee8dc46ae6fd7f37
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 68dbac7d676459bd5620351ae8c8bd03086c4b90ee949152c4a9001b6d653fcf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3c3bbc51d2944cf8f3bd23cf0c84beadefc75f48af518b1b0bb1e6c3af9b35b0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f356bb48b3975edd5acaf6e364f9433b5c10471b526e0e3422bfeeaa67ea91f5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 05812a79ed43c294fea0c1be4fdb3804642657af331b76bf0b60939ea98adb39
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e0ca51e22f3954e26a2c198380d6603a68c5d8ae1e74d49b1b5ad4c0c9db6312
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0a962bc1decfe2413c496a05afc854d99c2be739280853305e6451745448f847
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ebb5464ff713a5356a44a73244457b1eabc2c2c75ed6fcaac265c30d0892980f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a28a7da10e5bb4a9135234bf7a19f8b3dcaaf99a1923602b5ccf0b5dbeeab1d8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d24f5195d6fc40f746fc04862b9d3f5dc6cfd60e508daeab2548fb623ad974c7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0712730b6df61d0dd2145a96e6611c0e12264a0a1c96f1a6570e548aecbccd75
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d09208f67c5aa35d63d09c2d4aab4081f7b0c745f83d63548e1b55778ad57a69
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4b8aeb0ddc0b5915913c8fccdde844175a484af0e40e6c7254ee7395d0a3a7a8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9de6b79c3829736c61f06921e51ab6bec7c2e4a4a5038d454523093dac63a777
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 63cfacb11cf8ae41c86793338d0a01259a57317c5ea66bf67a515b050efaa802
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7e46ba83615bae243059027e4322582e99d9c64133db965ffdf287b21623ce08
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 00224110e36502415367be246ec5c82554eb9c85a332eccf999122f5ff424f2c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0a350d89533270b9e8799a61df58798a9648577fa43bfcdde5d9ec601262dae5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 479be23d8fad8e4aefe08b11cbdebe0a810ccde00a81a84a9c46af5c4b5d66cc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ac046fdcab79b52ca93cde58f50d1c21d1914d6befb3f51087633a1a27acec9b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 02a50e3d27eab5858219a8917053666072e8c7f6ac85ab563bccc3dae72beaef
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5b229742c08b05b4bf2f964768b62d662768631457d657a96573815687d58c11
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5d63ba5100292956a470b4a7d4559974cf0bc1e64228005dcb7a03c839fa147b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 88ea7adcb61104e897021b61bbf406626e9c99baaacd83a3f80f3cd665ea416c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 318b78e5c0234f71a57d6fa55292137be9ca3b5196d9eeed03d916af2200bbd2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 be054eff72917956e2d3802bd7c39d7203526a3c3e30fbbf23a73646c3a58052
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9c297affee5abc8b8dd8025a8b29a0f0295e0e373a06dc0edfb8e63a8d194012
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 92e6dab9ba5a9644427bb36e029af007afc85194c31c7705affa6ecc8e1a56ce
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5b1dc6c50d68e5533cd7cfa7c51fc0f2fdfdbfa7097bdef662ccc607a89f25f8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 81824b79adb8b695b8d949abe374f14df52495a7b67b86e5e7e825d95c8d9542
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c2f67d23c3054bdc2dc99d834cc9df0661ccb45fb48f9f483c4887f701974100
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5e5b6640a6d9d2c5bd93a3e497642a28214fc9578d89a42437c64cd6d38f6d04
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8cc5abb18ef04bf57563aec1a2b61f987685384c953bde3fbd6684d9c735bf25
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 56a4076e5d9944682c184b865ad813b53e7549b6670931c9bdf501449e0f6460
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a1b262ba6eee4f1641d2a9aed9276d91b4ebf4d5affb9eedf1b3b4ed2ee3039c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 63bf38e5dfd6c227ae83b6fde74159cbed7b3cd7cfc52a7d5b08d023f442ce63
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 98c8c9928a498678f7d3dcb8a102ee6ddc17892e125ea3a8a50d2c15031318dc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1a9eb801ad0497fd8db5316a40b7bd6368bc0aaf7cf9796c3f1be1c262bb47fe
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dda912171282dd1605c51d162addcc766bac136a242694b5fed77752cf0aa46c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e942a48a463880a016c936e3cec5465ec71347ef04067fc06acb62b3473f89ee
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cad639c24f615a1926567201efe3c30e2c057dbc936eef79be63ed4a744d1d2a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4fad3ddfc67b52e9fa4e8024a5eb5a2d9f4589c4b0c8869ecd808b3b51527a37
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1483612577c7704bc54a427594664ddb6fefc7a4d11cd8ffb13c78e05518861a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 20602b61290d93038bb821dee457db380ac2868dc0df2931a2c6edb5b8ec77d0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dc8e39f998fefde40fe57d8e9eeabee340fe01a8700ddbbcfd712b49b708a17a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fbb6ccd702f2e396168bb751cf9982b47c3ac8c4ee5e134c6cde5d300cf482b2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 73eab0ed412c59c66aaed325c236a18f7af2deb1e44a921c4606aa82da87128d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 69547551e2b7721e926ff343c0b550971e5f3b984defa4f0e5c809edd9d517ec
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fd9928860f3aaa8d9a054e58d32595d61e15b29cf104a5293b1884b4b8bdb614
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 eb024babab148155c45988ff27ed09cca2b89bacf6aa7bde430b6fe4a0edb94e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 68098f3c887048b2a9d438ab9ccf88e113ca5cd1dc92abb54ef1207506e2cc61
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bf85febd21708febca63cf26e5da8ecc8195ba753c867d28d4c078b6a882a731
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 12beaa3acd12ec32e36464e32505cdcabc0c343cd61f5669f2e5d758a82a3513
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d759d359ee867f0517bd43f68d789e4f18baa659de80681bc5e4f46562385408
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fa0d92909514e148ed32b657c3d21221777918a1f0fe9dbe5591d525313ff0e7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bdae5ebc4f5c86d90020d151dadba16a17f765a20365ba32ad01fe49f4898900
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5559a81c81aabfcbccaa872d42fd86aed42e9a7687e9d5a4521b8533fc141a0e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 347bf62a27b64c8ff0af6e2d0c9e75556a776175f0ff57e4f6a13b24227af731
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 75b4893db87af2b872f210d8dc46495b7871de5df35cf36ec0411b03a9576803
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 47f457e0add930ccbdf1e611cd7e9143c72a54b6bf1afd646535c960882c96f3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b93421e7b8a026c3e0caca70d2c0246d6392f6eeed287d5a7b468375b39e2140
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b1d8aec61b058e2c1543a6817ac6fb73e4be20487d49d895ab6a95d0d2ea04ef
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fe271728077eb816f7b74590fde36befe3d6aed6f5ba9d0e62e125051b722d0d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 892b8c5faa81b87dc632632fb326aee7675a0269525a6e5e231b20aa3c8b581a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c08831effba6b1c520f8cbc9f7bc44cd4df0731204a4a7747bde32308ad1c98c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 95a311290758fd83fde5b2c45c667aabadad513772b8d0744f6ed1ab7a957422
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f2afe3d7ae6fc6971059a0fdefe3ece3d0f522cd487eca34f1e66f83054adf17
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 23cfb30e73d46b46620fed03537ee461e4c4d72161d66ef2f0a3ed1b74d80f93
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ecf3242b9c71c932e8345121614cee3ef90937297fa794c429962ef836230dd2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 030c153b65efa274feb070fdfaf3532cf555102f2534a1081081ca95af952b5b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 414b6e761420bf6404ebf7f9be333535a2674fa8fc76aa64a909093c782f40ea
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3e933537521cc3b7f5996ada50750b5a6828e066bf091242b33146af97c0e487
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fbb086186d54911fd06dd38ef677c6c7581ba76b2af219e78071b7871ea1efd7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5b177ede4ba2e517e922cac43504777c73056f8c8f414b3b8489e0994ef1cc2f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 00d16aadd43638c9d8b47afda676fbd902b5bb9430766103c3e4525fee9bef81
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f8e14e5d34035e131c86ae9c7747eb3fdb8b6876d469496c9b1f792e06ac4422
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4d0cb7069dc608b2e299a6f1f4c0c6e5e1a2035d7b8db48767990a15e6bd0ca5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 249df14cc234420ac7e9ab689037e0bb18bc82b0070f86ba28e3f30c94810a00
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3d9f544186a59f7a8351122424b2327d067d9cbc51a53cfa8e1714bd66441e1a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2c42502d22c72a8b34861ffc951c543ee2199bc690dfbed59b893d6ed8cebe10
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b1e223c536f8d41ad4a7dd999fb30ee2918babb713b8ba303b647fece28d67cc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 97dd07f09b6c1b9d3da8bc69758928f5a4caf2b00abdb26e09d9ea618b92d31d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9086440676d4ea6dba7ef7cd176e68ca6602749695739f935f08641fe4a972a0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 147ae08c23daba2437b2052b32a70212122305c16b952a8e3071486482d7aaca
          • MD5 SHA1 SHA512

          logs.dat

          • Path C:\Users\Admin\AppData\Roaming\logs.dat
          • Size 15B
          • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
          • MD5 SHA1 SHA512

          explorer.exe

          • Path C:\Windows\SysWOW64\System32\explorer.exe
          • Size 308KB
          • SHA256 f56722b8df69ad725f3cb80e69c44dd22218bc8618db5b8a443906f26b3c419c
          • MD5 SHA1 SHA512 SSDEEP

          memory/840-1330-0x00000000240F0000-0x0000000024152000-memory.dmp

          memory/840-143-0x00000000240F0000-0x0000000024152000-memory.dmp

          memory/2492-10-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/2492-142-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/2492-13-0x0000000024080000-0x00000000240E2000-memory.dmp

          memory/2492-2-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/2492-9-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/2492-6-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/2492-5-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/2492-4-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/3000-876-0x0000000024080000-0x00000000240E2000-memory.dmp

          memory/3000-75-0x0000000024080000-0x00000000240E2000-memory.dmp

          memory/3000-14-0x0000000001010000-0x0000000001011000-memory.dmp

          memory/3000-15-0x00000000010D0000-0x00000000010D1000-memory.dmp

          memory/3724-176-0x0000000000400000-0x0000000000457000-memory.dmp