Analysis

  • max time kernel
    111s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/08/2024, 01:13

General

  • Target
    886a3d9396150f22f3431dc908a1d4f8_JaffaCakes118.exe
  • Size 508KB
  • Sample240811-bk9cssxgqq
  • SHA256 e92ee304f71e15ee4bcde461d155cd23a0c60a07d88089bbd022684734da3bd5
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • kabcho.zapto.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    photo.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3584
      • C:\Users\Admin\AppData\Local\Temp\886a3d9396150f22f3431dc908a1d4f8_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\886a3d9396150f22f3431dc908a1d4f8_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1952
        • C:\Users\Admin\AppData\Local\Temp\886a3d9396150f22f3431dc908a1d4f8_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\886a3d9396150f22f3431dc908a1d4f8_JaffaCakes118.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3624
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:2872
          • C:\Users\Admin\AppData\Local\Temp\886a3d9396150f22f3431dc908a1d4f8_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\886a3d9396150f22f3431dc908a1d4f8_JaffaCakes118.exe"
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:5372
            • C:\Windows\SysWOW64\install\photo.exe
              "C:\Windows\system32\install\photo.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:7012
              • C:\Windows\SysWOW64\install\photo.exe
                C:\Windows\SysWOW64\install\photo.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:7060
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 7060 -s 564
                  7⤵
                  • Program crash
                  PID:5772
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7060 -ip 7060
      1⤵
        PID:5184

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 bf8097f4c20b9ab3a2052bb87b7e5aaefcdb93aef6ce121ef46c4cf3d7a83f87
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 588KB
            • SHA256 d05284e71aaf18431906756220da33587c7ec64dd3add603cbf82c77e6bda9ec
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2032443dab22eeb4d03059e2c98914fa72835638679ad69d321af353b94a8d64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a242c6c51e0e6799fecb471d916a46e699814fa498c3d3b0454469ec43af6f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a29c917c15f4303fc7d26bd0f63231199eb4df3f586c35ce52309f4a52692ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2be4420cc572726dbf77eea08f5a1be5368cbcd4dc2e616aec3977acdfb82911
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b258be017519fff4e82ba0fb29956c05bee2c4286ada00bb82d52bb3492869e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f000e7aad0b41ed9d9039cf31cad2986500fe1e38e40d1e240879df6d2f3f094
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87a5a4e5b399f6d04b7a5e390c280b7c28933098a05264b6817a88710d37b0fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3347762c3422c8405ecb2516859d4168955316282da997f82338f4478394b70f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afada6e8b27b75498024c81ec3ab31d503f6bae46201fad911a3c3309e2193e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4781acf5a4ab8ec90e0b8282629b1d2b3d69bf03d4af6045fdd46aaaa24dcb15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 291eac274a685577f0b10a036959d972f6ad8a53f6ebdcdb9e2516f7584406cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0dbcdf470174e77265cfc71fb61a771050759401faf0ccc3bf1affc84be04fd6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 793ddafbd9e84eca687f06b7e233df3f6b169ff1b89c11401e916a480cddcab6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3516fbebcb130000e0e57bcd276766ce3b1d756ba2d81752595fa775496dc7b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 558fde457dc1b5f129e055bdada7aaaacb175b6991d5c13826e400a25c87a05b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0de754967a6717bc18ad9d0b34d1cc68940b15a5b6cb68d724acdf9209526616
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6fdbd91d30d894f1c9735bae06d1c59edeafdf1374314ed2b589b4359311cb2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cec75935e4cc88fca7d6be6d8b66ec313450707eaa3be96506dee10b05823f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5dc4bcd34d11d7bd79cade620f1e26b21a7259ce569b70bcb9658f266391293a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2b781dcd59333cf6c3b5c40db9b90dd303cc15eeaa05cc1fea22295021c96b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04e7134523cb093bcdcce7d623b996b1d0403e0ef7e0e850220b70705d9099f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebbd8eb1998d744ae92b802244e00663a707a3f9272f609c853b1ed7fa0dcbee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 841e35e791fa31a68e9bc0b3f5d19286f6667961809167dce2ed2745911b6525
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2af8b5a23ada80f43a5925cc68ae1a0adaca9633c6394ff8bb8288d19aa5c7af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f54f16e78656d28e6b31b830f83c3b7cde7497e6855584a3c1836b31d5104c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bdcb359e09fbcfef9838458cce25c3a5a80a280d6ec1112671571e82341fc83b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9598331102bb474c6975a32d6c540b6b8f68ee6efc8087b7516409507f5a584
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a474d5be1be28829e7cc2f844ec2f8f5f788a9d41c7995b763e648c204f83a0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74efe3edd03654dc1107352cac00a22ea5605605ca413d65c266e7da6b80e00c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a08791dcfc90768621506ded2832d0a1f999af294e0d23e0d17dbdb3d7a18f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a618f61e69ebd4f07fb23aa895697806a64b539c1d514e9b72330c056f044e24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ecfce26a3a6c7474cc40000ec7e6a2ac696313b5318b031b82bead712cbf308
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4b980cfdfadf8b2127c0aa97c7b742ecab75ec5e95f922b26b5ec02def8941c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 196e67dcab7bef73a8d4ce398bc4c1c8e208882f339780ca343d2084432248d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99bd0ac4c4218c2f2dabc122e24e27a7d83ae05ac304ec98d01bb9d9d2b88ae2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 188b68cab248c2262c5bbc9febd50a6b99885b8cf12d4e009b76e953f374108d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a9eef4e25141e6b93fd743b326588dbbc681798bfffe2135c7f34d16d2a9cfb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc65db73d4c616689d8a466f83e0186e1f52588ecd2df9b6581e2dc9794194da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f3d798853f68922b7942d94d81d372a8551ea18cb6d526a389eeefd32945e6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad3b6175358a6ed19766574b14b084e4f267648bdc642bbb956cf8ac2bf7cf86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88c5a41917310d323e946122e307f609e4f949e6c3fa5f78d7ef09bd27d294bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 381a333984e8244a307b23c1e047a4db43254eabf385b71a831017eb788f96f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0824924b55e4993852548bb23f4c9c64e732990f02a8b72b54fa276c01b63dde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9039376e77e01db23e64b2824acd9515a84466c05e48684ddce485bdea67460b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc0160c18162132c59129b50ccef815ed5761114daa922caf7e19de550ef192e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cf098f0555e2552f7c4ca75441a589f71141910023e908cc1c1654ef6f2a1e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c36794dc86c05c8c8ce79ad4be9289b9114bae86991996a98623e4d1a8343c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05cf705b585e78de543b466d893e3e87ca7efe2850a1c7493536a7bbc68b78a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69013defa2c001ecf599b1904c7d2718c57356fe5198095630ea96f3c18549f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4468f04c810bf74f347ec56bae89435dd95bd0a6345701871d32dab3bdff91ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 833138ba329844de4b2656c22e01cae529ecc31d0ed8f576274cf1e5fcceeebb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 faaf9ab70a61f10a0f8091d9f9df5b7c94c048cd2e7eab1702c1a7e237b91cce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8827d427785e08a39bf604d34fc18d01972506d0315646fc2cfe428e1e6f31f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6fb3a7884d993cbd2dd986f76d506611b1bd3907a89d50b2bdeed1cc092e528
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0cff0005490a99ddeef5d4dac64de85b20d7ce50e30c99269ccaaf8025916d53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 217840f9a7cc4fdd814929e79327fb5213f178c66414d702148643486ecc9c5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ab01f33fd32eba7e112467f313af562f9ac6f26fab0b0fe45b035e5d3986152
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67258ccfc40b527d6d8e8252d2b9493107000a3231413dbbf07baa95750576da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c903c70922165c8355d20d9ce8e58ee6fbb82e3280a52a70db62392c3fd0aaf0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1a7dfca9e73d9890347bc1abafb4f6f7ad3046708a21fd07153803149eac21b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aee9bbea6e59f3e3db0256ac813c295196fe44890cec06418d4933b92e3b631c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93092e26a9f8f4ac7dbca7d77dcffe93185593308592a1ab558546148f573e21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7c4e51ce253e648a6571a050ca325f4946e9a3dc4e4b65bbfdd8abb5fbc081e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ab6055dda7207e228304ec1c0a6a1c814768ec4ce8a3e7169e82bbbfc17e476
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96e855a7a387e9446a8773849a61426ace85b61a67e18d0968e10e7ee1f61ba4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f119b96ff5a4bcb24738db1fedce65dc6c4cf3c74a5bd21a4f9810be83342ca9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 140f3f4fb3a1da2db273cd17c42b474fa89722e94d8ca97df9bcdc20d0046b02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a5152693d1972dad4ab5e56ee3ec2457735d3a979b975b17effe9d0f2212058
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0c64acc377aa79d3a52ad01897d8a2fbe5f82405a5d764617d82c39f60523fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fc3f7407cf20b3713043d4219674794b6734d28a7b49784984dd3991cd7808d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bd553fd81c7ec1e005e37fbdb858bc6abaf501b5404f019b93b7539643f1063
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a50d4455027895c9dbb9e915cf8338dc19a82f9476664f68034c0f97bcecc929
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6eae2266ec33f612bb70631263fe9bf9ca4d6ddef2e73c9eae31f0e2e0270bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4be578a41ef9e8a10b987a749a7379f644e81f615f990d0ded671e2ca59ca548
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c317d007ad2bfa9ac3accb57366323ff8b423fed85409c7af88419e9ff2ef7cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54b49f0ad341092f0b074a6ff9f63e124318e2f81ab642be99448ad9bbccc47c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7063d91e5b8f6fc5729a79b52e7e13a5fab4234d57191e91d6cc126158a12915
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 698d9c2a0a32ef25f255918492305a704380a4e90a2cbed481585932c27326bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc9e114e412cd68b21d6b2877c88fb167e6f1be02b6d5b4b401afeae770fc1c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1fa446454cbe10e485c15f8faf4d841ef1f49b7fc3d605da6a2c5306d6658f8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ab041da9741eddd61470aadcf85f78cae6594088c2b2eb6c77635e38e0bc4ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d95ee45caa256d490c02c384e5c473556c258049a70bc5832559a11dd5f28a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41e23ca0f02fdab61dcdfacd0f4b406b81af9116d90cbe7e7932a49c0667aad6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 beccec100e3301cea5c87ceaa5784b9b1a85a13c98a13d55bd43e364104f70c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c33965d189c02a7d9cab49648517226d3f1bacce10514e3bfebcdcb7145dd61e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9e2b0cdd90e0eff957797398c32be3ceca701ef20fa1065f74ece7456ae89b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6858d70f7f060cf2e0ebf97a07f5f6f572e202ea759ad9d1abb1de00f83300bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42a78e43124fcea1803c968f16a16ff640904f3c5eeb0a05a9a63920cdf27583
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d08f6260c734c04a1bd47f12895b5a9d9033f76d118845f73e1a106bf93f6022
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95aa76fd8b673c1aa16fd70323f2812e1c5a9f65e5e21a08d12078d08d1a316b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33370310dc1322619f1b5721b1928669d654b85238fb13fd2907b1fa9366a1d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af6b820d8e2dfbbbd4d400fe91075ca25f05cc554f759baa8f7b44f678dc0065
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 debd9bfeda4938da6547a334333b35282b692ba328a0606ec4121574ea7a049d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 401314f012b91fc0811648c0776e5b6b66d7e71715b90fcc70f99e4ed63959e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d69b07e8af5130e2f0ab8d246485349c1f905a080645c842d091e9890960e8c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc4908d6a6a311b48b402a8ce8a3fc1bad57e24034a099cdafa6cc46ef6f8eb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd8893b7802d070f4baa8ea27a37d9a716f4072c84d064cf234e0649d08b90ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8b103f13b24cb3cce8ca667aaa3467ef842e345c58c9eb961cdf18688756e5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fb1a442082434d338b854f48ef66b1bc54b69a1f746f8da2bbe53a1b3dbdc02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff8849b8e18b12a3ada5e335fe9ad890bab53d809403ad802d66252c537a31bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f607ab386abf47d09620598494d49db3fe4c6aa3f2b886da3b8b0477fc8cf65e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2018ac003b35b32888d7e1b96eb59178294339f8e0d640ac89d82fc9af8e8292
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13660224af6c048213f527da31371287bced721809cea8691fae4bb006adbe3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19df3e8878b468e3bfdff1b045c50e919e42dde3c83038e6713085ee07c272c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebd0ee1e08b27912974047bf61d12aa0fc8a3358d105820e4337bc6eb2b659a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c73a6e82da6842d3525eb2d335874a51faa1b7181623efb88646c51a2c01feb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc92e5da0159b34bb2fd0dcf5c2554e6be04742b5a6145b885aa6b9ffbb89498
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3665c424edc5db95645815afec457faf0c21b7ecb206c6556fee201d322199d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e920aaeae7079d5ad5fcf74e0fc433ee747fe3ba9cb90bf5232d10594885f49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f06a5053f94ff743f392c4d801fc0c66186c645f5a3a1f125963a76a0e28d27b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3291491da21a9b69529e2d93691ac171af3270684ff3154e99a0a05f4ec7c38e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 538581dba622c47a1ec97a5320191142e9365c74f6af8fa0c4d695b25bece1a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40399c676e8d663d0c7058257cda5698813edbfd889a6ae27b347e797852ef78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0978e40743df1b17ebc6952a8af95d203a707e4ec1c99ded4803531c2ca4b74d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ae2155104fd044378fac14b115714efb25134fe41de634374bd8f2722e35d51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db464cb039a35e00fac84a2a10635126718220cf59eb8a918155edafda48be95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69edb431bc626fc568bdb42a9df69aacd6c1e8d7ade1fb9ca9fd0a8d12ad85cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e46aad50f9a0f3844cf3bdcf90f51ac5bc58a1cfa84b5b0ce8dac70da12498c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e65bc9a6ab5eba74fd7cb543ca35c8c59ced61c983b4631c48daab5242550de8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f20b28c32bb3be9ff52b1335bbd5c18f529435c4dbec2aee7eda81062fb6f6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fe24d71d8128edb89dd267adb0c63eea872380f7fbcad1beabcdfc6961658f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e01025da822218816e93f06574e02d403b62722557064cef2d418db1ac799ce8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40760ec6e931a0e0f9bf896f26de8bf959c1235763c4fe23bf865cda23bcdf45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81f3bb0923c68f29a5bbac17938128dbe15a39d8e0d4b957a42615fb46788e50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0c86c8694c695cfe75cc4528aee524738c78fcf134fe19bbc0af942bb942a1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f204ec2b6b16da057793245e797ad03573a837108e85e943bb6d92dc2fd96e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2de25081394b07adaebdc20326170135447a371e90aacf9c8787305f5b7d46c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60ce63bc7bf672864c992aeb93497529fa988a84b245c11dfa9121730660bc56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0fd14da979442cc7ac12384eb6140ac37c212cedb120b9d95e062b7ab94bee4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 889434f0267334ce6bc98e920a5257218f66c1c18b2b3f318298ca88dc280e76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4039a3b8614e718cd1b65a1177f1fbe13181adcd7c69530456d282c9b378c5fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e56f5f1ccad2c6fab3cf17562be8576ea3abb24e99d5693b9ca9deeea3861f15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 433d7cff6bb653e13f825378e6f5da3f09d6ffb754147d6e84f3e419c8468a8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a40b59db924555ac99f01eecde032341327de91c0f7e8c5115da81f127da192f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b80c4484cf326960d5ce519c7a317d875a8e0111cc72708f38c18e1ca0ed831c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e200b7987e926790a652d158dfa80cdf74eadab1981371753937e045e707c75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c57e794be82a3ff07b744c131d647d3cbb446cf02beafb009bc755dc348b0c0
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            photo.exe

            • Path C:\Windows\SysWOW64\install\photo.exe
            • Size 508KB
            • SHA256 e92ee304f71e15ee4bcde461d155cd23a0c60a07d88089bbd022684734da3bd5
            • MD5 SHA1 SHA512 SSDEEP

            memory/2872-62-0x0000000000070000-0x00000000004A3000-memory.dmp

            memory/2872-17-0x00000000008E0000-0x00000000008E1000-memory.dmp

            memory/2872-18-0x00000000009A0000-0x00000000009A1000-memory.dmp

            memory/3624-4-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/3624-10-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/3624-9-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/3624-6-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/3624-5-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/3624-2-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/3624-1359-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/5372-1360-0x00000000104D0000-0x000000001052C000-memory.dmp

            memory/5372-2518-0x00000000104D0000-0x000000001052C000-memory.dmp

            memory/7060-1392-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/7060-1388-0x0000000000400000-0x00000000004AD000-memory.dmp