Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/08/2024, 10:18

General

  • Target
    89fe53a9f37ca850ea2b26d1d398c870_JaffaCakes118.exe
  • Size 904KB
  • Sample240811-mcd3gavglr
  • SHA256 8d705fcdb166da639fc2e0c93096b8fdb86ec7aa51e70d15567ac30c328f8a0c
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • tommaso.no-ip.biz:3000

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    windows live

  • install_file

    microsoft.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    123456

  • regkey_hkcu

    svchost

  • regkey_hklm

    acrobat

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3396
      • C:\Users\Admin\AppData\Local\Temp\89fe53a9f37ca850ea2b26d1d398c870_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\89fe53a9f37ca850ea2b26d1d398c870_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4860
        • C:\Users\Admin\AppData\Local\Temp\89fe53a9f37ca850ea2b26d1d398c870_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\89fe53a9f37ca850ea2b26d1d398c870_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2272
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:3704
          • C:\Users\Admin\AppData\Local\Temp\89fe53a9f37ca850ea2b26d1d398c870_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\89fe53a9f37ca850ea2b26d1d398c870_JaffaCakes118.exe"
            4⤵
            • Checks computer location settings
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:2324
            • C:\Windows\SysWOW64\windows live\microsoft.exe
              "C:\Windows\system32\windows live\microsoft.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:4756
              • C:\Windows\SysWOW64\windows live\microsoft.exe
                "C:\Windows\SysWOW64\windows live\microsoft.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3476
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 572
                  7⤵
                  • Program crash
                  PID:3972
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3476 -ip 3476
      1⤵
        PID:4104

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 8e18852957fcba8343d3810b20ae2b8d3a82ee965a575e847b3a07c9e2dd3266
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 6d53a8c014d4c40184db71d1ca1f5ee39f3aa219ad837d14432210f5e0169dd7
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3823d012abf116fa30010be72b3256255c75c8156355fc19301d380938acffa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0f514edab945c96042f711f449c03e1edb6b813a9fea9d8336c981f47f3dd0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 631e0bf4f7dafa0c318920ce1dd3681f89c0ff098d36aee55e44251c40de4120
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55211290018182e8b34b465c820e015870df26d7b487e2e4cfd6c161ef3d6770
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1baadeb06887b02efed29b5d9f3c902478b3641f8f2795d8e3e66ae98bb2928b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9dee12076a4f1fd6ae3fd9421e5917b2596ad94c3b7042827a8d9042363c1082
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 593be336e174b27dca7b2ef9575ee3d638597cc616d2e16a30877ecce73efe99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 936a4ff5d748a6b465f13eb98da47252cb198cf06c0853f861538d4591c192c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24846b060f6107701b0ccde31a69722d1e2e0c2df694275fd2b64eefaa66307f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33ef987a8c2ba64562bedd8c13c9afd928fff18c1ab2048096d56c8bd4b72a76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53b7da3af589ba4c5cafa9870ea2f6feed8dac9d2f56e274ecd296a6a7996226
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aabafb4d733d73d5a0fb106ff7306dcd419ea9eb674ad62b23ca665950b658ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88a6fab85e64936652aa30e0bb1c019cc22f3baf9e62b68233e98aa4147cf5fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6282ff221345929aba526ef03e87e6f929c8d59b901bdfd06fc132de7174fdeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11b03bb6005fb5a68dd704789862435524b957a52e7fb55285e89e81c81fe129
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 661110f88de8e8a73207b99d9086b962df732f8ae3c40d06ce748534bdc0247b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b529380f56a8a650bc2990149415c89dd7e8324797bbeae9019db420868e6e7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d686ebc1691f6e69ef4b01b7f58f4c5d77c2e720547cdcc4d13130eadd65d3ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 147cfa7f77aa7bda77ee9dc1800580da1811c32ea17af6e0a6a066f88660ed28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09c8cac8e745c4f8b338c2709f22360e2ba0bc8bcb47cb8cd40b595fac047fbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae9753c17e5d7e65e5fff2114aec80ea5ee8296e93914398fe2cad596b8e67f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0febbb95e7eb70472e55850f25c68b4062a23e93d296bd1dfe380c389a452a22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85a3ee0674fb6707e79f3a09d06f80b8681bbc4ac0a62f296023cb947af05540
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15edd5cca92500cee519766a8b65e541c637ac8726441b978e452e90d4e82ec5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f292660d963d2d3f4ddb6001d86a8ce853a87e0bcc111b95695046f7be1437b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 409429a28f89210a712bcee5a9e194078b04ed9793513c6467dba772cf22f5b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00fe6553df7339e1258bf9e8c0af53251284985e4711df3f93ae0e86762631fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68f0a69ffac84de4b9dd4d1ca39e942569340d7acdefdfab4d7e2d54d24c59a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e19215fc3e3c6fd08eabb59206ee6c6ef41f2c46f4fcafb06664ca126560244
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fd151b8464e9b23b66742cf8aa0999966e1384e6fdea3e9a5ff1ae6c8d719b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3eeecb788f1b5454de3e8d35a623823c9fcc34c199f404ed602d489da95a3806
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e45a4ac87d7388e0a65078ab8e7e47a036ef5346f507e9277b8c9b872aea3c30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5121aa59fbcccc3785f9a68f89bc07aaec19e8e1ecf1afd71c5bdd811ef9d815
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c336c35326064b53c01fbd1540a50f7e6691db44f6aaf22be7b80f578d62bfcc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8786d49db31e6cfc26d3975ce1056290f2f0011ed4c1c196e3fa35e7d9ff098b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fbe1502e0a9f6d883488131a807bc722dd2d1b992e93e2d7358b21bc0dd5e56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71f750fb5b6014bdf33559bb4959baa35c416d28ff11326e7c1f3f31454c610e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0909125ff6a1743c510a0422fcc7b47ef94fb2e125f79c37278358d622ed784b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b40f42c4910fc309f815b99234646b801576c8c9a37fde0c7189a4cd1673789c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2be81388424eec3b13240916c7d67f12d1228dc089cb4eed577633c34494927
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea40921c2f40b0af2f64479109335f00f1e77bfa0fa25c2107e773e55d329ed0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e3d2840d0196ba9d28c906c4d1b5e2b95dc7e2f07342378133c01b95d843b90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83f6e08aa221493ae0b8eca57c1bff0a76bfe17bf64e3a9f7b9229dbfb7497ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f01abb44fee8b25e5f4408f2d02ad058b27fe3d4f61b17964312515c1d4c17d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c85633536e0d6d68bff0923de5df6ef9b3d422203be9a5c3224dcf26b120a9c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf73eb07db0eb63a051bb9b518adc40f36045a60ca1a1417e56018079a66ba4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 790562ec15a9a817886c3ed5d5814f93547c5d35bf2ea0f67bdfe0eff68d8514
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2bae4b673642be252ca9cdd83e0bab3f60a8315e5558e507cc7722cd576d032
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 239c2eea0cc96949d70fb29747c34fb94f6e8d51d3088d324b30390e4c0674e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed94e695edae2359aa83d6c9dea55bb147d75204494bae03f3316edbfd719542
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e34d6025c654b1f4683c1ab407e2fa0419a20b58d575abc37ebe71ed3bad015
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4061ebe850ea935e31d03470ef715898f8e8259108bac5cc3954e8fcec46c8ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31dde9db90281e942f87bd476433af5b1b23f065a01319a95d9bc703d03ddde0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d85dc13d189c08beb623abfdad749316040f055ae02c7495054b0c460b8dca09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abcda426b0d9d09e6a9abb12bcbb3a41f028318514351cfe054b9415ab2c3dd8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e541c570e54a170d5114505cfd6b338eef57c89f522b34d8903745fd79e5afe1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aec28b81badb1f35187298d8eec949708f7f3b09e995a8ca1c22ad9ab768e835
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 300c8400c5f13ef1d6372152e16f2136d4be355d6aa35345610fb8fce2fbbb4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff1ac6114142fe95eed3f3190624be596882e8e83680c6b4fae0c7cf129712ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0c2ef797d9b28ee9bf155d059716a95fe36dce7fae24007f4148938e227c9dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1df720ea955d9470e5a297e7305f436e846d6c6977244e9c6f5043168991990
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0daa0518b9e067a4dc6e6a41a6e54ecf68d0bc556f5ab16861906b30d437ccd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19d6aa59fc3fb028e4cf55468ba2e2219e3f80e24e0f82529f380e8409373309
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 615ec4a033b71738d780600c3abe865bb733df5379bb41b6f34f08394846c958
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a2289a42046072637f1a74f74e15a099842b4e2c871a3076e603e76126e74cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e5c23f994da64a78dcea73756d839eefecc0cd2711ce3a07508f79aeb2d68f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7d6ec1f5f8a12190f20179f816a00b5e05fdd233cc96d65e0c0afed8060aa75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab07017bdc72e0d54ac5c3ec2f8d96093652f21675caadfaaadadede33b3d41f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 284941d21edb3bfb8512c092ccd5f849d5ee4c30a318b9f79ecd096d509ef103
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75aa1e1004099cb254c6a9381a76af29e6037aed903b1c955e9b9a92d148e6a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 022eed5323fd8793804c7c69f1e5b9c254d7ffd5547bba8087ef70a614154a6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c44ceb0920d1c11f258755c3e23576d5f02de83ea7a316b466afb72ffa24c20f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5286fda9020d37b5797888709d1599a929c7ccd7343d399bbae5bd763dee07e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62b6bd12a1892d77c4b36562ba86f53161c5306e0d38210b7520cd59028428db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79e2912eeb56a89b19567361c578232a83cf401a30c47ae9c832ced3d12b4424
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c280fc2aa4adab472c52e1742e3aa702c961ad7968705d5cf1f9af19b7e92083
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c9f22b7f0bbab02b06165ca684dc1fed840fef75dfa699e619b2e4de2e92b16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6334c5223a20558ff456afbf510932cd9b77cf14f1f0dff192d687a647fad61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b98f7b29488e9a8e8051770614beb8c7fbc76180f099b19136e4a5a1668ed219
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12565e2578f77f94b510186a129d6de4cfcbb222eb056b17107c495d575dcbbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 045decde5260db1672343f007320f15a4e64e1d59357f3e03429c468093567bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42a331e5ea85eecc355adc4d73cafef4101bbbe8f3f30aff5413ff6006ae14ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58dadcd6934c822df8558824bdc0cf45228bc42cd536d971841d578ac924f37b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c7d5a7b5f986d242a879a081b86e18aa0193d5bf8679fb8ae79276570076c1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 604aa9ed2045455fe02f67b4af649aed1b3369b762ef261e3044c2be67edc6e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd455fa40802ebbc42bc9c88e54f630aa581b00157789e11d986fdac5f48601b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 643be095011448352665aebf2063649e390a3cf9d3e3a72b7315a9a28ca42f88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecc4cd611bf9a033053d62b1eb4ab4f95f8886806218cbd4c76fa709a2c30b21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 844107b5a56d7c698b46dc0f8b12219ba8d26b8020b79009bb2e8793c4d19f0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4975c640f1545f3219e67e06a14a94a3557f18b0f0da5bbc717026603348868a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54c8776140259e916f33da478f0a7cf4458a15e6386e8ebc53e76c7b0b611ade
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4568ed64fd9b69e3cdc2c4542689dbdd72c0ed39369e044f609e301b3abecc90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2646234df8758dc4805e4481a753ca83f99a5d28fc301f819552a2756dfa062
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 317449e634a5a7f7cd757002ebc94ce3fff24142893e783896fd34b0b1f077d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b27048e305979ac85284a866fc56c12e1c9dc1020b14c7dfd2d85f9dd306070b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a97e171a93e2148551abd904c4ee06eed8497e74f4a2e6dfa7b4bbc9904cca8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0447889df139b5bb0fceeb84974b5b307f2dec32213e1ad6712fcf2ed01abcad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cecf89069f8bdd1f45b4faadd28c937fbee5cc01c21d8daae0ecc1e10828470c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8dcdceb158a78bdd6ac16c4b6f3691633a490b06d3f602ba8598caee3e28095b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 417989206389e2bce26181de264eeaf1b695691c0d23412366a506a632012a9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecc2bdeef63e960d70f67fcc3cb8ef6382b51265dee6b3889a4a49979c6f76e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1765a978ed852f4d9e23b4fb8fe957dd63db0c6c7277e4aa75f3d92769cd5eb5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c2dfa70df12334ca7db486c6232d41010719a81407e055e52c563878ead1fa1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e1b758ccbf0da04f5e99f3325f117176cbaeede1584bbeff77e23238d218e7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c5cfb646c132acf40fe2bda16d39007e7031a19ec4fd3d8df7be2d1bf2dfccf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da5def941fa5235ed79539f4a6ba77c72aa0e8c237e1c2addcd89907e5a35a6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fc94536da1177fa99ec332d20e4f7352c9a1bfb987207957bd6c5ed8b474589
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0c97d5c026b62c2a1339fa74d638caf6ccaf582716ba79d24e27b26dd11e117
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ffc058b53885967f1e20e9d3c173de350c9dbda6447c87b5e244ca8a726fdf4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb152762409565d8d540c42227f09425c53a746e3d2d09b34b15e4b1589276dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a0954e9c92570c8c6e4348cba11cd272ed312c36a78af8b2e529d791703dbd4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7be15f8b5210cd9b25ddcf89420ac6fc27557ef5c51406668592e967c992c1eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e128f45d9993153f76249d6fd57bf085bdb440c0e5724afdc2fcb06e2afc3258
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de46623b2ebb99c228cc79e3966b84a30be4df54a031971d9eed2d69ef60add9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb237bbe8a148535550ac3ae1808809eda88edb08c7ef27d486e04323156207f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6297b8a44b2b97305053c8dfab745a9a21dc618a38576540d72259fd06cb279
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d28c8b4a76e62814fe7b830b9543f3391b4c89cb2c640a09467ffa0f7b569e09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4df53a145854417fe9a4078ec214cd6860833d0ceb0b58884a076390947e3bb1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c863f0eda9729210aa3ea7e13920ec01a2d080dfd032b982a6a4b9fd99f3b872
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1da876aa8eb6d0612d1f5b6ceefde5888780cd180430bba691fe658b2a73492
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fe432742eb29fed55db1a47699d5886677888a1b3d7d89935d3bd495f4786cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 052daaec2bfbacdf206ad53e7a8d0b97b1348aac72883ecb025d0f117d538537
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e824c0147bc7a128d7f69a9ed2b89fb31270059af8007cd41fbc77d225162be6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 899a671fc0b109964d0a0b178c68f52b312d8fa87483134c0258f51ace166164
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 449d03255aee37efc614d8b4adb5bf8ef02ac440fe32c5e40d3293d2f37d653c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0eed070dfb3203aaebb10c8b9158f1ccabc5cd1ec9e78f2db543fd75adc03c4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c7c72f1c0c8219ffa232001bd07df165ceb8b7df79fc0a3586d927b4618427f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0287776a2ff9af7413f516100f29d6c968f90e41547e768fbc1abf4a2382b9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76af111ef46af1c8d5ac3d56bc3cbd3d8fdc870a332f5f7548fb5f18401f2b3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ba97a0391021354142c41ebf00ac088366264c99655b3873d4e8f9bb05e8b49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 969e9c0e42dc9a5ca8b29df3cace80539f75b152f8bc70085d6aa9271d6ddc6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3859a09a24ba46fb58d34a3cfb8ffe6b6f3f19571ea5faefac7a16dce0bbd23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4f6534a32f8ec0e0734aa07279e1e2fa3a70d3efa28bbdc261201d047ad3e54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 feb64de9c87bca5d409438a5d2d14b346aca4be1fec2e07e891ba1bd5afd88f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b798236f0c32a511333d4034d99f063d01565d7fcdcffdea8beb2e10c5ff912
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5420cfdd16b10882335175cda680e577b48acd4e7eb47ea02d2358877ba2674e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf8c98542520102518cb7048ab12b4cd069101b37a050ef7be6812887fd88b3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b97e17a2f7ff326af2bb36879f97ca6a1c4e0ba6654f2e01bdcb9e305b90454b
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            microsoft.exe

            • Path C:\Windows\SysWOW64\windows live\microsoft.exe
            • Size 904KB
            • SHA256 8d705fcdb166da639fc2e0c93096b8fdb86ec7aa51e70d15567ac30c328f8a0c
            • MD5 SHA1 SHA512 SSDEEP

            CAD86D91

            • Path \??\c:\users\admin\appdata\local\temp\CAD86D91
            • Size 14B
            • SHA256 cf61bfba11cfd63fe28ebbd7b40f2437c0aa9af2acbff8d14e0660d9bb4a35a7
            • MD5 SHA1 SHA512

            memory/2272-9-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2272-5-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2272-16-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2272-4-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2272-6-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2272-13-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2272-147-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2324-101-0x0000000000400000-0x00000000007A6000-memory.dmp

            memory/2324-145-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/2324-1318-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/3704-78-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3704-18-0x0000000000C40000-0x0000000000C41000-memory.dmp

            memory/3704-17-0x0000000000980000-0x0000000000981000-memory.dmp

            memory/3704-638-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4756-178-0x0000000000400000-0x00000000007A6000-memory.dmp

            memory/4860-8-0x0000000000400000-0x00000000007A6000-memory.dmp

            memory/4860-0-0x0000000000400000-0x00000000007A6000-memory.dmp