Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/08/2024, 13:59

General

  • Target
    8aa2b62f335f6a09e87162875863ae05_JaffaCakes118.exe
  • Size 344KB
  • Sample240811-raq2gasemk
  • SHA256 453558c2ce0dffd31d40fe5225553ffd944df040c1d21867696aae39ba975195
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • 127.0.0.1:23

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    windlll.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    kabila

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8aa2b62f335f6a09e87162875863ae05_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8aa2b62f335f6a09e87162875863ae05_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3632
    • C:\Users\Admin\AppData\Local\Temp\8aa2b62f335f6a09e87162875863ae05_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\8aa2b62f335f6a09e87162875863ae05_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:4476
        • C:\Users\Admin\AppData\Local\Temp\8aa2b62f335f6a09e87162875863ae05_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\8aa2b62f335f6a09e87162875863ae05_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:3508
          • C:\Windows\install\windlll.exe
            "C:\Windows\install\windlll.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:2500
            • C:\Windows\install\windlll.exe
              C:\Windows\install\windlll.exe
              5⤵
              • Executes dropped EXE
              PID:2936
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 540
                6⤵
                • Program crash
                PID:900
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2936 -ip 2936
      1⤵
        PID:2588

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 3f8e0a5024ea827044f20ab0621c6630eb39783e133ca337b320f9956666e84d
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 230KB
            • SHA256 fcdc55fca6058b46d0868cd5dfc729f0b6c0e730f488e23b14ada3736108caf9
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e470ecb4799a1f32119ef4069e0551888037c5cde7df6ab80e8d91f18cde875f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9799d13b727d070f44f4f8f88688ef9baf2b1d7378b239f241e3a689dfed2bf0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46a00df255402789ca40c4a6995b7c545643a31ddc670eab9c04d00117ab3e09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3628ab92a15c8787ca7e5b60dbc37d571d0ad758169c5db35febc0d9da8e96e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b64b51ff84f2a18e1f073e98fe64e8e88be609a13b4aa0ceb26d2e854c46cf4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84ba0b1ee43e65db9107c8e8b6608fe1a83479579be75b402f1c4a3d2b3634e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a301aa89286e5d3b01a0b13af46c788d9eca96e23b7ca5175ae94a3f6dadd17d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 465fda357ca427f0a7089b7bace1536b6a55379be00af378ce6efa2d9daa58c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 779f1bd31a25fc6191b3e0440187b0af1e186bc45e2d902f6faad88981d858ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a5526ca31aa0a23cc6f4fe438b29995c072592632dc0fd2ca6a6ebc57638cad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b7b81782f45eaeec84d959157e84703e2a3192632112a68097e26afad5fdda1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14bb432846ea947c2abdf49a7fbc58500549aa0b7a7ee8b6cebd575e854ed9a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 198f4516f23ed6af7a53eb8a4a7b92c844607207651d96c51b48e877b2f9b6ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b92838330bead77fdbe5691d5f1877eaff907b9f2cf5c54000bad7c9d2aec1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bfc97f027ddfb5e10a9c05a79a46d03a96f7bfb974a18b853a4a57cecc01d67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac4d4445cf054b0604b8d877aa67bea05320295a78f4b28cc7ffbc2e5d13bf08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99c155f904831c8c189b6f149a6ec90021234750ca799161f42403693415f186
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a607018e13eb6f205cb96b69efac560fa80f243f3dbf1bfe79718dfe8730697
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8b247884e4e41ce90ffc309d73aec7d8bb649b7180277bca357af3538820775
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b86f25fda6ce12e9d572afc489ca773c0994a94db10b0edc05cd466ff222c327
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 649cbdfd991393d89465424ae51cdaa793cf72955a92f285daccc47f94eb1763
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd9beaea05edb31007b1fa3abc8343d509fcda5fbb67ab1d33b6a7baa80ffe50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fde47dc03f2a3ad612d5746e9742410f50c2668db1a932e0a3140791bae5fac4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b3a85b7ed9b325121a84cbe6b432752f4c17c0b1c6c54dd66dc54bb15c8f831
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41dd7436e36389a23473c34382d8b6c676d243e1b3bb0c68072aaf497d8eeb11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 748a3aeea9484b04105fcca7cc849e112795d5bbb4f82e33e33616d454591de8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b28bbe4197cadb54494029631e43dcb709a100ab800d2af25a9726666c584f8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a524eea714e6099843b4dd1e14fd73a35e854f5eca16d0d9ee794e96c3e3b2cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a2cd6ebd01b2bfddb6e5191513ad14cb929e725bedd71ef187706d8996aa011
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb7bea9cfe6170f7677f063de1905ae5d0504ad741a900d607011bf49d189518
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5b490afa92af5c49a8527ab3b785d87d6b1c1fb78d1612a81ca5a1ddf5abcfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e54e6256f721534c9b188dc1e6c16754cb533390acc8b8bcd528b9476c1864a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9087d23b61c553e294a3285f6871857f8d474aca26aab03fee2666777a367627
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2eb213bc1106848e58d11aac6818b75e48d34ab89bb24353a8d1d719915c0175
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 efa654ad64c0bdf475a3ab93b681cecf26056b05492c6e3e74f4ed07925aafa9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81d50cd7cead4464aaf4312b5185dc1387d4eaac64bf344ddc72d2699036d50a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a789b37857251d5747b4964a2902b2b10d48b8aad270e36377f30642e0ffb7fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2463bca947b298ac93aa212c4ba47d40a5cc500c5f3986d1c7f42aa33f94cae0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b11a1f7e4cac4c87716487e9c96394148cc216744bef1408c12b0cecb0ebcf6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e38cbddc45cb16420205c318706d38e751b86ad059791fa4ad05d6eaea21660
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd8a02c0a020eb8391b47e20ba6b0545ce3f074fb3fef8ed3d74d0852cbec920
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3e5860a236400f79ed909f65d4abfa917491359dd1c104428ad22761b8834f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95d76203c3f6d2efe72a9d0cef1aee52225ed5e15eab3b294f89286d2e593aa0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 880e4b68dcf90b72f49465e3d98bc7adbf0924f45c40d9963951c12f12cb76c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c75fbcae35855918bb5cd01f90d18247b95dc80a4cc5207e86a44abce1402495
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92ae468f824e98c6c1787004676843e46aa35728c34554da930ba154b417a835
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a525870577308f70a805da9cbb1d679e174e5c3151bc35e478b5c2b196034a4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f343ff47ed671bd4ef0bb9de1e08acda7871b1b9ad0d7b4892a5765a7a58941e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e85293246ec689db538d7c9123105ef70d3c99144bc415d554d1b379943c0c8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31ee526bee7aeddbeaa6962819da36cbf42f2391d9d3bf7d2f0c769cc3f6c32f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10f8596cb94c5863026aaa78657963f0d87a6b0dd2ebaa4c7a5a4aa81c3db970
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9855a42a236a3af850bd2f9520f49636565792a5d598e3a32cc066e8e54d37ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c313eb53206ffb8a16d24f475e4ab9e67e385ceec40026e7c0dd8b89406c22d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da5e346c1b284ac24e224defcb0027954f6e38d8119c4f7f9c18a2d2d4d587bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21e9cf1e1e96d2a33804b8760bc410f7dac71829d080b16b80143d13f6ed9550
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 229e4df212a93fbbcb644b14670fe0f262cbe2dc422bf655e3385dc52131d9e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5a27ec2fff7b55c41ab464b4a60e98c4e9322a1b4be537d355484e92b34779d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13b7ff7f341bb85e487ba3702149fa9f59fe7ff13dec12cb31520247f54b1c42
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76dc0cecd8f70141a9df5022f3139607be64825d7792fe87476051b401fee679
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c6209bc82ae72359dab71060f99d14b2ca50c15b774581347577f2372c00daf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5c93ba9918b3d81e2a6fa072986dfc30f8e11ae93adc4f70578eac1552090de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c38c87f0211d228e66e111e31297a9d73921362abc96022b61afd55e4df47656
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4933f6a41c48f157964e1f4f6b1f5c52e62cbb5cd37f73eae910f54c5a528ae0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b440284d9aa7eba1970118881ccc009a057a1b522aaade9d5e410be8177b1e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 845a07caa5b7bea6613e32e350265557885ea0490133d8af2955a2df88b8e3e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3977fbc1fad826bc85b5d088e4460b0cec53888ec177cece731a8f86d6a5f8f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4af7aed4c30dd080d748f304ae869e42a65f7902f1083b0a059bed2f3ae9487
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b35cbdfb38c4ad5a8b8b648f0b7d68b815239dfdc15013e8ecc4bd9bc357c9ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de80f63555e83c7c30a2fe52277a853498e468b8f00319288f9986408e67ad79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe1817773658dcc9ac87e2b3269fc1f2df43faeb803df70a0b6a9e9b89bb79b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e29067bed3c7240ae8c5514c43931e50981de61e67853c637d07d9305734b3a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6d723ff10621f9895002df197c68249678238e5a8dabe2e895444b02c384dba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29b6b8c75735c6ddba863da7ff0a43c6584e5fb52f09f6f5b70500fb31c427c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4aae1899d8a2cb092eb18de46590389437f25c8ad835ef80dced71e93941d9a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0944e36fd289624557518273fa2103d639b497876ead70949c0759325c1d4aef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 782569435bbef9b8367af7d1ab2102b057185640a909c587f2b818fc8e7520fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76a76f7ad3ad76e82f0a1d6727d0e57b69d8d32c53c77d050d8cfb205fa80ffc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c55ad92223948f1ff701b042bb508b768341c19a859c56ab43a2d11eda0f8fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ae6602e217a70096b4d075fdb469bda97409000574940a4d47fe97809c7da9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bab9532816ac7fee50dd74a3fc41931a02f17ef72532f35a50a965c259701c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cdcbe3b2d1d62b638b2c9aabe10f1020a729183900b967e4d3e532677f80410c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3664a84e2e0af488e5937307bade5c16d5568252091e37f041d93b63df8a97eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e90346172e26d7a5887066e140e4e47fc59cd32feb89f0dfba66f96d80b2675e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae44a23b2849b762ffffe2ffa5887df21697b2ec2b8ff8c3e9d59664c24800bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc20e3aa88cc608045917fbeab618cb6e66c7939e84b5331b979f30eeaf88d88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 833924a85c1a082143ceca8d82ee793bf25aa3535232b37d2ab7e2f04f3b0370
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfa48e5ff29967be580d96f07e9723656ca84f0a8dabf852dd5c8020cb9252d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9561b346cff852e14dc20de738ebb26fcc9375dd16f933f4267342cb52792fff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebcc83471106a5dcb1b8eb366b2c82f63af834881eb080099f04eb6b119ba5a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c03a0c10b03f2e9e59f9e0ff277134b190779eb4606df5cd667933ed2a068d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a67eede537e142597a900d4c791cb90c986ba137f6e9ac079eac42ffccffdf39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97ed1b89512b05144e7d4ce546dfd64cef8a14bfdd8f000b522eeff16986fa54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d6f3dedea60fe6c64a24aff904808c98aa468f66edf69fd0d1d24e88d8db82c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac7ebfc3bd673339c1adf65a72575a3689db15e44b950ac9e16b83ded7d673ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 122bcbac7bbe5f725a2430719ce90068aa47282cd6d725d4c7b4d65dc09f97bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 452f66149edfaf331dfc80996590fbd605ca30913b40bab7f9035a8b2616618b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1369605d0b40704f80986833ce3972cd6013e40779a617692d2d81936c32cb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01bf26a5c2a3a082a30490201989aa8371ae130208e3affd2dd6aafb738deb1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ceb417a06871d213023f040521c33eba3e639f3ef074f8a821a6b2fd700ed05c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b6f501f8c04e7de9be6eb757e00725c6a252ba8a16f196d1c6b38ec1379e286
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fd913e4cd7b79ebed728ab595ba0e4f4de28490e6fd9f855f96ef701943cb32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6019a522946d8fa52840d6e020e1d304de698e2a23ed1511cedcdbe756f9b56c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3b6e4f420cfbf75217a1ee00b90e1d3cb7fe38c6574fd83500dcbc5a7c14980
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0208d8f0fa20424207b32808e228a4e3ebb19f641298bba65a46852413b7f397
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e2e6b547fa2a62a3353798525382cdf80fb1cd88cae5d1357209e56ddd7847d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 032df6205b2598444749b23c914b6ca1bf207ce0e35f3e8cd4a528d261825b64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff704258bd4fa3a9f2f13dc0da793685e1e1bc1e2493d4c259088bd73365de1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6a08d11a2ecb8c13044db2996064f6474eef6c4441a46126d7079cc2ee6e66d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91d3e2413fa3f1ecdc2d565bde58108b3f2a8a7bd05bbd3dd7a478e1e6a47ae2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 619da0ca44dffbb7e552bb9d79d53d0358f2319d28377a8c86b5c73d6db65536
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cd2a8bb45ba2ad20cc8f58e4ed080fd83fcdfac9d8df53849a88bcfbf0af9df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a7921dc82b0ff59141d8adeeda8fcf2475b774133140063c795150e6ec89566
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b0698d41b84237356d87b7290a710550af8076dcdb91e3c4b7372a7d34d552c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 581f1b4a55efbeea1a88c87e74e23737e8b7ac5b0da3c1ea196dbebcf4740866
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6007e83a0ca273173275952e5dd92017260573de2839a4104cf22bbcf6717618
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc908efacd4aedbeb5042d48f831e73d51b0cd54b2702caf90240ff364249db9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f1369e12413f0741f5886303636a02b21243bcd6b49e12c0b546f772c9d4228
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b76226ee8c224d2111287fae6220e3e809885ba6933476f906a885eb2e2a236
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4215780d096a759c92a18bb07b714fbf911448b92f8a862a545d36db469780b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5a10f5357f071ca1e6996da049c283de21de1d0f7902b79a09c37860ed36dcf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd9d8c68653a9f871ac1e2a94c8a575ec799ac23a6bea67453e2463805080d54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 500eb020acc0efd122545aeb97276a87cccee1f897ea8b2e62b86ef5be8c7721
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cf98427f4f9760f5f339208f82e75825844dfbcd0299b9b884f3e3712a266cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a2fde484461dcaa60f00072fa50cbec47e1892aa54fe0a337bba192b33f313b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d668ab84b6c3c00658febd5081a7a45d8ea48ba04bb99f4810f4883bccc96420
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66b579a38d59292006729cfe88b34ac9dac4aad07c5f4d98042cfab5ba840850
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05d2dcfaff55a2e526f62d7f51229d0106407e6a6265577b85ee976a76d7ab41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23be69e138dca9ea565f736b303a0642e457ff5d58a3438bfe75f94c09a9fcb0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f14a89d3445f0739b2b1fb8eea6b8cfe7e416a85b9a018538dfd980035573c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b114cdc4196dccba08f6b50f33c3ba8b6d2feee0d702c9e84d2461a3a3bdb20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7a9d3e4f9938ed3aa0e953de511ae405f10b1b2af254124ceee9779934933a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9033454c08cc587850ae282af0e87d665764f7a8d8b982a50f6bba7de2193ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8482e964ee653bbae8a4df224202df2e4b8d1f2db5b0a2ebc1e152e08cf00a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e81d86a3856718fe47c44a1dac23c2816fb1aca4c67704720fe2f66a29f5b40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc25a1eb558b011b34c7c02cd074c53b138bd39738aba11f05628bd8efa7da6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3eb167941505e94007131506481d5c11103ff0e768f9d8a4a6d78853b7f91fe3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a55835d03b711cd3d15478d979183b2fa30b4e7ded129a5d71e8c133b955c22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 097e767e938d4e97557d344472747a656071136b4e1ed43f2575b0f166ab3327
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3082d8780cf58be189e8c26ee4bc5af842ea88f1a0061472fa67a0f172ce74d7
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            windlll.exe

            • Path C:\Windows\install\windlll.exe
            • Size 344KB
            • SHA256 453558c2ce0dffd31d40fe5225553ffd944df040c1d21867696aae39ba975195
            • MD5 SHA1 SHA512 SSDEEP

            memory/456-2-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/456-20-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/456-1-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/456-6-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/456-7-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/456-13-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/456-10-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/456-16-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/456-8-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/456-4-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2500-122-0x0000000000400000-0x000000000046E000-memory.dmp

            memory/2500-108-0x0000000000400000-0x000000000046E000-memory.dmp

            memory/3508-22-0x00000000005D0000-0x00000000005D1000-memory.dmp

            memory/3508-21-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/3508-84-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3508-125-0x0000000000400000-0x000000000046E000-memory.dmp

            memory/3508-1226-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3632-0-0x0000000000400000-0x000000000046E000-memory.dmp

            memory/3632-12-0x0000000000400000-0x000000000046E000-memory.dmp