Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/08/2024, 16:29

General

  • Target
    9f1efd2ba5d7778530a8cecb566e6311_JaffaCakes118.exe
  • Size 573KB
  • Sample240816-tzremsybpp
  • SHA256 535bd3c85b7fc16d1b332978a04427e78a5865f77e499a123d493dfc511d4a21
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • bikini.no-ip.info:777

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_dir

    install

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3552
      • C:\Users\Admin\AppData\Local\Temp\9f1efd2ba5d7778530a8cecb566e6311_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\9f1efd2ba5d7778530a8cecb566e6311_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4040
        • C:\Users\Admin\AppData\Local\Temp\9f1efd2ba5d7778530a8cecb566e6311_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\9f1efd2ba5d7778530a8cecb566e6311_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1156
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:3640
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:1780
            • C:\Users\Admin\AppData\Local\Temp\9f1efd2ba5d7778530a8cecb566e6311_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\9f1efd2ba5d7778530a8cecb566e6311_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:1312
              • C:\Windows\SysWOW64\install\svchost.exe
                "C:\Windows\system32\install\svchost.exe"
                5⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3256
                • C:\Windows\SysWOW64\install\svchost.exe
                  C:\Windows\SysWOW64\install\svchost.exe
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1216
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 568
                    7⤵
                    • Program crash
                    PID:3712
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1216 -ip 1216
        1⤵
          PID:1424

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 4412f111b0f868400a348e2a2042a55fec4c905e16de7f2c43b79c883bb6038f
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 204acf1a717d193124c40dd74f222c18b6f85c696150e0b90391560ddff843dd
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aadae78431d2ca12050e8f8ae499f846fef361dfe8a21e2f9237129f42d8c5da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6ae4ef5e8359138bbeceedc9dace9c22c3228416eb6f3085edf4726a7e04158
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7fbc745731c65442c777571558ab9bbe727c718d855957db0d98818c162a16f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f919cebec7d72913b49ff223c2cb8e08521e4ea8ca034866f635ed88210b6cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8ece315a8c77c6bbd797f7c303a32ba8d01f806aa1450e1b4c2eae2d19439bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c40dc127adca11f8bf652e9af6e128be11261d4389f6e5c7e08f464fb2c842ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9e5b5f7610b39ef0b7048f359ee4047287c6485ed321f74e0bd968ff15dc646
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3fc6f5ec25f01c12af0a2c9c46d7f1dc37a9ae12c5301faed9fb5b3d0d740e0a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ea4a70ec4ac3950f05b4a98ce87684b932e6b4e514ca9840712ed6f938e700e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e041767aac8f92d38e6103a38ff66ffe3500bd225ed678674cc578e55debda43
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d0acbef60c6a066046aff3f24c73d8548859cdb3bf678d258eb7cbfb6cf3aa9d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ac9c0f0abd61ed28c8f0e8247ffa77bbcedef156ca41fc0a4cb364e8c60643c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38c7e5197e2ad996a166d465db983b65110c10f379a10c2cc74c78d0a8285f3c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28d22090cbff1690f6a7a8562c77cf145169c78b39c3f1d2f5caaff4dcbd8992
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a437fbed1e0ba04c07abeac592ff78f5a9bf83b73d90ae823539e6167d46c12b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 19a6d90dfac19a0e5a771f2c2fe3cce9cc8fedfd8a6ebbc3d8e3302b1d556103
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3bce629b658a52a82367d1b276b79e3282d43c4b15b64bf550fcfb653d8a3470
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be20ef279bb935da81ba018483f33a57b70d460827ce281686c409de89f47f79
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24af8f9fed5857f807a7da7a4b322b823266c6cfd4f4cfa7a1d22457f68bac8e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 19abd7f91d5f539b7a4f92c2f6c71b44c4f4ce7677173aa5cf0b04b459c5c9a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ff84e0b5b5d24676cb9e6898017938190cec39167a1611dad60916a58aeb605
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8bb76628c721e3f857bd2a0e5f886e0eb328e6008e928bc599387eb019ddff4e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f38cdb256f2ccc8840b1d5dc8a24e44ef11549030a8fb95ddbad48dc9be26296
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38008128c45f9ec5ebe7abc0cc44c46168ffbcc27831c4dde3bccc9038fa2335
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 554f41236c2008f7715b74ac469db056c38d15af4857f8427c8ab7346aba4206
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d203f8eecc0b3ba0179d930697ff65ae6d8a1165d89223c9cafae6d1c59a395
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 37f27a032fcd1fe44f158065963279eeb40a3be191741ce0e9cdab4541f0a691
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17c4004b9591417eaf09bb3250225e545bb87c1df941256d73aef27d3855c46d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b17b6eb61dd7db78ac272a62eb390b56c85cbda7c151d2dda07dd6be9caf378
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8af4120849f6ff52fadd489ec23c297dcde9bfd4f138e34711af60e553f2c127
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c8ecfe6f304ea28a7ab95513231405d4914d20b7320e90da53a33f3cec4645e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b927f63770c3b7f60ae3d8800b53c998304cc1efc43c1685a17571686b828ed6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d3348133188468f1ab7c706421854802aa9185aa9e7e76a976eaeff4b90449a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e20373105cbc49f8b5573f45deec6adc167894c4020dee750a2140dbc052778
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d48f39fc54c1e85cc50b0c7ae2b3c83398ba6c96184721bc986ed25fb4122ed1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ca08b74bbf98bcd93d9a827666d26e8662f5ffdfd5423e2459664a2205c9282
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b8c35c6e962e24c6f917aa26721a2ee8708f0ac3c4c0ba2981a8ea31d83dad4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b52c2f258e78c1c31066ce1728c9b0cc3e739930e65df479671871d1055d887d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed3a2e19370499877da0b400dac35d9ca5f8dfb909a72ea192d80732d92ad59e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc0f99aed238ff025f704ff070faa7539e964b37a13c983f101001635740e575
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cbf65f66d549c4d9872799b5db2a7921ebdb215afffdff0f82f096953155649b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 460834d36bc5c976e2fb3048adaeb2cb5aeb12acf1ef0db4f38b84cd32364abd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf040c770d685f04a025eff2c5f3e420116c86e401cac9a7d579a7c9ff272d2e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 daf020011d03f4ce6bf6de5161965ff5bffa7703a1114f13401967b946634230
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca3eda1f8c08fe74d9394c0015620d379cd38b060aada3961830a18f53d55130
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d7aa6bb8ba30f1e94394db9d650505ecee207c05c35ecf2666526b09d4271ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6fdc745f304c0a37259f343039eb3453094dc9755bfc5e529383338554635d5a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d53f8b4ba4b398ac9f05a417a8197550e1aac4fc1e265e6bbfd974ba71aad54c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2752d67cc91b8087c7c89144fa74c19590c0cc4c5be7aeb42e24c720a7dc245
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 04bd2f9dc3d971d12d279a64f47f592633f9b1d474e1a4907c72af806661d872
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12234b44f9626195fcb0d8e3077e211c0afd0514c30bb539589b894db4ea6a55
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ae17e5affc7acd9b46b8fcd4ef29f92eb4cd9443017f2e08a55a10ccb9a587c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ea08f8cc8832f44b1384f0c5d97ae8961df4b5f936748bd229c2e4be49b3c54
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb92982d6b0835f29724cce7b95c8e131b2850abb755991df63cf094c931e7e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7279e7b6790c64968600c85e6bfefeeee4908c2777d88fa2b9909b42abaa4717
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acb80dd057687fce58ce9cc5584fbebbe3b4ecbb6ff2dd0066dca0eece52bb8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c28648e66213e45adf42a073743fc97cc89a04730014d639a7f94335ffc1e70
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8bb7f0a44b277462b03fcd476b072513313eda126b488501b29f8bb6d02da23b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a0f52f5fbbd3ff1b0e586a8e61d0b99be04cbe0916f084c7dff371fb6d31b9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1697a22d864a3b25476679ed47362e10733bd6a3f8163f5c13e8d169100f7e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69172561a8f9043aaf0a44b755304508ca7d70091ef0c0fe85db22997dd92c6a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ade2f846116775ca12eb89b22f3690ef19f425f7645f6774905b2fdc82591a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0af1069f9adbf712d4dc8dca639765643ebbc209f8798b48bd1e0215738c060c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e937708353cc0a9d3c55ee2d37d701f8d911953434db1bb125a55a3e422433d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 716123ddb2ece2642f40b128cea46198b6da2c149da4cdef01729d4ada24471d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b761fd51c66625d970bf86c10260cbcf4f664903e6127b9d64eb09c25b9c1f2a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98f790c9967e3fce3fa3404a85da1e4775c75891b7b0b42734a826a39249ebd9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a44504c11aedbfb06b5f3b0f06fedbc1dd0daf9fee02865f34b6874bd017df8b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f7cd671969f24b41318796ac1c46af354a9ec0785181c9c73b3a6ecce4b421c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92a0485494e3c3642b489cb083b8a94395beb581b199a496b3f6ef61599784c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0acaa2c03f8f23f840be4a3ebb4f86cd35820c3157d95d4db18856538cc0b625
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28bcedbdb15214e176d59146814038c59c49a0a9cb7a5d8d763893e77e2e8dd7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e98027c71bd0e2ced72425f045783c2ef338c774996cd4f5651137dd74a399bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3aba2f5660f4a5c670a7e8d9df4c50c8bc4915f7ae2c35ebf25961939f3b657d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1df48e45c39e306246aab5e7acfe3c7fc423e158a5b4beb739ceb968e9472105
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b215cac3a49ae24198d23ce027b04a8613bc69d43c0bef7e69eb10e6da01f04a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd45cf24414572c3f22ec15e03ab43dbcb8fa310237b7dbc1a5c9305561549dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 62add0366cb61599fb1755713e9713a1f4b20db8d322aceaa711a231055cb934
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bac768d3ed626bcccd2beaa8e3ea6fec143bcfea9e1cab120ede2f3027c068f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5d3c50c30b26c650a5513018288b5c8bb9d60604e258675e4259978047d9237
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58fd832e02857202093932c219840b103156d5ae8930133ebd49f883bf13c282
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9fa10f81f35c63d843d6d640079b2627049e9b34e1038cc8fd85aaf2157f3f95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0aa8feb648364980e50312dc9af993fe4660915a9cfeb54f749ace00f41272cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 198c221639c76e1c90744c28e6d7243c323614909860418bcf7ec5d68b27fba3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed68da4394b87c7396d3f12adfd3aaf05683e9a84aec4f101021c13367d9b557
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7cff729a2d81ae2f8cf641aa75db1e9d2d368eb17098353557bcfc7713cb8986
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 108037a0f62b521a11d6edad57aca0fc2e5dc2dcc668996d54b11a89da46ea96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 edca492faf4cdcf89ffe108fdcd99f65b23c941652b79734390a55e61b117816
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22147b5dd43d16ad3bd33e8adf7c2c462932aaccca363191caeda5ae4b5b81bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0853fc462e59fe3d38a056fa1cd975c84b3cae87c9c6b6c05e42199b4e44d37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5459aed2cdb6811b0d069b0c357d2b10f3f8b4490047b44d9ee86fe1a9d2c1fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5cbe0d892dcfc3bb9884d9a663ed97a8c5985c7a90263d0bd819ac8d19fc4b29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8a2afdbb53252de3fa59b0a37ed0e9d620faad33c27c0cd84ceea6ead2db9d2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9c80af5b5c46a5fa5679314b5f1fa9ab4835ae0b4b8da9def8a0df765b912b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8af93fab4354dd720f5e86f65f66c59bfad56602a371cf0009239a2fc652390e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 18abf8ec3e91d82013d7377a5f717444e1f6c505bb6ab774bdc7047a9f3ea24a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6aa22e34b321d4905ff124449ceb54d52cace8e6e42491110cfd230bd266ef90
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8e2701bd054756b93e10341b5b6ae0e71872995d25181454e4228ca8a53987d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97a41b0bd656f520e6ab7da810d94d6ea93f9f905c7d1a90a1de328bdfb0a50c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be367252e7dcca206a5075fa3ad26cf7bcee6f19cdc9d0edb5539f66dd911243
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8578928dbd64e7de20210a1fe199e13b39cfdaab56e848c3bd881042fb56d193
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2d41c073294029e04e1977f84b5ff4334949c743987deca2c7cbc9f18ff253c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4143a9b754375742fdd5be0da6cea8d2434bf2bc16b42ab9a3ec1d8797146fe3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c5d15fff22bfd6e5351673d9e22ffc8bda269ab0c346301966023438a238c5a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b1fc887b4b843e0173053f4de37e5eccb9cecffcd97e222ca95242d0a5b5b23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f0f67a732239efc7b11ba0a1bb37d281046a5dbcecd71edd8e424ea718504be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ba639f7d8d08a54748e98c736005175b33f68c940fbe00058963f7f09dd6c97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cae622cc26fd032e49e1f555d06ad0e24b7efd4cce02f2f6397c7364444bf0de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f9b380be6559d86a1805a2917ae4748b75dc95ecfe50f8b047e56964c884df1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31edfd92338ae8cd307ed1104043da417b5d201c061a38a1dedee44c82594f24
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7fe69eda0d1c66454b32f266e93bdbd3c23aa2f6f943499c33683c794d2c35b7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a793adb675ccc0a2c7d4d63d678a85c295e66d545006e8a58ef1771f059545d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be2ce6853cdda29cb7676fa3933c6aad561289344dbbe737923afa9c903c1a65
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b14f86ce6ac0b8d800cb8acc236f927051935134fee0e5e8099245a01e8dcceb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d9a9b90727481e51f1e0f1cf65fe7b71622ae09e2f14674ee0e7ccdf8a44a86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0af37aa9c272bc1b9530796da7bdc223ba9d7252f3ea205ce081f4df75c18f78
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f5100e171f30f03d53de2e943384f332a8912221f8d3fffe44684ca35f06642
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 220831ff223878ade9f2663f3b03cd81c56e9756b87b8c6465fe7ae3de69cc77
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53d701a4b5f78bc75204c997fb5889a4d9b233077f31683ff58528cd2602f78f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e81306bf76ade0f316c5c8d097f8c897c60ef9013826d9079a7e1e1abf113bba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fdb2c670b394132d636e299496e84eefe97673215a1efc14b731aed30ea87f4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3bf8d1069038e419adb32f65baa19d08901d1ba7849238aa26c74db2b82a070f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef5835a434a3421d88f2c02c6fee52ab0bda92d540b25e43c162fd5bace489f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c1a2f1eec35fedcd804d24953feed0534cad10f3a9479d17d8e206952833665
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2019597468b1d660640a7727eeb81828fa22afbc7c5abdda2175ca5ac81f571a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a26301a6eabaff6918a22c3907d41ea6df5925d291b169e4de14bfdaba3ef15d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c6e6badb100b125bb0718f434a5ee3c4c67db482637170b008e02fe60515c65f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3663cf2e402ad3973a62f2aad00c1d91e5869aa30324f607d9e2c9948b489ceb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff3ea67d956cd2b285759f103a4b9a660e243c5969725f25994d0d6d757016d2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24909edcbc9b25d3610bce5369c9c7c6311a79a65bb211ae07eb1cc2b0d63c19
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acb22334caf36ff610eb7ae95d12271563aa42a8ffc2833fa321006ad05b461a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1038451a7f9e255da4b14ada755a6c62813862c6f871f3055048580aedb7aa4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 52742c310e5d18dccae7ba3029ad3f70fdf6897b3a19731eeb586e76ebc1daf1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16ae20bf00fd32611e6ec35ab57a3a49158e4f327666d04a975ae8f474b527eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3cf8ed5534d2c53ee2dbb12da53ac4fd591f25e595e8ca757baf4185578a9c63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cec6682d3d0aa7817b825188fc3850c95c8e9933351007fa3f8be2df6b4fd075
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c159ba7bdee195bd2ce35a6c316e4315abd93add8185436b96f1b675dbd715f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f7e635ba81b78348718912d03a56f72d62a3051a50510c76d6b9ae764df4dee
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              svchost.exe

              • Path C:\Windows\SysWOW64\install\svchost.exe
              • Size 573KB
              • SHA256 535bd3c85b7fc16d1b332978a04427e78a5865f77e499a123d493dfc511d4a21
              • MD5 SHA1 SHA512 SSDEEP

              comcat

              • Path C:\comcat
              • Size 3KB
              • SHA256 3a4579f3b20c582d73a6ae1fb7dbd71b313dcfa92b12549c6991364e9224d2ed
              • MD5 SHA1 SHA512

              memory/1156-16-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1156-150-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1156-12-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1156-13-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1156-9-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1156-6-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1156-8-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1156-4-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1216-184-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1312-94-0x0000000000400000-0x000000000044D000-memory.dmp

              memory/1312-151-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1312-188-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3256-181-0x0000000000400000-0x000000000044D000-memory.dmp

              memory/3640-34-0x00000000003E0000-0x0000000000813000-memory.dmp

              memory/3640-18-0x0000000000370000-0x0000000000371000-memory.dmp

              memory/3640-17-0x00000000002B0000-0x00000000002B1000-memory.dmp

              memory/4040-7-0x0000000000400000-0x000000000044D000-memory.dmp

              memory/4040-0-0x0000000000400000-0x000000000044D000-memory.dmp