Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 07:02

General

  • Target
    aa0bc8bfb94405948b42ea98f8be632b_JaffaCakes118.exe
  • Size 3.6MB
  • Sample240819-hvaqjstdmk
  • SHA256 4eaf5e6bd708427f030b25274edc16f2b68b1c4015bc5e91b9107087a4870c5e
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    Setup.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 12 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3596
      • C:\Users\Admin\AppData\Local\Temp\aa0bc8bfb94405948b42ea98f8be632b_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\aa0bc8bfb94405948b42ea98f8be632b_JaffaCakes118.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2328
        • C:\Users\Admin\AppData\Local\Temp\File1.exe
          C:\Users\Admin\AppData\Local\Temp\File1.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2412
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:4744
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:868
            • C:\dir\install\install\Setup.exe
              "C:\dir\install\install\Setup.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1420
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 732
                6⤵
                • Program crash
                PID:452
        • C:\Users\Admin\AppData\Local\Temp\File2.exe
          C:\Users\Admin\AppData\Local\Temp\File2.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:5108
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1420 -ip 1420
      1⤵
        PID:3744
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4128,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:8
        1⤵
          PID:3992

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              File1.exe

              • Path C:\Users\Admin\AppData\Local\Temp\File1.exe
              • Size 276KB
              • SHA256 ba3a5046cfa17fbc3711f03b2fceb2d8754e0d1ffce027d9f867cdd2dcc70e32
              • MD5 SHA1 SHA512 SSDEEP

              File2.exe

              • Path C:\Users\Admin\AppData\Local\Temp\File2.exe
              • Size 3.3MB
              • SHA256 f4f17b0c72df739445fab86d6d55ec6f326ec17f903270df067d308333ea0698
              • MD5 SHA1 SHA512 SSDEEP

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 88eada501de1e59be6f14fe0a9c2f7e0aad7a4dafd20cb056d2598e45616eea7
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 8a509ad0b60b7a53829a1815d83025099f8c78a79b0374adce626efceb876aaa
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cef20eb9361fcd104ad59dc75e68fda83093b939f9fca98e175c8fa1f8d8a2e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 deed392d1d0a62108d0cf4daea60e9c2b041092576255bb48a3ba2ca15daf85c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30a0a97cca136c5e93416d2146cb62596afacd5711a295e361f916eac85998b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd732ca93930ad6f060c0e222c46463918522acd0c235cbcbc4868a1f21b90df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0221db7f94acf39abaefb0b6a5911b2e9aac6a15f687b24c13ca08806ebb8325
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e9119c52b0b3ecb37a6dfec08e6a32cd325dbe52cdbe76736163189cb03c808
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 335ce95d8a95fe870d918b58ad5bcc7a99aaa7e2cad1a11ec2158b03afec848c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 81265c2161808c87462059f8a590c8e51caa86b9e05a10afb3feb9535dcc9368
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ada7ef203ed9a49e950830b88ad7608d1772c0603c16330f9a38718a67ec73a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42d21b1896c1d1839e125fa4abebd5996b40a2c8810c1342c2fc84b52a85bc80
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0d8d483d6298f8f1310f2eee5ee111ee5f29f9667c21472465583867a2c2e87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b0e27ca631c3b3a468d2bbfa54058863ceb8c2d12190a4a4726827605bd1750
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f3c016812fce64df29822607906c556feb23295e05d1a1631f22ac90c995918
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed8b6e5b59511749b109e6f3c6b943e8ab5314379d9d2aca1e1dbb3d79491e99
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36725ad7b32d5d1a269907e0f99f3fce191b8b0437ecc915d6fcaa9415d95b6b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1a66fb7ccbdf8bb43f02d7c08ca17cc64ec6727ac6cad2e3834e7b93e8f1ca2e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ae1edfbcc4da7bdefdc0df1350af6d89881b08b77837db34d64526fe3a0868c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b2b26731c9c77ce3296c1e2a0bd442ba5946b2b38cf29013ff2f55ceeb63f9e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2e5bdea154c343481b058f8e705aafec01c05b6fa914457bb3b601da390acfbc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c19fb3c58d01234535947260e55876ea18ddd240a5c29ffa50abef313f307abe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13bb3e1761f9e183ed1ddc1cec899da1e713a1b76aa2584ab6e3068c982ea986
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12c857f7ecc2e0f802ae0f395b57f3f3015e0520a0008cdac63136d7d2603f31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1af895c2ac64c3ff2f07c436b8d23887d20c529a50cc0b4209217c789f479e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 900b7165df6f6d2ea69f373450e25fb47e4ab0561a041e0713308c95f378acd8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f7a07b401c2dfbd720e9f2130d8718b1ee3ec5091b90dd1c99c798bdd95bb2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 52660d36cb1db8bd1be720387f726da875d98b2deb7baa4379bee6d3e27b1ccf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78ccac8bfb9bd4d1be98cd0bd1fd64056c5ff42726fbd1e762c684b71cc0bcff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55ba08a8424a9b0a0f009caa17bd4ba074266a92ed34d8a55bf59667289aa264
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2655a6dad070b1198bf1d417e92023ff13894a38a108527d05fcaad3c874321f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd35b9d8ba42b5fef1761ec278b4093df6ab1204de2b8ca870ac166c12f4684a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d154e87d86be3fc76ed9975cd95d1a0646c0bbdfabb99f8378db78ec55101d84
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c70a49772e4860104d4c3414c38ebd4f0e7c6054b6bad00fb9cafd692a73abd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38a1ec6e57c9c231b956ead1eb0b890097188b67d1fac92b8978b0235d299eea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e663b22d201b7e66c3324cc7c15acfed2b31357f26c7756cd64d1a2a115d3f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3793b204fd8600952005ef49fbfeb5a5e0fbf6a64626b852dc8a595057255553
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e857d1fe39af3f125fb55cf1431aec2cbbc77cae76415a763c3fef6503d3cfd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89e0845d06481d4c71528261b836b9a17302a603b8e6420947ab4e2252af7d30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 802c32ca1d0b16f3ec3ead564f37d138b7c56329ea4be2f2c2dc20b7d577c0f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c000497cb879a8616253e5b90b3e8cac1340b4953ecb7ebd95efb86773d5a3fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c70746b06477782907e7f88bce9248ea20384f1b3b98aa0a76c1bed584e19679
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2374293a84228dc634c8cc96be6395ca55d374664f246f2a8f8775eac62af7ec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 111aa9c95278049fae70a3660ced58a1d7c8b6fff518d680c40654579acc5585
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29ed09b505ab995af1d314544aedce5a3bb4b4e21a6600686f2689a7271cc5d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86e7b86fd0f08faf28ec04c5f7620133cd19bb53547f09a99f432dea2e3dd5bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 529279be481f2ce5f6b67f39d67447d454ab0a7f36f7041c3b01370e23929b88
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9999c0e2e8ace696fa48c1be81f19fdd7dc3b6aab4e58486ff118c1bae422c11
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 230731edfe02413da02d37b6ff55140f33144f2605aeef6eb54a9a86e20ca1de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 391b23ba87ab79d7405a78cb2eec9c7efdd6f1e532d421958971f0fb74e47642
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d3a6eff1a2258d427cddff90a9c10e11b14159bb4742dda5b28ecd953e4057e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4703436e80a897f1c004c5b8f1fa4deb245e05c5cf2ee2595fcc5ef0c8e8442b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b30a088ac75fedaf5f8451b0c34667b28add95c59225eb5a1c511ac030982b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1afad348158cef186208060908e80136c7899fb6580d3f287f60ea8a3ee5e035
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63debbbe57dd369f5856b18157763f2767f0420757ca6e133a17461a67c4e43b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c848ea9ff3ac46806fad8209f44f8f8a2d199e8cc6dbaec4e10599fc3b65068
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff74a5c58c235d111df97b00505c3a1a2f367257bd7fbd4116534b85bb91007d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef932d341aaa326c72b906e4eec0a94a93077bdc6bdf141c6526b66096e1753b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48518f599ef1d3c98b4e61df92a76507111198dcdd9c896602e0b494f69c7d59
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e445a04001b70c39361e006d8b711592b20d6ccfef8ec54ed3207db462a29d37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 baeaffde307126a6fe39d7203659e7521273c7f888ab9409b9f2b364bdc8f581
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98467c7f49d9a7a370bde35e396696313c8ae21c7d82925eb688ce7ebc0d9d09
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1721b281337bd73719f6e9786b51b12a0bb6ffe4fb5f2a1d5454c1922912b9da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1028f68c7a920d381cd18aa07cc7527335c3cf35648169f310223e8c46cf6e40
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43d62771ccde84003dfa4db00737f54f7328695811475fd5023b3ccdccafea51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 541ac0c5042aeed62cd6779401d7479471c5cad7fd39c7b466c63b199f009acc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0288fb387468b485ef356a07e0c54f78426bac53c48dfd365590b6556e90888e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3b91b25d18e073edc76868995054e9db16751b1d16c622ff09a097ff3c21023
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 45dcf325ad72079c5e3ffcde7c13a6d1ecb358634c7fa704a299e249ce18cde5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 07a73bbf25d3cff63fde0b9be556f0bb6777a05b6ec9eb837704bf4b79d41ab9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92213ef23e10fed6de05be954ba212783078f5c41bf4e9fe1579c92bd0182b0d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffdd09bee41786a03c5b03ffb97b2e3d9d0b64771cfb0641597214d447896ade
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58458a4ea3c3b3f8690ea520dc7d392359558ad17b46b1a5f9ce7230611319d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93d17525f6cceb07398d4482211edca5f428b020eb2370ad2cfc092bcd5bcd5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c92a4df1c006d44f6afc3bc452086fce72808545433a4ebacdd2441ecbffde34
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3eba41df5fce6e4d415b070f3956b191759658e037c79621495003fb9ed9d1ae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ff4920f71fff0536c7004fa95e6d583b5351270533075d64f2f3f071e2ee979
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b14aeae36a74203f4861753914ddb6aca68579ceabab2aae07174415ff421045
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2eca1e22c8443f050e069a0921fbe4bf031162842ccf7a277c1b5966d14e306b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5248a7d4007ab330fe36543bf3053e643c4f7dfb77ac045518f70b16fa7f164
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc1aa0e27aa6ebd8acfe7ff182757d9adf226d66baa4c46f60619cf6bb35fc1d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c0866663022038410ed7c28b2f178dd1fb547418f0fbde187557f8015cede2c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84b5c6637848b6dd3d4cfff3798c4c0378b26f8cee3e2e0acf6717fa10379abf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3738e08030bf822960539aae77bd8153a0462a8af2c3e9a4a5df22019ab3df76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 227e2c5ffd23361f111bd014f75347393e500682856a0f66be21b596437b239b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d634c8ad76f2624e827c1eb3536dba64f771989e318d14ac2696c4ed07f0803
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 162d1fe2b9a9c265cbe9877aa75710334fdf95d36ee491eeb3157f6b4374fb80
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc02f6c10ee5e68aa351be96a91afaa8d2b6d05deb29c8b5e5660869c9b4e8d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc624aec167ee3f81872f07454d7426c1a50680f3a1b2563e6581624a2ed660a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d12300fc33ae09eb2ad04c60677b8537b535e10dcb98d0d53f46a01da79c79b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1be345e5798c5e7fc38b8430b7a34e02934e54b68da4191b83f0ecb2ca24840b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56c876d726c57d25b43cd9097d423519009509ce93ae5d95c46e46590597d6ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 613d69907658de7eb78c555da0aaee4ddf1e9269508e1a4163857410a4c0eacb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c46af80c1e6e4a464d9817c5d0c3c3d5cdec647940d9f55e727adee25a8a1ec8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a78000b82f43b95a3d480ab317afd90c6903218a1fddaa9fc248751d3fa9916
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e74aaf9b47709e90288bb828321afe034a03a703b483d12161cc003de9d3d36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d95226e9d814fbe4a36df8a221113edd1f9684d6c6bf06be21372c347eb74969
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 167651cfcfcef99ed4ddd8a8e440bb0a9b560bbb8a13d352fa533ab8a88a920f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e24ec888ef41355a941a733fb1632ce2caed16b4b18efe8464febe52bd6b460f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc69b0ca75736aa21ea79fb65e5d9d4e018025571e44b6513435baaa75e942bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2501428f7fd3c44525d475765a257414660bb2396b56aed7e70c4a7d232eea8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 779c2a925113b49c4d2ea2eaa20d5c23d9194d8b3ac98d205e7332e9e74c6cdc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b8e332c5195759f59e46c97e4c5c705bffdbc6da36f459cddb50f4b794f25e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57ef4714027b076149a606a6e0698a278ed1426fb94fc827dd1e3e953639bb7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 15bf3e8b32d7ac33ec967696f6b695452eb079e943852ab41be6efad6f957ab9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65c37ce8bfea6d90c9c9abbc12e8b77cda8e262dd1e5de77e1fa8c3090106b23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65ac23e96aa947e22a12cbdf6f48907b76fc40579ac5f1b502bea78cdfad8a2e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c8c4a3db1e67df8069c489bec2fefea2d34cac9dd1a2d4b1a6566811c8ffa91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6563404bfd6c7b0b3fdb8e9ef5308fa1c95698008bde56cc1eba27801f6abdc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3fd5ee0db48776546c9add328bc1814f7d12bbf4cecfe1360f2dba93bb7a2b7d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef1405e0e5eb7970bcea0c918ed9612ba9bd4e042595b62ad0255dcb2257fe0e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67320938883f591d9d26cf29b9eaf7ae2b4f9ede66562a06191b52c8af20efa2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd2e3f6d94cd85451d7af39fedcaa0a96097079b5516a0c8c44d82d59f8fede3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 23a5b63e2f2c4432a20e858214dae32ffc040f027c33e0e5b2356f8c440f8bbe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82f29bb84c0846b937427d211aa0097d09b81dc99291c4ecf2e4e14447c0d539
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 303e85c4bfcc9bf08518d359db6b86352cc8b07bf25de62bce8e4e6384176ec4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bbc65e862c519476aa0a6d71b3d2910eba5ef2104a30b581e85ae2a5d16a25da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 359912b3860547c1bfd8807c1f608cd5ded85e9c1767a1393bd4b3b8c570629e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c0c069e82034aec5f4f40b90f9d65ec4e26c954fbc4f7c7561a5166bf2329562
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe43a37fdcf5fba0954fcda7fb2fb7a98c83ed8f9130a0ab5f98008353db8b6b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1cc2f462fa226a8d75310a0711e9a562cec89a746cdf57182ae0eb87446b128f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e2c5e71f91a2da23b703373162b724c6c504936327604f5ca7884b0a963dfaa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7aa0e5a85d893f2b379bba079c7853518f6e11459e171e4dacf5011ce37d1b78
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6857f333f4b1251306f90042fcec51f8642d076be0a82bce20d72d983dc5678d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1e9209142f3cf551df7faef319a59cfbf10b66c8094f8e8c1afbfbafb7700aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d43112b86b52802a86fb7477acb96041f105edecf67904db3656498cc5aa4f61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 262d52e3ec5316be05872d71872dd4fc0504bbe425577ce10be4d2cbf8039212
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66572842cda2d6b4d734df95875b95185cccabbd18b3fbdc246f07bc4dddd4fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27854399e843a27c00b3707b2441f6f988160479b0e29909c57d9c4b8755441d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8dd1758d518e42ecec85a2a0f0f260c97cfbba6e5e154981c0964f20e34a7463
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30573d114ae19d0674be93ff5e27dca652e3ca1d55bb733dff10c999a97dc330
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b3efd1710dc344518f7f965b94ae48b3a7cf7a090905a3fe986a242e316ae739
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 adbb83b95e3b8014b2661fadfb8d6721797c7d3e042d798e6ef955a3f3e91826
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6ae01a1ea3bc2a98444bdf67a3e4349e6245bf1aeb3268e92dff8be9a74da7a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de900dfcce9e605c05fa155c173f0253c74cb36030397d6e4165febeddb19491
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cebdfb46299f1fe1a34f4b1658817e93d25d330a2cd0ec420acd9e2c7940afe5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5a5d6fb3a12839672519bfad925830c20bf14ea5ab4929e169a1d828d5523b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dcd92b68209fca84a89429a0f5b222cf66aec2a63f3af20b2913ca548727c294
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5b96d4653d79c285227beeb632eacd8d7d59ee2fd1d30c83bd35527cc55992a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 161252a8b872454d5670d62d2ed7fe5ee1e94807491609246e8c7a54f80013bf
              • MD5 SHA1 SHA512

              ButtonEvent.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsj6965.tmp\ButtonEvent.dll
              • Size 4KB
              • SHA256 5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
              • MD5 SHA1 SHA512

              LangDLL.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsj6965.tmp\LangDLL.dll
              • Size 5KB
              • SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
              • MD5 SHA1 SHA512 SSDEEP

              System.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsj6965.tmp\System.dll
              • Size 11KB
              • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
              • MD5 SHA1 SHA512 SSDEEP

              UserInfo.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsj6965.tmp\UserInfo.dll
              • Size 4KB
              • SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
              • MD5 SHA1 SHA512

              gcapi_dll.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsj6965.tmp\g\gcapi_dll.dll
              • Size 62KB
              • SHA256 c66dedc708c1ff94b16c46951570887f528e542bbb3e5574ba314fbb736a9cb4
              • MD5 SHA1 SHA512 SSDEEP

              gtapi_signed.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsj6965.tmp\g\gtapi_signed.dll
              • Size 71KB
              • SHA256 89e157a4f61d7d18180cb7f901c0095da3b7a5cc5a9fd58d710099e5f0ee505a
              • MD5 SHA1 SHA512 SSDEEP

              nsDialogs.dll

              • Path C:\Users\Admin\AppData\Local\Temp\nsj6965.tmp\nsDialogs.dll
              • Size 9KB
              • SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
              • MD5 SHA1 SHA512 SSDEEP

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              memory/868-144-0x00000000240F0000-0x0000000024152000-memory.dmp

              memory/868-229-0x00000000240F0000-0x0000000024152000-memory.dmp

              memory/1420-193-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2412-29-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2412-143-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2412-73-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2412-11-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2412-6-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4744-77-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4744-76-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4744-75-0x00000000036D0000-0x00000000036D1000-memory.dmp

              memory/4744-225-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4744-15-0x0000000000B20000-0x0000000000B21000-memory.dmp

              memory/4744-16-0x0000000000BE0000-0x0000000000BE1000-memory.dmp