Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 08:30

General

  • Target
    aa4bd91383376c7e88ab944322895bd8_JaffaCakes118.exe
  • Size 351KB
  • Sample240819-keklxstele
  • SHA256 3dd5ab6f597ab24f85017ca54fe951be980f70e985a9c3b07b672ce56b9cc52f
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • none.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    System32

  • install_file

    winlogan.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3444
      • C:\Users\Admin\AppData\Local\Temp\aa4bd91383376c7e88ab944322895bd8_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\aa4bd91383376c7e88ab944322895bd8_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:436
        • C:\Users\Admin\AppData\Local\Temp\aa4bd91383376c7e88ab944322895bd8_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\aa4bd91383376c7e88ab944322895bd8_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2300
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:4084
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:760
            • C:\Windows\SysWOW64\winlogan.exe
              "C:\Windows\System32\winlogan.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3412
              • C:\Windows\SysWOW64\winlogan.exe
                C:\Windows\SysWOW64\winlogan.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3620
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3620 -s 568
                  7⤵
                  • Program crash
                  PID:3892
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3620 -ip 3620
      1⤵
        PID:4540

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 2f4ce47f671ed7d8d3e6eb1f42e6805af68849ad17cdfb42081f7ac9c1a778ce
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 96689dcee2c024f6bbbf8b6541f14f11b688412c6fbd87f0635a1d0d859b6606
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 490844a59fa8d2fcf7554b6975e264ecc16833af151facd64449cc992b678d2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97bd5bb9a614faae463eb829b8b676c6b82cdbd1526d85ae7b273ba71213388d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41e72d48243b1d516270b7fc6750a47248472b76b46b3e22a659e3c8539c8ad5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e91659c390231a838820fac6ab7d9bde92786d88d4a7e79bd5c0ffa5f2179ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d28cf24094fc05824ed3526f6a4a5010bc2afb360b524925fcd693075082db22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4405e9a64acda2fc2e5f79620133aca968efdbaaa9b38650aa4d515c95ad8922
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 031499914a2a591de394e315b183c834cc294f2b2b421f9840e3ed1d86fa8ad2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec4ac44bdea968703f60f840742dcd4457d66a388e2ccd76e33b44c37ae74530
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3aacd72fdb7d9645d67992ae5efd28ed90db90e82121094955831ee3ed3949aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa1a060cfe629f27a04db82150132b0f67e8041b7afd0c689c1146843d24ef4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 413c026a92dc0aac348668cf6bbc71f01c5343a0d89ff897a50c6845695bce1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aae915aa29d7e3823b919a5c668c96dbc63adfd949af710367230d9e44bc407c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 feef630a5be5702ca7a7c4c210de0be4fd8515f8266477b673ca4a6835b1ba80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4454f701e7d8e3a57e73a5dc19626060f36d637c7f42aeb80e757442caae00ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8754e0ea9bb0c3780bdfef4839542b04b3a3fa23ed48110095696970ae62335
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae2e53c73c048129b197b4ad73b8ef2bec6c4c674c25889eaabf6e81d2f5351e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6412bcfebaa143d08274ad9918ff6cf0c3fca8ca0d7827550894e5ddc57cc557
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0dea7dff72e2c3aa11ab99ea1b0b9f2103a9c2dab228d2862453dc38b36db1b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 748daf287eeaa4f6da5fc209250bd186243b3145ec2b15b8900ad7d239ad42b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 670d41489e4a860e79336d501fdd0b15113dd02ab9eb37e3278f11097f1c20f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55e648e4da2f5ebc78cf0fbd5aa2099726cd9f5f1d2d6fee0a2eccb0543b0339
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33460b002c3e177211fa50f7c10cdf4d6e481062bcfd84ecaafa225a34cfd901
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c8bf34d24ab11d32662828e33e83e6689fb645dd5c0e6ef30150e896b7662d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d57929847b4b3b36b79d83bf8d04ec779bf2b0e9cf94c651cb7d19493d075108
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd960fc48a6ea2b73fc5a5cc6cd363e2485b0a45ee4e890e7635931f43a04f31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45e4624dc0ab11dcb8c4228839618ea61a2fd38bd72791c56b6bb1c8d6075d62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 654392759b31f78cfe213c306e596db78c592f807db64b68c8b48fb676c8187a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54e9c244fabb17ab4388b7ba23a8b06ee9549fd5b0416800f6f583f016bf101e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42f4c3fad6412cb87c29aad6d237ff26ca8cbc2aa3b450997a3e7633863a863b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fc025e965efd428f66b7aa93ea01a6229319b59440d67dafe2a4474a6d08886
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d68e775176b8afa3ebfbab28c7f556418949eaea39e79d0bb9a17bf885fa7fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7eb5a00f8eb4d4b16e14ebf348754ed2872df566dc6ebad71eb7f6355c0d052e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 185d8444a98ec1529ddb69f24549316aff2186f1e06cbfc3e0b57fb95be82188
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3deefc80fa1307b6b21e266b934e3e33d75aae00cd9ce82db34a4b9cc699c0fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 712f84de04f2ce6afb689661ca74aff64856a956c94e0f9d8d998699013ea3da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8010d3e73900cdff8f1c8804e0523fe157fa1aeac346f0403fa135bfd952638
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edf5aaf2a4eff625bacccb8f0a6d8dc0aaec0dd85ca13a4366a1d1773c3fe0d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fdcbe089770f2cef51cbe6225feb699e6128aa011b6bd3c578a0ccda423c498
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f240f9328dd6da9e578f1634f3db369dd22cb686420d590d4f59f6ba92ab7171
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9daf8d29d9e1562f50256db3c766252cb24d894840566e571037a055670444de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fcab7019ff456b6d251e915709447f711e900b08a687a95442d8d4bbf721c77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2571df3425dd62db1059665d3afa0683889033b9c08ee4958408385d9c67440e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f62bbe1d68c46d4ef7b3d5264b22620f9da0fe0f486199da48466cc50b5e173e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21ecd074bef507ab995c7566ef14eb24edc558cdf8afb5d3b86bba9142a42473
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76498e662571c4aeddb827838d0c78b5599419887db15ab0895ef8130c997428
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1335d1a6e5d3f7aa028626fe5a524d7d55482ae505dd73e8e9df6eb8b571d551
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44dafe962c5443751b5a5d237942576b1cbb0ef736247d8151e08c35bc032ede
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 901524c653edc356a021fb61329f0c1544194dc8763021d084b57765dfee49bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b6dd3326a53e10196cb2277d9e37694c733593580d8738afa352307a4d941dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 000ef3ce4eafb070e31f1af8fc635b1496c90622f0ad99317824db1fa8a408cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4587886fae48cd221047d5fed77d8ecb6b0734f24398a58170e82f9677296533
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69ebd278ea56f87b98634285d4784367bbb50dccd36b037ba75144585af066dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 313e114dc47997a8c6bdf592ad2cd07b50fb7a58409bbb506f44936f27eb9f1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebff0990747abac6a70fee359eafe5256b71e59f90dc269e1d598bee581d6104
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf5507d71e7cec86459790df238d1c75ad1c9055502ca838ce9e3d1f7325fd4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da55bb6be50a402d1cac8633b33719e4508583cea5168120cc0e0faf91cbac8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59f770d55c9088f38fe312f89ff94141cb6e55ff4024562ff322827303209fb6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ab0f9975628f94779642efbd13684357247c4d61487e0822c5a205c2cfed77e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b50c1d6bac838adb64a5582629fc92536fe38226092e72f5877fbc77050f3779
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d65544bb4826ae3cb866a2c5967d1fd9b857aca8a1d358899541ecbc724dbf59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 674b62d7ccbec7ca27e5b86ab3148badb7f186cc001c99e19c46992cbd265552
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f11a90682f815513dd295632849d470e4d5c79090afbc2eb3e59b21a2c2653c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46379bb6166f44d0b1e45a15b78b828fa87f43e5f12b40eca9277c29043cb520
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb7af2c128990315824aa9961ff0b1be7b74ea5fa0dad777cd1aa128abbf3538
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa760683a6346c6f39620ea61f88bfe2922c9adbcb5bb7788ca162d22954549b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6e78af42a44ad41403d3df3a34549b5dea53d985f4f04e9e2ebbf3717ed8ebc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b117a6d3fa5c71f21d017d60d3dea78c279406b6cef9ba2e7ac875abe5631b81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 365cb03baa5766daa0f2ecbb9165a1d149fb2dbbf42f949c6f96cbd40c616068
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c583b3a1c7df1a7b9c293215b1614b1f0325b268b8b595901ec6c06a8b6a4de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e90bb1303f0afb8b8335e1120e1879c1aace65955f100dcff0bf7b7f86e09517
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a32893ec57889c51d364be1c81a011b5dc587a55366ac167ef56b1e64d47f14b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56f4792a2353292a8c2b42321b3266ae1c4f792d2fe830f9654f9195da6d0dee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6936e1a5532d0c31d6b325b7787b61ba27f2e667c6162dac3fabc2f8f907297f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cd3d8528a791d3ee3fd7eb0c5d45db23fce5eea9a91a3fc002accaaf7c6c75c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c211e611f7c9f1b20a680f4f23a311cfea2064178a182c6a8c46a939926592a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98fd23c9bdc4b784f087d02c7d5b898f20d72ce76eff02cae09c8c884f8fdde0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c247cacd3a5d11edc8e9aa3ebfbfe3f2dbc78413a0a9ad345a545d7df25aa84d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 710a741b4352c70d4bc14dda3ebe80f95590a7559d55637dceac1651cf19ea93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f843e6dba930e34abb5931c7e7e899c09c123b94a0e046e2ee1e79435f51431
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b167b1b1447f3644c166cf53c09ff708ea4bb0c3fff471fbb59d3a7bdbb3aa99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3cda1c54069c71cf26a4bd477b9589dd473818de928a2ae6657bcc32ee5bfb9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d263d3a068f7a54af53477cea77fcd531e846db2fcd9ef9b149bb4c69139dfa9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 433d10f256bf33cbe0429614c169b82456ba6ba62d3892dbb8fe899615aff9c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff45270c4d51d709a6e3369cae1f354810cd05169f1c15025de00b014045212e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bce5ded0d97c2e65f8cc4972fae18a3c8dd6843e15f82c1bf1e31722ad4188be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a8fc41ececd88cf1b66cbb46eb45e74652c761e1289af8cbba90c9fbd39393f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36c4e69d12a4033bfcf4a6324f2759b2f67d6cf36a782c433053bf6f0f92981b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0814ec3993d81cd72be16cb3f270bafe1663a222cad1a073872d77f53a543502
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c5b1fd83d1b304018378fb4669609282de4ee3877ad6471fdcba9ed7afeadc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc943036215583402d26c946d20c63b4d8affb3d3f5bd10986b7ec7a66aa84d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad983b1e51325baed2c78b19680f7d2f3d7481670b5f33e943db0e0313e2e8f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fd7ba04d6fe0e41342bed9b409826fb03bef36c2b27e1cc54385dcafc69806e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 703d35fa8d603f6ccaeed395e7ad6212a9cde411089dc5421cb995bdffbc2c09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8a212fc27afc77436c47d0ed52cd164f64e7e43a39d4e01b26038560e0b2dbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8afa87f6946884f038d9afa7e84074504c6431f72b1fba0845f46be09abbaed1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1493f14d4334c11953e4278cbbfc8f5f6576cd6bb17030400cbe7b0a80b48afa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8bd2c7d6f4a537e478dc88c349f4d201ca8a164c017527b40c5d604a95ab184
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab5968bad58245834fa0abd22b78186e959df04e4f2d261746bb3d8c1b021785
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7dd183dc1aec382ad724761b7f2d54154de1ab55a0778ab4b5616865978e75c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b5d608e8658d481bc950064c246095a9f0686548847a9a120312551be5acb94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f64da2e7bc978982f5f7119c8b8c511f80dad322ee5e934a0f147bc6c8c5bad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a84e70a9603f687fe3f33400b27e545074f16463fc6e7ab8f007a149e7e83651
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98b42ae797c05e55882a3f53375242bc392820f168bbe134ff116341f165cddc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f8b7a79faff4419976433f5871ce4bc4e45113468fe70676722f7d898407594
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87ac0d56a33b25b92d46c784a218eb3c7b81c2ac2fdab536331628fd9ee1fbf8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acf33fe1ac658b318e06094d4ef2db95f848719c0f1cea7b0d0c5158d70633a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7bca5662b93c5a24379a62ffdb0e0a3ae495491b8475cc6e67c478485428f8bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 464be982e86b04d0c4e8f1014e493088e70e36765b4517b891618afeb4ef2078
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6edf4bdcd26dfd6c500b9621afa1f29dd1c1ec9a1d65ff826157c6681cbdcaca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 546c97b0ea1690badffa00d6c1aee7fd6e7f3a94c47ab815445c178c1003ee1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56cde5d1519bc9f5ca0bfdea948557df318d5e05edf64a62e2f0af5f5510d7ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eeb1c950cc7041c1f8e8ffb1aa818db41dcdfcfe3d5d3a5b27eb7c57db932aa3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd0886984c0f492e81304fe424a398c0c7772b4d622bb35a829eae471cdf5ace
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5d2ec936fe1136fa6a62fd4979cd3349fc2f43b8499a5403a4c21e50e55b1c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29694f07aa857617f1596c60d9ab22d9eed51e6063f5fee5368852ea447cdb29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a66d79fbf5579937f3edd7c8fb30202249b45978b15acabe20df1747cd512f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e889d5084de6c6f9e9e9c79280d62288bd6ecd7758912e07f520cc735919adb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e683ee62161c1035f85c5f627e2401eb18611b4b3600d6ed07ec93f1d2f563ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9860e579e9aed78f4800ea75e6f9bace80f6832d8eadf850514c0fe824e1b94a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2aa752c511b939ad1e32923ad02f0d63733e8e04fcdf8447158d95501ebf747
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a81d819f7b76fc765cf2c78fb9fc1b72d1912b8338e8900a29cacc183834d621
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25d79484537e630283973b7d61749883a174939bffaab7a57efe2a23d1921c66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0db97f34202fef443bbff200894044ca79fa89af4b40d0fe2c72a19a4affd80f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a268a0911112ae39f4991ed282a88972889be1820fa54e82244e19cdea3f28bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 543c66da0914a1abad06710cfb1e1537fd8e57dcae352074c0bc0a858a8184db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db11f130f1106d21bca2bc68c800c18b4fd50f04b4297b4bf75440da02eb2432
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 210edd0f9be761166730ff9926725fddbf5c58c55deba24b9e73d6d64cdf55f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 389ae155c681d37b59e33c28b3c112f5dea211819ded57884e459b1ba00e49cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62ef588f1455a25f3d8fa96ca04d81028351ae1cbd0d4074ca17ee02631ff373
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8d154fa843c73fc5fe8626d4126e30368855c4228bef70ded633b1771c59f9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b974af57dbff43bb2024df5d59a3a1f649690172a3e619fc6aa08e6fd43148d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fcd6854eb482c15686e28c5e9cca7738ea24402e78ea0dca6f1a75f0267b16f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1df4ac6119c757e078beeddc27b5433cf3c6301ad45edde7415bf42a88d778c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 399d9203b9b667c7bd7115c2d00893f90d281432d7f5031ffdcef5c8e261fbd8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63f620a1a993fcf34e78c52e85aad7237fa4d7ab420fb70a8690edc175907696
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9eda03c2700dc5d76ca847808dd3e0c44e7248aa91e1a003bfb0321cc388868
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 986e18e358cc13083c28ffae59cce9d3554001c12d829560ea18b930a4ba5f43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2825d4d8787585cec6e35b2b7e475f1401738da5a106044512f772d3d65c018
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            winlogan.exe

            • Path C:\Windows\SysWOW64\winlogan.exe
            • Size 351KB
            • SHA256 3dd5ab6f597ab24f85017ca54fe951be980f70e985a9c3b07b672ce56b9cc52f
            • MD5 SHA1 SHA512 SSDEEP

            memory/760-176-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/760-142-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/2300-4-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2300-5-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2300-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2300-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2300-8-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2300-12-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2300-29-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2300-143-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4084-13-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

            memory/4084-14-0x0000000001060000-0x0000000001061000-memory.dmp

            memory/4084-75-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4084-175-0x0000000024080000-0x00000000240E2000-memory.dmp