Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 15:52

General

  • Target
    aba00d825331430a862305498ceb12cb_JaffaCakes118.exe
  • Size 290KB
  • Sample240819-ta25vashnb
  • SHA256 7a6981b6a1805df734916789b0092d4e67af4fa8959654dbe445a7d96c2dc2e8
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • myiman.zapto.org:8181

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    asdfg

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3396
      • C:\Users\Admin\AppData\Local\Temp\aba00d825331430a862305498ceb12cb_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\aba00d825331430a862305498ceb12cb_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3744
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:1532
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:4780
          • C:\Users\Admin\AppData\Local\Temp\aba00d825331430a862305498ceb12cb_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\aba00d825331430a862305498ceb12cb_JaffaCakes118.exe"
            3⤵
            • Checks computer location settings
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1988
            • C:\Windows\SysWOW64\install\svchost.exe
              "C:\Windows\system32\install\svchost.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2028
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 568
                5⤵
                • Program crash
                PID:2136
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2028 -ip 2028
        1⤵
          PID:4384

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 a5c78207fe361d5ff4ce0b682da8f72ef29d5a01ac6314b6b071bd141f8ebf07
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 0851ad9e5587dcb249a39e62f5683b7b6cc415055e3c4234dec7fec490e56266
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2dd0f445852becd5ddd2e13535fa71e7be967277c1874e7e9166af241ff3e23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 611d3b0f6b0e4beb595ee8e9583107663680df4a1c6455694784e27f244faa9c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 101de78c544d1d88e3d97310caec4a8641a49786b9274cb064d8be0746f47269
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 45ae93d912faf01c1a458fee6fc20d10b5e78b72ac92a95294bf913bbec8bff9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1739192b98277d4fae625a71766a53f19bf0c46af1162da51227142c7f446ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a36264fe7f397a6c3bed20c3b4617131aa030488ff3081b8a626d676030488d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2fe787a28ac42010c5d8e4cc7bc2ab74ec5556ec0e0dd26136e4fad59bafe084
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 766ba7dbdde2d10f39916c51cfa675d9d74b5b6b7d9181dc37c22a04acb43ad2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7acdf8ab8ddc3be9559917b340e9ca07f27c5ec40edf3295105de6fcc890d4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de95f1da15f6acab811cef141f2f5268a6744900150953ef2a0147277d45721d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 37252c58bf3387c4b7a4fdf8713b466b4866cda1fb8e383ccfc624844c391746
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5a32b2ee422e577da1e7546560179db4528a289ff57d1e6d1006922be32ed77
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8272a70d439ee7cdb3b0d121a8e6c8c2f1d63817d6dc8644703984adc946e275
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ef00bb5fd3bf05c3772b242f938f3fd8d894b51c614718c9557bdbc9e3a1c8c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0d06852508ff6b08f73faf0db0fc8b9b39432bdcf54c0aa4189c35be55a91d32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 96d6ef2a1f1dac38554017919868a332d69a4d715d7f2bcac67eadc4c6f861f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8954f0fe74923a356d53a6ecbe8328612286f63d89d5092836a7afeb9e65c00d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f1b33677ef7f5ccff7e9e8713ed8063789f94d8fee8d25828afc3c6ff5f4052
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 437356da9abe01c10781f8f534090034357f89898fd8919de77874484144991e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d22b409826fbf9af64fbd26070ec0c7529a07518fae9bb378f6dbdf2444c4c11
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d61da33f1c00b684f3d823829818d655882778cb43eeb9049b0492e05b34ff13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87f8b61ba371d446d18b70cc6f75a77717328c550430121978ed8e78705ee10e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 122f0a31875f3b47601988d3b867829b1a863f0187af37fa5d592e7c20ae84db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b927b5dc4d06a2a748325aacba02a2043fa3bca7af9c6382a7cd3a24505a6e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 add3dd9ab12bbbae294ca976de8321f6ad93cc8064743f3af4da1260094f3e6a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6029f054d1dea1dc46e149b81e7724245d3c4c4d3bc644497eb9edea220f9432
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e093ac36013cbdc54e61127472b990fce3391694513878dcaf4af1a99f745678
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84231b3be445ab9d3f7a4ccea5371e9952712c26dc7c65f982070d3f20328665
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 91b52c3fbdc83f2ef8ebd5936834198f6c2b67551f2a16e992e0154cd4b778e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31eb8d2975895348f0298e3c6e15567607999244c8c1bbc6ae59dfc8bad1e1f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bac0af039ba630f1f740922047e26b6d67f178a86eecd50f26ee30925622a167
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 446a9e128ee39301d0e7c69a28d93b31f4b5df787026d09baf3ec6bb4b84868a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb44c13f6d5af2b9418634f1698f8e1a9be3bf848d98037047360d4658378d5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2e830d1ceef0c9ca7290818cdd159311178b3c4a7c15db89604e60fd68341df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d26870032ee2726c06fbba77ced125865ed55049f6562532afcbe47449352269
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b89cc6bedbf445f2246be96b24e584b2384a704077cdacd0f8ad8ecf9c96a80f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34d48459949b1123ecbd87e1f853d57cd01d451345f13b6158fa407bb3218576
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 357aa28c6e4f88979277f64e9cfe08dc677d3472bf320f7cdaa635635fdbb1f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c43988406ada1773c2c5832f8e6dd0311d7a7688986da59934f25c8f5deaae1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f59eb95348407854ad0d073bcbda2d7bf35663ac1817fac7c31dcac7b23e013b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af6976acf4d320324d78c8a74ef418b345b64fd6cd5af1a760fcf11b83aa116c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc94352946d3add72e28c8b644c631db6b30de929a8eb37f09135286c882127d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a63300d99312bf82bf173ad9d45b7986f6352e531966b0230b4954720119760f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8fa5bbe70a17a78ccc750fe11a2cfeb080e74fb3bcbae2df321a5db0faab5265
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20232ceae677dc5d4067bfd05a27ecafd2765a3663ad8cc3a3b960698c25621f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93c72d4eb3e68034df4379f737207c09b2651796db6ed3378867440fb79cbb23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f5f40ccaf5fb817c56fe6a5136e1aff14b6625d5fa38a5b0db4ae9d5c7ee4f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c6aedabc0b762a60a85546dc493a588769e23868a1139d492373b86f3c6ebfcf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b0f14104b0721d323e84072d954d01460f479fb69b488f60444c36ba87166b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 067bdfe8a858daf842aa60ddc0b0c343e077a8579b3b9e760f7af322def08bd3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e0048959b8d31bbb2a29c50ef983bc79c4cc76d6163e1fb9409278b380518b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9476ff22a2892ab08e5fd546d6649e02e2b1989d8235ae1a08796f8c51dae27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87af3efc2771e036392127fd349dd4ef2abf7e1c65eee4db63bba256aa0b63a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3255dc8a79e7ca0f76af5fc389f2beb94f933278885fa6eaa0fce129bafab96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f1509f148c41d55b969d50e7a944f5fef1662b5922b795bd3b2441105818382
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 338bba7281ceb3cffb8d938fdddddadc6654a74b4b066c4a0b783eeff5037a63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f74eb750806c67f1454a70ee7915158e60ef1577a5762ce6f25ebd90d22fe46
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da8bdbfc3e931edd61134df5a1d39ad825ef6fa79c0d38a90aacd9d09e616c07
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ed262345d7bcffc268d5af5c929563583ea3b5d0b046746427085284b623607
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71d16c3790ca0eabaa6b60800d53ab7af7f2ebdfd405719b222ca22e993108fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 552c163a46b6dc3adcc095926d2516bbe95d01d91c982cdc437dbaf28cad499d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d439564cdd59d14650bab0887c7c3498e40d63132d23f9a13f300499106ee646
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6be62b69bc667d6beaabe36ecc7a10ded091b2655d4e2aa1a8bc1dbdd6017e2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3cff81b995d2692122335a60cf84f57704970d7a6c0cb4635221be8f940c8865
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 441ef73dc51cb1d7e7b9a16f8bcf5f2f165424762534bd2cd537841456bfa1aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 588230c0d7e59fc800be6e8563f4a19316a003d2e9bcded9e4aceadeb3095cbd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c4c3de4a4f9eb1ce87ffa33411ddfa753f030eb5d9a51d9e46d097ac4ac65e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c2d4929e8eb1d7d0fca4fced40bb73b8f4f31cda1275d730eaabdc8900b0745
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65094a9d21e4e8affba2ab601339ddee218b7b30fac62f585fc3483763c0c9dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01332ae9258de3ffe6a521a66882848fbccd26ca3257230aac8896c4e0b311d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d547b7057b7b63abd0ad0ad4ab27f6d9b454441f3564f0d4955cc39c97b5717
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8db2915fa70d00888abae6cc1694df4a7ae2a6107ac724bac623bddea13a447b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 605e7423088642e2b5b6326cedee1f25f96244afb131561462e5d5e2bd69ef49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0d3c9c55688d3598d27f8b25cc3b999e5c13343bb3028db93de7b723a6602541
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b89c9e66a25548de7b1d58ddc0433d9854bf0389064aecb07fcadfeb85003bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d2d20b6f37aef0892ec7d1dd3281748ed3ec4a8c0d68b06443ebbf2ccea6816d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb3e0a0b3e3a701d3ad3c0b25659a250599b490007e9da08cae83bf22d2631e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fdc8f005618a44d4108cda4e3e8ba2443985e298be4173f3701df0cf90cbdde5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 18600d4688e79ebe8181484434b0b72644b6375b6eb446bccf46bdacb57176ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b8aae02d10c1ebdb833900da2a5ab14735bb226f672d631096990da8b3e2f4b7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 241c6ab45a9b9da6c51b241a5430db524fa02723099595ddede6594e455f8f25
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 546f2fc9e128e2fdba0802b71b15cf0ec276729e7677ff81f120ba5daa4fcb7a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 726e512d162fe897d8ba519315b52aa9117fb64eed8de7d38f80d3925b147cc9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4686606eb80bbf71c3bed2d7c437e07a809422d2f49f3f5c83e290b2e9c70152
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 91a224e70ec32969bf9c60cad34e7a8c5c8e98d0dfa02dab006f690efbe8159c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08f3ecef3867595ee74ccbfefd317d7e208798094fbb57b8ac7d1ab6d6eea746
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3fbf1d97a879b8f3b133d0d37216847a9deaf2be6a0216153dc6c6d98992b170
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e78a9d86772909bb76fefba71a91fcee417836221b95377aa0d65a3826d15bbd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3da7a4c134359555f72def8f8ea08cd35e47f07f02fa8f8ed33ce9a5d1b21e36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dbbdb73fa0314fc1509d6667f01b59b23da1b5681d2d77737421cfbc7679ea9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 189664a7b29ab00bbdea9eb66577ed4f4f9e4deb12a7909e33a1a009d950b7a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b8c3cff3066cdd3bb82214d9cf7a2cad8135a09bf368d34c22f1f1c8e2eae522
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a9bc13896b46484c2f145e6c40dfe06432fcd6131fdc77fbd3c181de68b131e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7c34fdde04612c51fb85e9ee02c8d3126e70b9d25f843d444e91480b3e7cbc2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09a95d59b223f3e5a8faf44904d5b4c7e635baf40e4e490c004d0998ee4211f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 077ab8fdaecfc29509856feb088ddd0138867e8d0701d3bfeb701f1562b47275
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d9cf97c267fc4fa50738ed589308b7fc75a30c3ac1cb647c095968b6de87f08
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a4010129afc855bbb88f88ae41b6d5ec44f2de5550934acc0f175c92f256462
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff3ec115f933bad0d108b3b00a0893eef6159fb5656df2a69f33093b456854fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d39ed9e4d872b4269dbca6ddc44259e308bbf8d43a336a71b4321fe1305c3264
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e9e427f6544d4c67c7de143ef79d1c1b9afef6f21690bdcb32ea2a1c5cde4ec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ef92d10b815d3424a5d4e931983b9eb2654148a356b04124698118264fc4615
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd6b284db0767fdf8a862c495788b5053a6a914ec6dedec13000d2a194f56b09
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 455140798d8ba044446becda125efbdc334514bfe7d3fdf55045c82c2c625d53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1fa26e479dc3fdf17fc202591dda136e91619f3ff11a0f60267ce535219ae573
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b6411012c103bdc477e49ecdb7e0671e08e7a6806d2b241796b85b9629b62d89
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f4814dead6f734acc5684a6cdf054d530b1a84d3c3b7a79a88afbcbafd90da3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f696d6649ffcbfc60916def4b8214c12a24460f7874cf074bbe7f8fa870c405
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 956f676456435e0bdb54069f8665740d7bee1ea5593e9b9caf63c3fc380ba2a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ca1491af67f48d2dfadffe0f8da863e56066a4194e110e3787ee65401000fd8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1edde18c5a982efcd2eb9e60ff85864474b6cb90e8cdd2ce9653720f02997298
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c27bf26527afeda4d8d013a3e594ce071b27ff7430b8314c7be8d7516a5fc83
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f01a5d4609cfb631b045a18e61c18a2f260cbb2fc7641c84d3afb62f88666894
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f367ab6e1632eae4b50eba04e62cb6a116806404fa07917a77670e4d55c1902
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e17321787e01f1f8dc20794f20f758ec0a3543c4cbc6540e4ddd58a1472651a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c69197a2e2b259f5fe60a9ffbbd1b54bade41b13251f6b5366d9cb6f06ad10d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b6983b308e8a888c6fe753585415b1ce418737ad41d18294f3da44ea5ab68a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a9e3609ad9c89f2173fd316db8baf251a76c1d96eef33dc87f4ccded9cfa33a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0c9e54a21c5153bfd5f64440f58eecc33981cebb22d9b0660a8b8027d2a9596
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 adbfa844f24dec3e59193025481460aa65754198181c0caa4102726ed9568056
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fbe6ce3785935a8a81a99a79a02f2923e29857892d8a2cc35fec3f0d3dc14b9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 558057e3b952059feb5453b2b82c09392cd2d2cc83187da9011178d115863c04
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce2b38c7fb7d80658884b8a7df8f4a6a146f3937aca1aee8599ffb912311e236
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2a84af9794ef870a03da4ddfc31dc6c5c30d86a6eadbd8b17c5982de0003a8b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02e98c460ce91065e134e479ab806153cba33e8b6199669ef56a23fb6274e987
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cecba3d0c7195506f692ee618e071addda37a1f19cbfc0e912eb22fdf235c81b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0480471190c3490c3fd9ee91adb041ace4ec1591bad17c9e5e9878271e8e6b43
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3c79921e6f07d3d96d75422ab96e6ea9eb2b5459cb74dbb966b8ce8c9bc8065
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ef8bd2858d509467677923ae8020a73ca6300bb31d137d7f16b8f9abe10a0de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e3a5313b145f003fb8fe25d7133b61492a7b1229cd56c0d0ff3cd579691ef929
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77445046bcdb98634b869cd11936e2ffafdf0f36db95a6301847b42649a1d945
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d635e29666a7abf2cf618e9763dc52f17aab354cf3bcc32809cf6535a2c1b5d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b66ef7f2d9040500d3eed11e19df463a2ce9a9112e03cb82b944b479e6a9ae38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 101c17c4c748f81c6698644449ca1674b658ea9ec58d26b9cc4914853a71d227
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9df699e96c14cd140387a4968fd4956933c732c3374e0d6c58003e1abf0224ae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6b40b25987409027c5c14cf66f806038c9343b22fbaf62cbb0881d4631c931a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9732b2fba25b44d152f1049f66e12721daef2a284e91b4475c8eb46bf32965f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f7f8a5e9755e0fa9bb59213a1562dba2c4c280bef928622cd296f002f5e518f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35df3b86fc10d4c75c7ae4471071623d924dbdef9fe3982a9b98bee41d2ee6d4
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              svchost.exe

              • Path C:\Windows\SysWOW64\install\svchost.exe
              • Size 290KB
              • SHA256 7a6981b6a1805df734916789b0092d4e67af4fa8959654dbe445a7d96c2dc2e8
              • MD5 SHA1 SHA512 SSDEEP

              memory/1532-161-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1532-8-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

              memory/1532-7-0x0000000000E10000-0x0000000000E11000-memory.dmp

              memory/1532-68-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1988-138-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1988-166-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3744-63-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3744-6-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3744-2-0x0000000024010000-0x0000000024072000-memory.dmp