Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 22:33

General

  • Target
    bd6ca727bb90f76d4d895054a326c5d2_JaffaCakes118.exe
  • Size 1.2MB
  • Sample240823-2glensshkk
  • SHA256 a148d8ea5d247bbad29c6791509bd2af47b8ded2a03cc940c6f592f27b12264a
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • cazador2000.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    setup

  • install_file

    driver video.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3524
      • C:\Users\Admin\AppData\Local\Temp\bd6ca727bb90f76d4d895054a326c5d2_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\bd6ca727bb90f76d4d895054a326c5d2_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3148
        • C:\Users\Admin\AppData\Local\Temp\bd6ca727bb90f76d4d895054a326c5d2_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\bd6ca727bb90f76d4d895054a326c5d2_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2068
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:3516
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Deletes itself
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3860
            • C:\dir\install\setup\driver video.exe
              "C:\dir\install\setup\driver video.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:6544
              • C:\dir\install\setup\driver video.exe
                "C:\dir\install\setup\driver video.exe"
                6⤵
                • Executes dropped EXE
                PID:6640
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 6640 -s 544
                  7⤵
                  • Program crash
                  PID:6828
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6640 -ip 6640
      1⤵
        PID:6792

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 87ed2e760f2ca83bc21bd348f252c67574dce0731614752d1ac404e5d33c3005
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 588KB
            • SHA256 ca3939a51e5654432e1fd441dfd07de6c03253de459fc1e7218b23b86c4de8ac
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08a6b3ead3389012250ddcf58b7ea47b3e7cdc7d56064d5ce0a6dc1c9d2dac20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8c5965b7f540755e11861094bed18b7fe0b4621c35e00da7609533467cb5eeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8a059e13442c8c2dd941a8a87684883d7a07da5c41b81bcfae3f4f02cfa211d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1ef2a1ddfc910ae5daef079193e5934e89716695c076a3f5fabe938abc94c61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fadab44244c77f9e67b99cadbf96d5cd1647a73e27ae9856059ab4bab19682d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccd3257419a26a1a9e83d43cbaa22609b3fadfcdf8a5b13112392950026f07c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 028adb4871f8d74980b7a2a0b38594cd5af8cf46e8f5cc4fef45b4e3cd341717
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afd6e7669d7286798a949c8541a0c0fb0d6798b3cba09a815920c2d891a182cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc4170b2c3c4a1c5b1f4077831fd5b2f93fe24fcf1c7ef860cf122634171fedf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cdad9ff3dab9182ebc8f38ec9881210c01e6caa8d2b7ed932a61d645f16484c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d6989000bf39b5fd7693f48b5430a1053ce003c4226ea782264498211e6d80d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6b7a3d7c1aa90912e3cdd691c400af7967640da7add9c5c9f260f4d7f4799d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96e0bef74ddd304c95e463186b8f0fa850a17518b68ebeccc8c5f523d9dd5913
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 991a0a680f8e9b0792d6634be2796795d0322ffe951c81851979887d80c577c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23679fa1503233f571c3e54374d75dda2bffef671ec5bdad17e104142ed6534a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05cec0c720f872f966c77864f9f8418c7528719322cfccf528cf18742c5f0764
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3502baabcb7bcaac91c31c25b764159e2e4e4133f19fff9335a26e74b1abfbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef7cdef79ad51ed506230d996dae2314fb4fe557faf2a2f26b134bf971ab08f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f0082a2b95118eb6ef75b04a2f66be6269a48b0a688424ab1d1094d10e7d62d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9ca14a6d7185d7e11cc44e5d7f61f266892d20b9f71185b5715b2d5f60b94f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 910544e27d962bd14d50e5a3b82d774e1a62f12f9016672ff99bab644ec57a0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73b4d9c045facca713e1c9c8e025597de5117e0fe4ec95e425b38b3bbf7bd8e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2cfdab98db44a6c369c6925253d18ca1f8350a7d355b76339f34b572acbdf3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ee16629f58b45d65fd03080a84736fa08ff761d184598e18a440007030a7ad9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b4f4483ebd571916f6647d084c9f89ea3c2ba6d1c32597e77f62c98b00eb48c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28d42248b9f75bec2c8ecd5836e04f58ec8be22cd750a0a0a5572892aeca9871
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95a2ecde196f22771a88343836f12d3a0f39e94d1f8470113d5d15a14acf49c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acedf6a5b9e12b3aede697a6815db3c0458c9d1887878d906765802e797613ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e026dad27810a8a80a16e9a3c7ba2b0686064a4d55339132e245e31a7df19e2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb113641c381d769e8802cdcd166171d0bddf15471357e7e42aa944f7e092a03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d8e035d5b7eb7068b63ac031ed9a4bb1963726b6654077520897f56fd1a2291
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed79d18c8bff40e4406782b066ca61ffa2e6fe475e964be56e143dc82db1b740
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76241bc56723d79d707d412238b2db5cdfd36771c8a7a4b0433288d55ce650c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab26b293f1141835b2bae6565722f478a5c1ba654d06052800e03f84545e1026
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a33ec438e8b4eb3b68c6310d331cfaa95ba4fc6c39b4f9fb869f32309d9182d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55f463aea5738e6316e192e7024e3194838cde7e14ffede61f0cf7a01d549c92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a32b4c663665154e439c34a852fe3e64b1c06f6b7d33dd9db35626eff3a8bd2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe4a5ba086e00f19615ee73223c4709daac390576d713e51d08db2be56b1c526
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 186f421730f1e0a8a9b9dc9c053f0fec3c96ec6820148052e5b9587cf266546a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7ad6c8946baa45447801674d8d442966ba9b25eae5a5600151029e7e959e095
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02cda9f57e5dbc16629e007cec34363f2576315a85af5a64d2e218df263d0b00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64553d13b243a07b37871ce06f3b66e50d9e6a7afaa93496aea4e675998b456c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00c58e1c03e82936fa38d5c9609e9ea954377f69f4152a28b33f31475b8c2acb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aceb7eb91f636922105518df3438c04a1e2e49b126b9e6d17e73289ebb3724a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93b771de2eb1af30ed8d098e56a5fc544f3433bb18dc0d481cc41dfaba1c9b8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 303b8153b4a90a5add2d6a3865f5f294f9273968d14d45d2e26774cbcf7b4e33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b99d478bf067fa7e15fb626dc52ad48d740044b7427e40cfc2511b9be38aa2e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a24059be6cc20efbc06b1e95631b152f5c72dc546fc4e90ad73fdf534b73819
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c20fe2bc2755980133369a2d102194d3a58cf9a07b23cd04e699aec74d8bd618
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3991c67e833882f4266b4967f45da5a08ea32487a6eaa8148dca33e27955cbc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b179a6e46caca9754e02b38aed9eb669d5dc96bc0412fe5049ab8582b7762cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9836155c67da5b584ae87b07afe061734f585e15024641039a6815508b75da40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a603dcbd9e39805f29c7e76fc0776a912c7cd2254700af3fce584fc5b2b9b30a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10f0ac04522957fd3b5ababf686e21a99c7984f48f2aa26a768ecc2f496b16b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85fbdc2284a335e8dc3b591e140b1b478af32c8de93adbd16da3dadfd9899798
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d57a7a466866c568f9f493296bbc882aa3101ba5c0118259e93da9a95c9c4d26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 852c015e2170da7a0622684f527c21223518b0c0142aa8f2fb47a0566e4659f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 933bd6ee79061c4bc8f0a4c89896396b69c6cb3f551e3d4fc3ab511995acca8e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c89bbce525afd3addb0b198c2cb3c3051c074838c370c5ad504dce1c39f1b76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7342dd3defb09e2182635384885c7fbc80783e2d66455f72722d8ddef6d7ccd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac18f122a71dc9fecee71355af37e9f39e2fab6ced40497bb20e3f5c21dbfb6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbb06eac153c786966deffde12e212f8e5f2e17b94612696ef1a5603cdcd3cc7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6dafce09e9afb429eab5074a01b2532689a94400bcea259c7c324e76353af661
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42d277ec924935c875c69d9f31a1f67aad9115d722d224682f5c97fe8323441d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bed9f95556d789b9156277560cdf3762113eb492bbbb1faad7ae91cb797f753
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45f3e4457cf89f1fc14f5f81ab2126ceb1a4c929972458e07fa06cb9e1076904
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c2637758864da3afbad7422f4d81e3ea62696d7f13defe47e78c1bbc507f999
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c7f1aeef03d46a01f349fa2fdca1b7348d9d3cbf5b4ea94ebf7625b764ea61c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbc907a3c00e64a87771b2ffcdbd2651a1a4d48282961c4d89ca56214a8c03a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3caf1ff85e9de68a04e6db0c4d8f955c0017847613181f0fe43effb1a38da11e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ead4400c1b04377208a5de5afd10d286f63f1fd3130daa05398e4c33dfc9d2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c293486cbff041eba071dedce55a3f5ffd696d8c2a7d809a75455d1706c9b34c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e30f0d1bcad3150960879bc7c5c092f134b7ebea4d6ffe2927b6785138bf1a3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9b9f6fba05bd6458dc4e469ec6195f1d53d00e435a158ebec8d6dcf35371f9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7cf08f606ab65a3fa5591decf5c500618e4d6914018e50fae7985653b83b9e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1b1bd0fc9cada7a85a67007cdfce868550107ac38a11197018216243e4bfa65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97088b750e5de08140ac6ea9321e8895ee7eed723d03110bdb778b46a0095821
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d490977e9152e197699bc71578ddeb01fec0688b7a84c5e09bb0c2e96ff997c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 839c7e581a33cb0bf93bad5652fd984ac989d9cd633f4641f080a1b702068ca8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f99eee311f3d5d05113249994f96f1787961c929fb0bb4703285ff944dbdecf2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1640c49724ca9127e77a30048bb754c23963d3b4bb57f06fb543c327d4a9ee35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c63fc70cfae02d94543736addf136b964f1db8626c8724add57557943e0ea91e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0ea3c526837959e27f63fe4937873b69eb2f6f3b7d1e5d8dcd9ef407029085a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3a3225cdb1587ecfe07724bcbc186d4a151a8b84c3e732f5f03a6c3662b9ddc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3742b334dd28539353d0e759b3f0858fd9780edca6783687b26e51849d62bca9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b4c0c6c0fa53bffc34bab36c1a8dbec1cd6bd45aa67a87ca287990a88df870c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddc16ed4d1db392df6b891d331397fca9354f85f8f28936b9711326b72488d61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1926747c59c3cf962d0740fa1f8d0e853861349d91f2a646192fee2667bfc188
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d73de60f77a9ccd7693aa0af073dea0a2b4a9ec873787389b3583cd1442a11d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03912a3cc973ded5b71cd6656bbd189433ba50719e0b702b2f7e48b874f299fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab39469d74fbafb83121035b21d12920759656055865476d34df4e7cfd7a18c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ae8c33167419b720fb0cb53cda856ed83d91e1951a49d45aad717af5b36f017
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98ba55b81faf3e16431cc421026cb1066f2b3d798642d5283a95957ad303a428
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4524084f549d2444fd903f5e419b998b69c0ae21cd64222d67ea5c3c0325691
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17f0d8bb31f620a32bc70b4b3141c74a23a8c1cb73a9f83b228ca38ccc691633
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 654c35adb710a879eca4f8cd0b6db55113b264f4062c71f35764cfc6cb31facf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 611f656fa1ce1fb512bac9dc7533bc76ae2e68637bce7ca4c6c7489acf2fe803
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dd5faf42a5f20a3032e2673264e305c6eb449c6811f72a5abd3c517196d7512
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7fc9bbcd443909a7e3afa4d5dc672f1c1e64040e26e67685dab99c3900eced7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0d57538c32e3c9aa12601a92eeb2a6d8363a56ee4f3e20a537c894f65f2468d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6b7124c9fe9f62c812c2fcd58a6c63de48b018303c0e758da024f7a99947b3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34963dcce571c6280f56b7baa69188cd25828b62261c15189d25b3ea78688f3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b73bde9065309821a2a5d038fa3c450a4c11a24b28a2229c2fb2850f86335f41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db08cf7581df1468d33c4f79b702d5a18d171a901cb13aabb1e8b97ac62e7714
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ded5af6d730abea7031793aabb564e48e4ea2c2a161f6aa353aef63327aed51c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 968d8c87bab34ed71dad7bd63fca94beba2f2665a8b33334ba50b6253f893931
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6cc1070847654db035c67a9ab185239a193c82cc0a93050f7e9107e83119dff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b36d355ad37c5bdd7a8e9d3722e1ef29bf2970bdf9d42bb349e9402e91de1e9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9da8be661734741b1e8c8a63c665eb3b9f934335e477ccabc10e5ca558c1061a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e836044115dcb714cf884a38f4e39645c75ecb75460d139d94721b10f7d13d65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecaa481ee34a7b7aa05ea01fc8784d6a478f1d0f6297ace115f91e03bd35b301
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72bc7e0302ce64bb77420e80b1b220105585fe2d6b7b0c5a72a578aa2c11ac82
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9026527776ecfc96569d2db346e514c80080115005addf357543b210132c0cc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b86da90e4833826ae6e92855e9df0649a88ca557f223b8cc73a2c93869c8557
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b28e1df4831d656967239bd4d588ff7bf5663721dcf147b5bc7f5162bd3b854f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca540b7be722737e39ff3c1280202b318ae9e309634aa360605e3b7d51455bfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a32803e95c052d7552bee62251837ac77399562a435152c54f5ffa9a70929500
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1babdc2808fcabecb31d337732153aa7028b768ef5ed900eb97f8afe8688bcd6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb328b4d570d6f3d743af4078d9b6a2e9a64e726394909de24640811bc262968
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 984b85f54e64229311b409d4e22e3a2612f8263ad8e78297d953d8f1263d958e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04043a5738eeb43945f72a5cb67cc30658ddba5c024039e0dfd66d5ef2697a0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d761b8d15a0f49d70086562c6878d16a080286dfb4ddb084c99998b78cac135c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 920b6c817ddadf8d1fe186169017c771260143a750a062807e955868eea275a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d0d97e9da0547e5b1955c94c04c73de9324e9645759f425fe9362ee9e4f9ff1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d7293319f44c67ab9a324879accfb4fefe3ec468c70cb20613242e540ac989b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d5e80b644a57b24e83938b5bd656bf044188e9bf2b68e4a5f8a972818fd8504
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98fb98d610cca977b3d19dccc024ea8ae9c111dd4550a571a64fe275e52b79ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f53cc2644c1ba9f8510842fae4fbfac54e5229265bfb04296bbd2986ad75ef6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be0d5941de4a30563f6aec69ed1d3629a6db227187f71ca27ca34f15c5676df5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3d5234448ffbced0ede561bed61502a2a1a7844d3a1603f365fd3ad68da3f97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e61823a47ec8bae30548f533a022ece3a14e197ada8d8d541be8519597fac38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19998829875138764261ceefba22bd0669de1db6d2983daf94f4e243d3f74121
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b02573b2db53529a60edac276478f97315a9b4f1102935bc14e852539ca5b4c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3947d8657fdba8ff5ec07fedbe85d4f73c11ab426694659eefcedd218777e5b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a50d1427c469ec601ded58c2e03716bab3cbea4dc00572d790844b90cf0ea2e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c26171539bb84b49391aa03e677a3aa735e0e9cfad12b092ceb50e6a48bb20d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 847e4fc56938796455088e5f751488fd5ecc9a8d59620cada2dbec8e64fb6d19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88611abbaee17d4508653437165dc1483ae46e26eac62176e2bc503d13ff92a3
            • MD5 SHA1 SHA512

            btiBE10.tmp

            • Path C:\Users\Admin\AppData\Local\Temp\btiBE10.tmp
            • Size 172KB
            • SHA256 0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
            • MD5 SHA1 SHA512 SSDEEP

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            driver video.exe

            • Path \??\c:\dir\install\setup\driver video.exe
            • Size 1.2MB
            • SHA256 a148d8ea5d247bbad29c6791509bd2af47b8ded2a03cc940c6f592f27b12264a
            • MD5 SHA1 SHA512 SSDEEP

            memory/2068-30-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/2068-1374-0x0000000000400000-0x00000000004AE000-memory.dmp

            memory/2068-10-0x0000000000400000-0x00000000004AE000-memory.dmp

            memory/2068-12-0x0000000000400000-0x00000000004AE000-memory.dmp

            memory/2068-18-0x0000000000400000-0x00000000004AE000-memory.dmp

            memory/2068-20-0x0000000000400000-0x00000000004AE000-memory.dmp

            memory/2068-24-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/2068-23-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/2068-707-0x0000000000400000-0x00000000004AE000-memory.dmp

            memory/3148-5-0x00000000006C0000-0x0000000000733000-memory.dmp

            memory/3148-15-0x0000000000400000-0x0000000000430000-memory.dmp

            memory/3148-0-0x0000000000400000-0x0000000000430000-memory.dmp

            memory/3148-16-0x00000000006C0000-0x0000000000733000-memory.dmp

            memory/3516-1420-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/3516-699-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/3516-31-0x0000000001140000-0x0000000001141000-memory.dmp

            memory/3516-32-0x0000000001400000-0x0000000001401000-memory.dmp

            memory/3860-1375-0x00000000104D0000-0x000000001052C000-memory.dmp

            memory/3860-1421-0x00000000104D0000-0x000000001052C000-memory.dmp

            memory/6544-1414-0x0000000000400000-0x0000000000430000-memory.dmp

            memory/6544-1416-0x0000000000690000-0x0000000000703000-memory.dmp

            memory/6544-1403-0x0000000000690000-0x0000000000703000-memory.dmp

            memory/6544-1404-0x0000000000690000-0x0000000000703000-memory.dmp

            memory/6640-1419-0x0000000000400000-0x00000000004AE000-memory.dmp