Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/08/2024, 17:13

General

  • Target
    c9421e77df17cdd6ebd637aaa32b2e4f_JaffaCakes118.exe
  • Size 404KB
  • Sample240829-vrsheathrl
  • SHA256 6d58a420dede321f638ac8b4c182c2e2df83585b7658a15d6f5d6c4f2314f78a
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.04.8

Botnet
  • me

C2
  • alexalextwo.zapto.org:2222

Mutex
  • 46OUKW2TI68JAM

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    svchost

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    112233445566

Extracted

Family
  • latentbot

C2
  • alexalextwo.zapto.org

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3524
      • C:\Users\Admin\AppData\Local\Temp\c9421e77df17cdd6ebd637aaa32b2e4f_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\c9421e77df17cdd6ebd637aaa32b2e4f_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:952
        • C:\Users\Admin\AppData\Local\Temp\c9421e77df17cdd6ebd637aaa32b2e4f_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\c9421e77df17cdd6ebd637aaa32b2e4f_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4220
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3392
            • C:\Windows\svchost\svchost.exe
              "C:\Windows\svchost\svchost.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2452
              • C:\Windows\svchost\svchost.exe
                C:\Windows\svchost\svchost.exe
                6⤵
                • Executes dropped EXE
                PID:4432

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          UuU.uUu

          • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
          • Size 8B
          • SHA256 2842f64a807298dea61517ebaf60e06d24024e2fdc7b0b8aca6250e86841b581
          • MD5 SHA1 SHA512

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 222KB
          • SHA256 407b9b2730fc2f287aeba5a1007806aac90010cacee8fadd69c071bee590b4d8
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0faa0b958312c162258817f43cbc9e810a2c70c98d0b7c56f217a99024e7eeb7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b92c3b515e089c606c081fb5db9fdb6f57a7105e8280d5c77594a76ca422bff4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a0409aee1346d5f69aaa85c4700cc645c460e012d5801c67fd2ac705ed8399f6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7bfeee93a0f3bc2210f6a4603b5aa653d6cfe54cd4f20411dc54c7cb6fa24e28
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e54e8daeb8e8bd9c27a3f0e780ded5b8fb418ec4bfe2c46afb53b997f9a8b2f0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 793062b8ff34e44ce46fa1ac2082ac80524a516daf8c249d7ee76bb7cd0dbf6e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6a871f073601f777aa03a664d462827a0e29307b5b65039396080467612f37ae
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2d1f6b7936950af406b2ecb4ed324133a97d5e423d713f0a60086e7b6e4a5084
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fede31d5badaebc6b0dde649d8b79cf0943292b5d244a9a28432384214274d31
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 87184b93120442f8bd20dfcd375ca0230740b56ffdaeb5ae949ceadec7c294ea
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a28781e016284ce3b670a022ddeab239bb7dd42fcf1ed5760021b5251467af11
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6f53b9c40d759a15f89915ae0700ce75b7f276c8fee0f004373aa3fe4bcce5ff
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8adaa6f2a11151fb97f4013c54900cd622d27de291f5e7049bd4572d714327db
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 998a2730b9946aff2c3cacce42c072820e625e58a45c8b2d995dd2477ccf1060
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ee44572f368f7a191ed4717f1b3821887838db3b14f045a5bf79153240752dbb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a2d7658a43a13e062226cf67e05f27509366e81b8d859d0938978bd19112512d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 eb2f354c9fc1ca558cea6aaf21dbb9d6d605c85b93408c96b9351ad03ca8410c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 93b55a52079e1fbc2a1cedf7e14b55394c725b1555c99862e2b1f6eae7a3ebb3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dae7caea5b93d221bedf746ad1868dd17b3710233c7373f43f932774577d9a46
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7bb3c120ff18ecf203f44a09d0ce1076e9d63ffa4799996f0d83f6fe0da4e72b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 474524bec6974f12dd4c9d9866e9ce34e4d37ddf62c8b2e4ce47976e4a72d17e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fd2498ea19aa1fbcf0fc36d3c3b19721d11e869512e9840413b03b7e7cd069a8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 21f25139cbc856bf05a739c235b12035b80ca704bd4c1de60d68a10192b94f11
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bcdb985fdf89ef3f22d2b4829a1ab55f648722f47a121f0f734246c390c156f7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b59cffa805cc0f9089a215c91bcc03fb8f97dad41b95b8153bb3a9d1ffecb6d0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ef0adf3270ecacb81290998ff1ad0278a0bb4d5b6e74df186275d268d5dcd4e2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cc45b2c731e79e1786374935907a296020c462c218abf589f804b38fe1ac7574
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c5171238fe6e4a825a006885dbafc1231d77342e4f4430aba480fae3d05e1d82
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a0815d459d931f28fd3f07e22bfc72990ecf1f2fc7106245b7735c5d63600bd0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2f523ba784b8e175f95181e6ffd202033aef9236584000b349e3fff70d9ca7cf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 430c4d1a83d4eeeaa3ec177fbf859d8eb3f697b220f1b5e167900e8e5873d7c5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1519ee8f81980206e3558c69e00a296982542ed85faae992ecebc618259cd708
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7eae8d33ac9a5fc4f05a66793963b8350969fd3d2b09566e817a3de7a266a436
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f61c066abf327541bc893475147206d9e65391f28c8907f18214e1837297b25e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6816a6c569efb00047bb9df132b5e78caefe8a974321762e08299fe523cac3ba
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2a4083b153b9af64f6ec98d616386e7ef9c9bec4ef0449b8b2e48a6f9d14928c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5182bd3792b4801f1f523d371975d6040771f1d11c9d410ad296b462a7cbcba8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7ccd209bbb33088293de66b769d56e47c8074da6bfd52d9e73cebcb775635c79
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0d1a95daaee33da277c22576228173bde7ee79533eb9d84e762e658e675e0729
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e8e30da3fd3b5f8512826874433f401ef809abba3698f0a66953ccfeac526aeb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ee21134167d5c2f77f6de5db97c503054c71223708d35c3cb62646e77386317e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b43eabd20841a43505cae607a04483d0a4fd2f3976d8576013d030b6d7f804f1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b2dcaa2eeee8b7070a3951449cf237cb606e78168370fe0014f0db25e1b674bf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 55fa3e85fae98a49e7950e9d3c5775b957cba127ceb2bae7bba54fddcbfe66d5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 419108034ea8bb54eacfb0fc7b9629b2b385350f5cd3c9dcaa15292a7dafb531
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 46ecebc0a65c463ffe40cac322640c0c7e81ad7dccce02356358bb8acc68c950
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7af2f615fa802c5e5a7d5e9a4f2b76d9437e50542a3b1eca211f91f3717efcad
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bdd5456bdb3da446d1ac3e97b2a2f7e660395536b48b7646726e44298ba4b0c7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cc638af04b2830ef2f20a5b64a3c4bea61b984af2f19d9c81a0bd4df87d8a2b4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0fb9e5e0bf49d66758a129101fa885eeff42249e84f12e528462ffc99781099d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 36bd2d3391b82e9c9a21110070eaa29eed80590ef4a4231bd3fe1c8c17b54c49
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 97d23cd338c90c2bc3474dadea2d0a17c2fa1ee50d8efc6b541e4d941224dbea
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a0a964f4711ca484d6f01b21f41e568021c6fe4fd7eeca7c5581893f767c5d34
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ea77e7c8875292647a43a24abd5d932e95552aacf3e7c2368ff089186c9563ff
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 238910639947b39208a7312aafd16abbd6013599b02413fd3cc2a8be1ec05b2c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ddf147fae198f6077bacb203a7d8f8a1c17a1ed5c65c8273b5d7c50c7e2033f4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4d378ebb148ea0cf0b5d21303a6879694a84f5570a6f32c2a4fc6e8071dde83b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 edc81e28cb88954f8c85a113a4ffb913fe754703c763b3db35db58a3f8275320
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4b662d462fb6badf9c38c6f1420392027af817acf53e1cb625ca2f93ac1e63d0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9a11ae6351d6e859f74f0402fe7efdfd48f38b2fc905c60e55dd547e0a371bd6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4c5730c3174dfc961bb625b0bf83882fb252c246d0e04540e35326af70f29603
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fcec66353298f07b6c171a5e340f5d707d77d6f4537b1c8661105fe4d8120b40
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3cf6b36c3e7b94add0fbe5d312889261fa4a5d390cbb803f0e72a1100d1ed76f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 891cda931924ad468bd3c4717c6d0470def744cd42502f2bb5841b6bc8441f9e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7b1366c89f9f8fb31fd3152b6641bf5e0cbd671ca0b86fa5b79d10746609d1ce
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dd673b42f640a3cae25dd6cb408eb277a5f782a638c0687e568f1b0fad51ac2a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7e7b28cac7b8dfff7bb92dbaba2cbd008cf629153a30d032f79d02c7fe7dec98
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 97fc77e9c98c0d8e9b112f27c44467367a2dd25e9d86ad8e468e05b6f2b84a0f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f0a82b2db41d04e3fbdaa6b3bd3011fe8aedc0a7d32a4bf654ddacfebdc6714d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d00dc4b75e8bed5eb79135e972b3a2e15d06f1a4a86b5c593d9feebab79fa796
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9a60f5aedc98875af1baaa323fa9b2fa90deb0bf0991be3e7b52b595b1c298b7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a666fb0eb7a9f5c9fa6f8b41b097167a3a13ce177fd9a743c7282881f65352bf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d8c42ab0e4c793c5d4481a209653ef62567d90ea0fd4062b6e839f56b16ec54c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b0aaf8dc68c69e32fe9cd6a4ed5b1fd0a5e2c05e495c8314d315a2309b304758
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 85c0f0ad0badb652bdce3719777ee339aa3553a066c787aec4e8336260e764ca
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 94c1f01c844bc30350c00dc9f2e037a8e69693f878ec062e75e6d57582496d20
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 61e77c7088856fc6db1797c5329ff8f0446dfb61922ab1ffe7e73ddd7cacc299
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7bcf460783b7ec6abd81eeee81fe3bf1e46c7409a1fe932ccbbc4211e9c347d9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0604c58c9634de31c0a9a93b74844304b1ea734e2fcbe9a366cfaf1e19579ec6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9e973262367055d1feeaf4435818b6415f4a7c4589ffaf08eed45f52d580b597
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ad6fb7d66b95500a5f0a2b357906ee82c4149ca304e1327be82adb6b5a91a3c3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7e7e537d73f6189397a60716ca871d7a2f3499eacb92c6d4d11cfa1604414d16
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1fedd836c8b653fced55a0d45742c890ceb037ec3101bb410f5df141f34829f7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4d2d25d3fa40df6d99615f7944712acece66870303f16b8b7fc970d17c47a8c0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8e70aa1277fa6433bfefef68645919fcd7f25d0072781c102689508c0f69a65c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8091c8861d81179e0519d24d61338c14b84e2639ed98b6daf190969adee9305b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d1cb3c5869f1a1e86aacde465a4cacf92656f120312312f666c031cff2e64b72
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 65b1b641e4b3dba853282663a818890d5f2dcf1e3c3e241c189d895b92b63c0c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 df82b52aac57e9f603d26bdf61711826a20141e6a4364eef0308d0637b428362
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2b308c134d3766e34e15d14486b3bc16a77045ac47912c5eec07c14869b46b58
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a9817f4dc83cfdb3ca08679d269accd8aea4501db032487028597dffcd30d1c0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8a23b2e09c1697618f50dc511040b2d3468ea92738d90658202d9175edf9fed8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cd324d6a16ef2286854be61bc38248cc90b4e9698b99bacbb8cf1f67fc8c5dce
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e5a6290db2e0b147b1473208df913f49e18c6034b7cbfad93e6c842cb83dec10
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 00726f026dbaa1d2e0a021f1c46b2e5a1e217aca954579a28f4d9bc526c5124f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6cfa510c20198a2cf5dab0ea48ce582606864642b3eb8ca446ee89df2c69c8aa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 544576c5d550478787f83b473beac13d9e980eca5670f2fd058ddac19c75080e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9dd4a2a538cbc3f74c8bead7ec75e191f47c24e734d1b5e759233250c55217e1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c1b810661e55197fea68958e745092ab80f8d43bd2b970c84aba45e268b8975e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3078764784158b285a5a85a6e769851346ea0f5693ca1ad253512b408deb1a28
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fecec5eec35395faf60acfac1a3fca70ef70c4d0d1926492065cf15e2cf098ef
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f2697b0c5495eb8709b24df391eefa9f6d51dcd891d62d4607683afefa00d8fd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 583c50084336cf9d3cb75aa7af9ab15c7f84ef76c4f3dc1670005a3dab710052
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6d2fa73cfc8f0b565fbe1e9bfa9ba937d5030c700ce4450f6b66727ddf807fe5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 732e78f92d705af8be85c680d75c8fc353eee2e0c53f5f73539890f145a3ce46
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6f96e9e19ac572a6f6db389c862d17a64e53ac0005acee413cc66e107288e983
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5cf1ece3bd793d40c3b06f88454d44a361f9ee753cd8410c75e94c5c5665f3d7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7a05fd4fd3a524cc5cb9f1eda4a675029eae6c68a3d2ae7f515d490338eabaec
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f7ac8e4352584c5b5b4c40e5a18b875a7cca93f93e125013ac2248d62aa7bd00
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 de71d91ecd8bd6ddbc5bdf3badd5542548a99d338e3b3977df3d47d4015ec951
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e43fa2d790a2eafe3ed6ef9242356a185252d152c5081ac9c78518d4caedc40a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f45ea65025057b7b646bcb0eda36632069acd6940bb37675993d6d274e7a0c3e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cf03dc8ceb007171699a83ea137c952abcdf031742d966ef3ceea508f23c8735
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 716d4e7ecb9bc052ec91f3ffe388e5cc984c920dbe21e72b3bbc3a519a713027
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ea675e1f9c32f278d375e6951bb31e5d440cb567fa83e191256167c80d282e75
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 975b4074511574f2a36aa21272ccbcea3e3cb2e43091196beba31443c1ae7d4b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 89fc970191a2c0441e01bc44afe7708ecac1024f3e1b11793dd6f07759702a8e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b99a7c445f881430c2d68a577d0b17f5f97a368a8ee00adffd05a2aee2e6dcaa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 437ddca71aacbad64e49350f6c5860cffe19cd97fd2c245cb9d7f8e358347f2a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c13ebdb089a0c93c1626ca776ae108ab7f3c064556ece788c7897450479a2470
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 50e4bb893a6120afccd8aac0017a723438f352acd5a5c5b22fd2466eb22b5704
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3065f50da9fddde0ee3b596ecf8e8b47d2c7537344b2757dd6d4bf67d193d911
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 805261ccf19bd2f801f8e962b462d337186202698a134ea30b585f483fc3fe7a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9b49e872ded28530df22092a68bb1fe4b10d8eaba0ae6c0e5ce1e98c49247977
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a3ee775024873dcb2ca011dbd90910721b4a18cde3f64345db2981a4d67dd5fa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b5a0558486c64c4aa52d1f61795903a775f89ef00c2b0e3ca902449e51c7c502
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2bda8e138eab22a4d65553039da0a879d4dbe5315c38a15b681b24a4e361ff75
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a7247633f56cdedc428bc03b7590e86afe6772b5dc46db170f6a3cdad37a6d5c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a1101df984cf0f078cd8e9aed37f58eb46f6f6356f0fed92adee09d9b14b2db9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4db4ff8864af1040d82a178754c3486e1e47ce18cafa15213b3b59064ddcca80
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c233becab0e01ba4b673618ad2ffbb35146dcaea2f19ab07d81d1bac89d63064
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0fb578a874ae389647f520fe0d70d955d9fceb95c43083b4046c4cef5e0b37fc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1fac4c90cc9f904d47b1aa959caa1332ed026f4261e2a5de4d858c15cd4334df
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 513a6c395ac806eeb4062d218d2c7e1bcca9460c5e1053099e2df5846827d971
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a3792d42f0fcdbaca6f2326268e0bde234b117ca52118268b44520fa3ca18e36
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 97a9ca94c1b2f7f0b1411ac4cacd32ce591d6f040e346401c426791616ede01a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f58db96306d7ced7681d8c9d8dc052a484ba294bf8dd0b7b09a1709ca562844d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6776a4ff4c1757990ed7dd29b79777794afd600478fca2017aa7e3146ba4ed12
          • MD5 SHA1 SHA512

          cglogs.dat

          • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
          • Size 15B
          • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
          • MD5 SHA1 SHA512

          svchost.exe

          • Path C:\Windows\svchost\svchost.exe
          • Size 404KB
          • SHA256 6d58a420dede321f638ac8b4c182c2e2df83585b7658a15d6f5d6c4f2314f78a
          • MD5 SHA1 SHA512 SSDEEP

          memory/3392-78-0x0000000010480000-0x00000000104E1000-memory.dmp

          memory/3392-13-0x0000000000890000-0x0000000000891000-memory.dmp

          memory/3392-115-0x0000000010480000-0x00000000104E1000-memory.dmp

          memory/3392-14-0x0000000000950000-0x0000000000951000-memory.dmp

          memory/4220-71-0x0000000010480000-0x00000000104E1000-memory.dmp

          memory/4220-3-0x0000000000400000-0x000000000044C000-memory.dmp

          memory/4220-5-0x0000000000400000-0x000000000044C000-memory.dmp

          memory/4220-4-0x0000000000400000-0x000000000044C000-memory.dmp

          memory/4220-77-0x0000000000400000-0x000000000044C000-memory.dmp

          memory/4220-2-0x0000000000400000-0x000000000044C000-memory.dmp

          memory/4220-29-0x0000000000400000-0x000000000044C000-memory.dmp

          memory/4220-12-0x0000000010480000-0x00000000104E1000-memory.dmp

          memory/4220-10-0x0000000010410000-0x0000000010471000-memory.dmp

          memory/4432-108-0x0000000000400000-0x000000000044C000-memory.dmp

          memory/4432-111-0x0000000000400000-0x000000000044C000-memory.dmp