Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 19:49

General

  • Target
    d05586d3462869167af5506a8df528e1_JaffaCakes118.exe
  • Size 316KB
  • Sample240906-yjp9vsvdkr
  • SHA256 cda090605756353487efb74c37b40c73731b0f980ec553aadaadf249655aaf25
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • kurdan.no-ip.info:3436

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    svchost.exe

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3608
      • C:\Users\Admin\AppData\Local\Temp\d05586d3462869167af5506a8df528e1_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\d05586d3462869167af5506a8df528e1_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4384
        • C:\Users\Admin\AppData\Local\Temp\d05586d3462869167af5506a8df528e1_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3372
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:2948
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3288
            • C:\dir\install\svchost.exe\svchost.exe
              "C:\dir\install\svchost.exe\svchost.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3756
              • C:\dir\install\svchost.exe\svchost.exe
                6⤵
                • Executes dropped EXE
                PID:3812
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 540
                  7⤵
                  • Program crash
                  PID:1668
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3812 -ip 3812
      1⤵
        PID:1200

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 fe92770ac089b580efa2bc63832d5a99e93a8e75b0aed43e0e3d2d277d4822a0
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 6fe639bfe8d928491a3c3381c837924a5ce7c0f01d57f38c990edb1c9c3033fb
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2582870280890e37158f16dcb888b6d9afa0e14e05757f6d164c33c20a38ac1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9295e4d4aff5b2a5a83894b7fdfe7b36f79649c91d2fc0d81c9d8598846f3808
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d6d41306fb4f12f9b8f91447689430bd691b192534845811bb99f48c6b8f94d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66d3ad5cb9502e049736e0943fcd483fa26924a6a63fd36a08d4f52b018e5e63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c06abf50ab1da37527960ae18134feb980d94cd369b0ce097100d3f56008a0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9ea2bb9929f88bdc570dc5e83e6243dbeea4fbfe2c47ed5272396854becbda9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cab6fa7a345144f01c77e22f5b5a4816a6c01d15b60f2238d06cc3c5afad977
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3e974b69f18ed6084437ba905cd5ddaecbf557b572a281ea0b35edff320d0c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c8c33144fb00040b3310c1493ca3e3e3ed2aabe1b9c927df9ece87f615173ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23760743cd0d42e89a8fcd5d7113b5ce2ded4af7979e9048583cb7c955e1fa2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c174655066c78f5876eb82d445aceb9d80263f1d245830c2beef1a92905093d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72626b9886b3e99ccda8bb66236c168c5026ef6d42f53d69882784d804b41d9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b52d50ec9d9891a228107d2be242ac60756a4bb811be1f92c071a2240ef3a719
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2525b8fabdee51fe97f4fa63ffc63997dd0d2cd84898382b53d98c7fd5948683
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd05e844b3b2356d4b0cf1c338ab9373f097cb2d8bbfc0c7d4bc0616f2120eb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f4038d51c92ce431a13757b9bdc2a5bc009f25f3ef741f9a579941cd14b839d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e02d8bd71c1d9ba52fb20e218c71a42196db72264dd150d8fcecbc7fce0f00e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e7e9c0e141f6ad7878c3c35dc31980b6ba142d950c5eebfbb52c5f519ba2c66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b88e8286ee582382b82076e468f1a52592508500e3e8e29b226a5c2b0a3d8a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8a48e270a934058ee4a39039bb99b1086f475b21159a1a889b0b03e7817f3af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fd0cc8606b045fa5cf938ca13463e8ddf001be9a6846d05ec06d8d743546a98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7b44b1f5284bf82461efb7297373a02e32db42d888777b1f73058a8c38cff58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e88c649eb106f11cbb73472584bcf6ee5f28574930f78c40017f6075852e65b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d286d08ea327c8ab759dbdae46817954765d0297fa7ea85c88c5e0d9fd70f12f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69e0bb8633e1377e9c44db9446ff4887111072891406bd4b5f7b99701e0fcc62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ab24b7096cd3757b0af139c85e17f50a9b0c1e6a30d0914d559f5150a8c334a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 caaec841d8bd074749f3fd251a567141fdfa50b3563d4cf866275547abe008ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af38fb82ec3ba7e994cf2f9e142a76939732e0955cb205da188995db788fc925
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7f218d3cdbbaa5d983957e034367c3ae60241d400c086959aafe65ecf584d02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f20ca75aeb69c2c94bec4e5047d615fc077521c2c2ed3605a2451c6993f59e70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e82cd349159f9c0445c3ee6e121adb98aa80f68328074331dd163a5dcb5dc96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d965063ce60bac165eef414ea80a404f786a4647c6240228f10568dac09b2cdb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf99d3f92fae45068c78083e8f1444aceff81c6ca761892ce516ab89ef15fff8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a140c5f85c201bf2524a9f882ce66f50c94690074c1a6ea0518477f2470a37e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f340bef08f3b926c7cea1fc75441105f3521179c94f9058ecaa1c6b99c5403e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a8529afc81a5d36931bb82a178304c6b4ca9ae4f1f369c34d1a8fec4a379bc2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55cabd868d677583f23ae279860c6461cb3a3c3d25bfac6ac2808d157abeae3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8058e4f02262365aa0d3c153f1460998c9e484d84686aaa7448670cde5303169
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42290c79e8d6fc31f9436f3f328595c1057bdb281ba66710c8861bf183ff47ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58c5fa28196e147d996e32a0eec98136ae44facdc0e86eabbd0ee3adcc5e6794
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30291cc855240ca5141d400baf6f1d43ec971e0f36b2f5d5b3185d83a9076419
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fb103aea70c53326da7a1d0cd8213476abbcef876c5915c7f2f45d71c1954bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de1ea648dad1620cae1930a515ef9d1457793081947ab943aab581e2fc3fad64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09b79fbfbb244401b2c2960284acf11f417a7eb73ba42249f819587ee61bda68
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5226ba01a98ae9697e541ef6ea9972e9c64d562b8d64dddb34afd1a8925be7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8ecdc023bb1aabb2ab1a6407846c8e242746acfd14867ffd3d0d00841afbcca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df85164683bfdd4a3f78eec4b057dcf9bba1db48293c21eb4d78d326f31293b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aad11e7cff69d7cc65edbe7ea096763ee117e76e2b5858a5d3f102c9fd0a5efe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c8c74900961b99e94decc93caa40e4c856514919ab843d386aded977b0b24f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3cfe6a7def314909b3e54e9d1d73b6eb9c39a70202f65b1743bffcdb0acd2b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd9f0e4181d624c5f68719f17befe7ca70252ec948c7342f1f10cb45ecb8473f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4db8d4e2a549b4f9e959f322c20fd5de660b4c6c0f0889dc6dc9ab8837731227
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0240f56b09141cda07d35f6fbfc4ba184a9d99c4d61a5ef9f4967f421eab726d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c77f3dac546ab7dd624a656404aec43a1e59fb9537398dda1b99a03d15f2cd9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d4c6db9c46873b712d3c5af3f7a794a4d9a456b32f4122eb414bdc48629b231
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8074fcac41fe0cfbac3601ffd59733ad9d92236124c63658b0215919ea3179f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f065658bb5150c077e8afff5dff40692de3771a79bc7e60a93c56a8d4190f0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c4f19145dd929fc51df0cce2eeb09d22abe78324c8b1b5811e196148354a529
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c91bd8f939d8e2c28e67ade51dc31221e9aaa1f36686af264743ff6afdaba465
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b388f1ff00d2552802da336d99b2836a5901c4341d2335325898f62d793d7385
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adc9253f960711262a8f9137a5194d59353e19846ce187788479c193b9c58917
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 710bb9ca3b05521a38c08ac9de9da3b3bcb9d473ffa179072a54062e50486839
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ba2e004f7be9707293bfc2cb7bd00faad13a95f73319b6596aa7774d98278c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8172acc3310134184233919c0d2949cfd1d3389571475468971dab6eda83b762
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76e861698a399c0b05ec3f3ba4df7791dbc6d68d7d7de3a916434cc1c75fbeca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 149ec5361bb927f3b11f6ee3b70fa39d2c1bde53d5608f3f5ba0ff664d67cbf4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df26f8f50089da77d249897ea5476762307aaf59a9e01b36a6f32cf993d808fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ee33c4fb6835f247357221f4292874ddbfcb9ef482d2b73cb368e4b7e01d8b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b71572d15043e147b7c3ded5195b1d85db35bb3b31b7a1502e042cb9e648864
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4edfd650e8ccd18b719560de730e795ff305e54a2106dd7132cea6c06dc1fd90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55bcada1b81b167cc8f3dea501caae5dd3e70a45bdf16616ca8e8ee1134068d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad960ffdcf3b80c56630bdcf1de6ed0d59f3d252e48db4095207d1615175dc04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9657fea0b382a228fcbd31dd659243231c97f114d4eab34a8514979174871c76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f353743056420bb543679b065ae2311d4434589ba59e00a1cea64975b3c66e98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34d3040813ddb7c612631d4c3f75d852a18ffed6737904d04883e02d91802288
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a826a52268f6840edb72a7cd596622bc05854166680682b6a1eef05abf871f3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f6b52574744ca61f4adf71e7886d24a81d07cb0217bcd0b9944383d03ad6602
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6fec7a8d0e56449026a9d32fdf6baa363e60f7adcdab646551e5dda9e4dac457
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e984ddf3d65e894d42f49f9d8bb2caa38c79c268a39f79c5f52e3ac9feb356f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea60fb79efba7f77582a2d655dc69387b396b295dd57fb2ca319075ac9079725
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e10373e420d60405b18759e064b13adca145a5be027b2089c9fd5284cb845b70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1842bbfb9fa9bf63ad39eddfc7fcdd15645bf42145316769585fe96ceeef2f23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c9f032c62875363266e301b41c3d5473e6b65764ace73d7626de204b9632f96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11e7f697c114cb54563c0eada5a5f9d63e40fe0b1f65f33ed3b79fd422ea45a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 508eff58834135fc84b87636ccd2cba668ac8eeb3f9eecc37fbaf9ebceb6d26c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b267976c9c6f94f0666f2932977a468102dad8a44288557cda867220b33ec70b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 becec72913d1c2f554c231cbc3c69c2370ccd5a63526af683c06c48855bb3a66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa3f0f52ac5d82c881f42b74f0e760beb50674a83079345a5cb3579fc1af790e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8027e8a4a2cd28abb4af8b632a484f7b0bc64addc7bad66f8235fa254550fc5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e607b2c9d9a0cb86ed9342de1b09d602d0e4181ad81bf7c49c01fe9d9bda4a62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d567e256025aa9c517b7f0227e1910e7a1e37f5e868f533d7c2a92d764309893
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2092c80b80b5c5b072c3df527a1d51b71f21d2c067b2567fde59b6213e3f3e80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d62faae132bbbcc087f0c84e2f7f46d92cf346a8624b7bcbf45d36b875096551
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9fd21883e20dc9a257255d75b8a970770328efcbfe04978ae8f04108d58ff1e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b766c8bbf65b8350c624d8189171020601c99398f1142e6cb6fb26b22b4cf877
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da27377db513aaad19768f85748d76be335dcfd32fa267f1308ca0e8cf8bd6cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27f4692f39bc938e036d9d935ba0fc54c19b7e940d5e9fa72fc737bbcc8073bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2188f530ee06178ae9a2652c8663e8d89545f10a15374a1b67924791e4a9005e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3044a95dad7d5747b7c708c6c5f1921ff5e70cab78904c5277a998bec84284b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f68ffba0a2a78f94d054284d2e397a4079e1d025520c5f495ff8e5eb25a58af3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a91c5c0beb7dedbc68bcae7600b2d8fa40ed738ca7bda8b44e0987bee31ca7ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7f12d88eca87158fae59ced2db9d4777462ea4e4e24453dbfd8b4199da117a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97b13cc283f889a5f5db12ec5b8b97bf82435804852ce540d136c3fe269f4ba6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c14695241504fd882dbe311d50b8fd8127ccb85f25c18924b721010611022636
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64ba5301ae5f9375ce3d25c0ff0d1b6f4fcc2759484dd04c9ee37352e025a363
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c62a7e23bd4ddfcea00118ead90ae7582d242b2411185a5474c6197e9ff1e09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23c7827975d545d0d9fa80dce672d5f151615657ef93cb038900aa72dcdd7445
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6de0230f25abd902cc70806722733f9fe52b832b015cb5845add8a888623fae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ea1bdac2faeb2267bcd530cedde3d77f0389a7e428ee9f2c97e248f80b86511
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82d5a729c844a5cfb6d33d1f12390ee6d0a15a8fc9ff3db5e36760481bfdc69c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db554112e2ee586c28489fd77823b4fc292aa7de084230d67615962ec75bf3c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4dd350f5e0ae3c5191a365da960cea1b92fe61e4dd0bce171a99c399ab087dbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 374c91d67dad830be12c43fb9fc939bc4f65fe589092fcd3e8edc72780eb1966
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed3d949e48f09d03ceb283360e609b65f9443b4b6e60844b5a98cb1b7d111247
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c271b103bc264b03472f6b5d0c14ac16e9ce28ed59217012c119dc66bdd375c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3d53d507d453062380008e763366f3e07108a38242e438397b815d724bb18d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e35b1110621e746e7ec2bb6aed93181e1263e2a5d9817ea712fd6c94a68b5c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49714ba04d7b27f212829d65b158445e07434ec9102464e00242ddcd7a5440a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5795bac519db24f959a9ff136350a3f86e7b5f9677c48a6f94efe441bded05e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af23672b3b088f7936a58d05de4442dcdf49d0089b3ce759a8d13c28319bf536
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33bef36c598c0f3d4155ab385d06c4863891b60ef470221ada50fa290a3934c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04b7be605794198417916198496812acdad08e8d1294be81867f2a372efffd7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 472bf6a4aceb2d20d899d2e4e72ac136bbca2abb652cfbaab778ae5a485e758b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c0d832f55523a0d882436931b55d57b55d5982380d641c1c67ecb7bb717c84d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a1cd26598cb7b13267a45b2103cf56b433ce93a81b47fd5123e1eeda0b16af1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7515d6eb3a19d34d39630a582b861e1b9ed7267259e1a0875084e7400a2eab6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f0678e2193a577d22105ff7f523e9498d5679664d72391aad0035265d2a3d60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e535d3cac76212293d4ace09b5505e74ad56045c20ef6e7aa9fbc1c582aa3238
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7a3dc57214367f12c89041cecca4cce41b6106739747053b890d18267a86247
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54739fa6ca32d58cca0b3016590f01da56eeaddb3e301cba1f48b0f44a1fda53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99156881887f25d0825a4dff8251342357aa8a287856000cf96fb0b4585d0e6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6a670523eee997ce290c27f1838dbbea644eda066b487a11c39dc924027b48f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8f2eee7288138b0491ac8ad05836d95c57269a6a56213141440b7abcc1971cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45661f829999d32dd457ff6b6922e24f12f46d59f71fd718f8673617f10fafe2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7bef5029dae0c710f87090e9d0832abe11009851e44a22d943f6b4300d8766b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6a40766908786699c1fcd7ec3497efdd35c2e9e406cbb5b6a3c2afe3c6b3de1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2633661f6e83a7159ecc20a8b873902a7ce0a72ef429e43df7f6b7513ae4b279
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecbbbc6737f395eeffbf840a4f6a9a62ff1706f09e575a83619c6ed73ab5a94d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a27f33ca985f0736308d1cd6587fa7475ec6dce714b43b9c9aefdbfe68761f3
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            svchost.exe

            • Path \??\c:\dir\install\svchost.exe\svchost.exe
            • Size 316KB
            • SHA256 cda090605756353487efb74c37b40c73731b0f980ec553aadaadf249655aaf25
            • MD5 SHA1 SHA512 SSDEEP

            memory/2948-17-0x0000000000C00000-0x0000000000C01000-memory.dmp

            memory/2948-18-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

            memory/2948-79-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2948-181-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3288-147-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/3288-185-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/3372-9-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3372-12-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3372-16-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3372-146-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3372-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3372-33-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3372-8-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3372-3-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3756-176-0x0000000000400000-0x0000000000413000-memory.dmp

            memory/3812-180-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4384-7-0x0000000000400000-0x0000000000413000-memory.dmp

            memory/4384-0-0x0000000000400000-0x0000000000413000-memory.dmp