Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2024, 21:48

General

  • Target
    d2e7d575fb531dc041540c7e9d652c90_JaffaCakes118.exe
  • Size 432KB
  • Sample240907-1n4ddsxbnn
  • SHA256 43c7bcc8434135f5ab09fd28f03faa9927a4b793e913d2ddde1e05e081ac0315
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • infectgf.servegame.org:5631

Mutex
  • OBIS4"ka

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    WinUpdate.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    1234

  • regkey_hkcu

    IGAS

  • regkey_hklm

    LOHG

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3444
      • C:\Users\Admin\AppData\Local\Temp\d2e7d575fb531dc041540c7e9d652c90_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\d2e7d575fb531dc041540c7e9d652c90_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2348
        • C:\Users\Admin\AppData\Local\Temp\d2e7d575fb531dc041540c7e9d652c90_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\d2e7d575fb531dc041540c7e9d652c90_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3228
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:1904
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:2152
            • C:\Users\Admin\AppData\Local\Temp\d2e7d575fb531dc041540c7e9d652c90_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\d2e7d575fb531dc041540c7e9d652c90_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:3740
              • C:\Windows\SysWOW64\install\WinUpdate.exe
                "C:\Windows\system32\install\WinUpdate.exe"
                5⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3748
                • C:\Windows\SysWOW64\install\WinUpdate.exe
                  C:\Windows\SysWOW64\install\WinUpdate.exe
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3864

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 931620851f1b8998a514e66a7ea15d70f8b105583eb036d43bd950a6f12f2c16
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 f30e50b4b92252e9c7616c356b5681e79afbf8be2610c5713ef8d0a715bca712
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5222730fcd90097ec5443e2251c7cc72d5e12146541409514dc18d00b40e4a96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b0b6a0df10a4d9510070c6539b1fafee0b949de162faeb22fe42a71b2497f0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b974d7e5b3b9d3dbdd9ebc3a8578cf7091aa824f62757966c2fbeba0002fe93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22e553f2077e43f73c329e4944e5659a0a0411fdf5d245ace417562289a49ecf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4275b5ea902762c21491a48c5ff4519e8830cddf5b782f91b8297e1abf2099e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae264655f46bd9d2071dea78b269f6bc8c2b92e7bdd6461a5c58064a76ce56d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac0e97cd0cf9324ded2ef559e2d3888461793fe0d4b3e85d95084b294d2ecc9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29928a2ebef07309e557a16e5feecb65aa39ec3e7bfe7050bf63ee08e3b767ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 320a460572f87367f231dc88fa57d4a54f543019833dabe7f04401c80ad20386
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 100415da5d59aab66ff2ee701051ee832917ff862d375e8a0fa71f9a5bbf0d97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47626c2b4afb67d75d46d32474c3db56b41ddf817f9f1a14d6f84d491f96ae13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 536e966606eabf106ec893347ea6f23db573966e8a8cb909cb55d611c3d15f87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1388203c279489ef9e538840edb0c5e68db7190c7a9e6d7a6586f410ec1680b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce63e1c122aabbd2bae8ca68c91afd82dc6c0230ee1aa1a9bc2bae7fdaa67771
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ebc53218c70c969313eba7f1ecc6ec0b5724c4b6535b8c99fa76c1f8213f79c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 835996835da4954200ac682dd6bddd5a17035677984a00989d28b469733ca7b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8de37937af7fd2e835624a9b69cc6629b97418dee4d9909f9c56a9bf419770b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c438fedf23d861e007184587cf55f451ef09f4dea8ca13947ccec16a834437e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a52bc98eef2fdd46dbcf53319de53442181fe0c10861fa550ce9e77cac8eb610
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 666b49c510c396f9e35c141b43ceea8c0f637c2e7c8482d3b3c6b4ee90f5583e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e27d277fdc491437492ac02e3beb9c7111d8927fc85dc2e66ca84d100b2c64e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3bad82f9e686cc118b727f46e3ecddf00acb091ac219b2100f9999b47ea7ea4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 091254baf295cb892ed8aa86e3cc1fcc66361952ceaa46a130edab16d5684694
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35b2ee064936d17c62b065880e475c7db9bba28fe53b5f6b372ac5806c63f5cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5d267b0dbdf862262296f8e53217a8faefba85c4d2402e34e322fac508ad88e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f05fd198f980d3797361f0c4bcff306c82d707182d9e33a5b7522d80d17bbc5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38e21f26374dc0a21de7290e2f4cdf673b65dd441218abc4d700f0a5a4055931
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 875e6563918e8c9ef5e352d735e2c383858a46847b89569bacc2f0a54b16bc7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6baa3b3763f868729f5036635f9b9f4f15b5780959381bea16e2f38ff295e0e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 736c27fdb37e7a13dc9c6523af59fc3b83c7ee8cc12e5c6e89ba6765ae5f65e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 180959b94024e87691c25e6abbfa81e7a5786f53b67f91b0904ce611fb956f61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b326e3ec5ac1e48fcfcc9bf2c11bcc87f9d0a0ddb1c5408cae7d2c940007aa4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93a582d2e9d11c22a9d76a9733ccb47d19adc5294bd238bca4e3fd6d5c06c49e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9cff5310227336fb1b41bb76742e3ab918924ef0fa6a4d20e7cf1de4021d35e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd1ea0878a9c64a224accbde95e1539263ad37256c0ae724376a6645a1f1f635
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b5c2f56fb0f0baa282d3b09befce013ff7ffef4e701c94b8940dbfcb25c6b90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a5332eac0a253b43d961b49949094886cdb02d419f0d12d4f7049ba39bf60ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 871183b4ce9ee1d13483cc7be699a07858d35c9b874699ed1994924bc8f263a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a3bf11119cf563242c3fbc476a3c8f7d9172a39b9f354334e3b31d04d49d6bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e28438f27183772a9309981f943dc01e6d786e009597a4d4a303e074e40ffcc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb31cb633697a41b6f00fcfdcafafb322e36186e14962d5fe02f98ba5b811fc6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b92a0eb0192e7733133b850105aead9ccbca45eadaa21e440628bfe0fad58f91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c089e3525267aeffab65eddc4a3fe9d38d4daae457512f1cf5bb66dd23e9904
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2646d011a44a076f3dc46cae3c6fc296280c77abd04a09692d5bac4287a1dea3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7164957bf4b87ada295daf74c31685bff29ae4a0a4b0579b19112c5934d81841
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ad8300d827c3c27737577bab1832cb0578cad2550beae1703804d357b1e5559
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02e53341f94c9e1899e78b9975752b2bfc02be216e4d2f07ef207c9df840b2df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06261e3481daa80bc3645284804da052ac8e9dc5ca79e901f455f02a3ad0e29e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 306acde0d694d13334db97d8911e4c325e0d47edbac19e638aa7c3dc61b19416
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2138addf736763306d5d56a3e452ade66df544439132092532c2413867456f1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec9fe35e60ac978ca6bd9a7e0b17dfc333f9416063890fb4bbbaa26c8c89ab1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9714cbd1b23cb842cbbf9d4bf518a128fa9778f93e6c145d81832576a628283
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4408b55fc88ad1dc81eafefb38d956fedbcbe92cf1e224c120149ff1c913d05a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75aa78bb74e32c136d90152b6075da24d1471c4b27834cca2e8bc274116537f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d5094727cbf2a133bae2412a8444a114995595d874fc49bee843114afaa36de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 221d382b853e106bb93f9aeaa5fcd9cfdebe6fea88f3f4bb91c1638f8638ed98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b96046b09a725ab2729b8cf807b1ad7458e16a0728c919f0410fd66c402588ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8b96f10ee1df42ab92aab739af1546efe9e02d89d81f9096f53a6860a60448c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c50ecbf2ef99fbd19c3f61674830c948f32890df8af7a7a97bcadf1f84058042
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18762cbbb2e5691c5a6cb09b07dfd0882819127ddd7077e7c1973366af360545
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7b98271b87398d0a949146298b21c5a45a06d7b07369a02e2402837cdfe503d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0a9c32190b5e65f7950f0b1e5989905b6f92f322889b6eae204b9771550bf6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8675af2415b051ce886b7843b9ad29dbd6930e2092fcf18fe7f215609cdc8bb2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23928fe35ed5bb8985392d2237096a7b32e10f33a66b5df1e751a657cc0e2dbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 830209a425f71dc50eff5229a22d27359584a3ec3aef7a13da99a19e0fc94028
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 038c52807198fa4ce99141150c4d817aa5b9b30462e819f59b8e1da4330abf26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d151c21003326c451d6ab7077959c74b4c3db54f4b7af1ac4809fe6cf35be3ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 722a31ff68d64e72a8928c6ca3c2352b461e75fe2069a295b70f27cef8abe9c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9b3c0adb1fe08c0949cc2c3c40641fc5f16509428770b343943126a03164738
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a701cff9f5385e9e14740d4cd7106a539544cef38bd119e6d9194fcebc994bfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 881e2fd00ba162481315432df691f06cd211bd69c10280ca256f508dff498b42
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ccdb789559f4eee736bbb76a25b8ef562bd7c4a7726f421c310050724a6e3c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fbb9ebf532472ea8bc2ebe31bcb52149019ea6fabac48601789ebf261bdbed5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0ce73b0947591bd00573e154d132d7e74981c0c0bce2d542cd61f7359d386b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18c5e8821797da015d3ba6a9a4dba9db8717852bcb7040c7145f32a4984a0a76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a375e0351efb58e19b579fbda06675659bc2ac0ab9e41f945ff961c3436a35a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d4e5bc9ae330853d39eda50c5b2dac889ab7223f4f1f7ba9c94000a47737cba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7303692acf066e5ef9709897001108491e2d1f2a4959d48f1d027629a3584ff3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f64885f3b22ec23b76cff323dc3bc257e1c4b2348d279f87b3256dfa945d8ac6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2aa5466fab05bf65988caaedbdcaf6add76503b642a225341bfd7c2dbf58639a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 965939ea4adc8ed975634bca9ceb7faf846e9532351893b8e6197a6cf14b1e7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7c3aec1d4d8c47e9443560b00163dba685ac6a815987f14d358573a021f2c15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 045b7e33ab570689c1d78d0d73479faa22adf643061affeeeff8a7381bc1cc9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9fe941fffaf0b1a7cf05c713d9a151a1ae16fcef65025b3487fe6dfd54eca0cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29fba095ee4986a990ccbe45a866fc5a9151e5779dd8479849e8369555b2ab20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c14c441146daa4bac1a9590648bf1352733840909856b34f532e2dc52532bdf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c9860b83e8b269ca99f2b206ea0653c4db1450bba02f99534e5df36d9c2f7ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75aa555267a94aeae04df6f0eefbb932d30f3f2e5887de010c3fc402569b928c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eee595e80d6b63f6dc46552c0944e8932a661fdbb9e38343c0a0f69709fd7d8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00848cd4d21a72901dec3d6dbd13eda38e0587a2f410b95a1c7214a0a4492c1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5858c1ef6ec2f5d2ef107eed8fa1284bb51fc9745267ab565c766a96de34ee50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5bbcea8f090d1aba8ac094a646dd24bd6eb07f81a2b882972cd1efc7d29efe1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a3bdcc9d52b234ad09c3c5facf36d6e571e253a94298923a3634a5ac84cdfe6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27ecfe455e14754e6c778fc728f5c569399ada8b172e8c6f3996660c5cd39a76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2628a784420c4c7582dda696a5d097e6f7e440cde75bbf5c8549471a0a205a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a839e4ac8fa365679f6c0005538636a2b14a2edf21f9154986d60bbffe8b677a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8becc7a95363471a7991095b55e63ee734ef054166f9df62e80653dcc45813ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b753f77b9f7a7ce93eca7479be4a218e00d198337369eb808393e44e097b1bd4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 041834ef87a18776226b045cb32fa08d360b54e8c0e1f258ef6f1f8ee1115ee0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8daa50d3780fb1d6c91cb9eb46a555b14e5283d14e52572163f8c25bd58720aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 122815f303f51b1c59ec271de5155cf4831defe2438fec9eab545b3f84bc327e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b9fc6df1a0124b1394057672267574998b396ba706a28f6eb589afe87e789a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91d255c2db8ff6fa13490280e4376047de5da8f2296ef1d540019f0f73bf68e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3dfd2d1d288c6d064139a71cf511df6716efb1726b40d28f868bab7b4be419a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26aed93ae6cae862cd7ca21914c6316d4410a38b33fca6da1ddecbb44d75d805
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 202a11905c01007b55c6cd4e78f4677a20ec87020c6becaf37ad5b3668213ad9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1abc00bdb5dc98c6165f1d14b5b84d373bf4a1c36dff9d04162a5098e3f9dce3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 499cd94cd79a23600f96070ce2e7f66940571c16ab12db208bee55ad09af265a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c39f4915622cd9b7d890bcfeb72ed743c3228ea2b97939a1a3bc9fb8c3572ff3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 710d4aac13939e3e51270804edf4aa1e2c64e2f2ab60e9788f4d139472db446b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81062d6c98dc12b4ece341b125fba0171ca4ef50436db9332658f28c36cd2844
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ce324ea5fa7551f17b6169831687336f65e16e9d14c64d79981bf9299d0d8ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6d88bf107d974258e808ac16326491f16f1e75fca425dd4aaab845a1062d5a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc7c13117b04d84c90067a3288e82ea0bc8af876028627e252441901aed48c36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 382b24a5d87aaaf1ac0a2fb7136b87946b537bdba4dc0a407bdd87883eb40fb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60da9835f2cec56db0c5b68d355905177d3380c4cdff836d1ad0197721119eb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f15589835308589eb1ded75e2a8b76f67ccee62782b3da26931eec87bb334611
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d01234737744a11d8060f30a82f7d3947c4f8dde81f3b809b6893f15b575e40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dc8d448b997788ac8ff0ef4d1ad343e0eadebb0ffcdb751323f39d9f9c62e24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 355568089f8ca6ba22f69ee0e9c4ac390979c4fa34131faeed0f1046c0cad890
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba116f8c78314e680446178339c3386f5fb2fc252b9e3b04ac938a69ecb7b778
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6598c817213b47e98f72b8655cc4618e29d4a23d6191e097ad579465f5db602
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb417f3a91ee9e7c561338c7e3c7fbe649732c112a9daf3923d6be1577022f54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bae6af6b2c99e00ad826c454f75a59035bbebdb822e779837a211a9ac2784ccb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b296d3aa1ea0cf78db7053dafd7413fc0465f70afadbb3c41ad1ada59dd384e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c20916523c462add97b290394c788d8a81fa14bcac871f0c51cb371da578fc13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1e2c7f7c5ab438a6d5f3d7952e5a3b405f3b0873135b43ba2a5399a10ab8236
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a362e17170a6cc9e8cc932be3466a473633ea1e11ddf5015d9ca0ae6b7275ca7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fb00dda2b67deb4791c3c6d8f01ed0dbdc31f06c287f1ae3a08e53a145e99f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5009c2b80b2885783d2e22067b7686dabe04e4dc089a0e8f35341a23f027ea2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c3ee4d11dd97e31043fef67519b2824cd9c7e988ec56f20c97446c9f15a818f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a17481afd43cf9c31421c00abdbe231423e300775c8ea767efa2e05a99b15ba1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9d38ba62cf4722b5f720fadeb25ca960b063a5728fd7b85c18bafb6a154c518
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a9c12fbd85dfec8bd2e9783e401b725e6f7011f280045ce69d3ba65c3c4098d
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            WinUpdate.exe

            • Path C:\Windows\SysWOW64\install\WinUpdate.exe
            • Size 432KB
            • SHA256 43c7bcc8434135f5ab09fd28f03faa9927a4b793e913d2ddde1e05e081ac0315
            • MD5 SHA1 SHA512 SSDEEP

            memory/1904-77-0x00007FFD57AD0000-0x00007FFD57CC5000-memory.dmp

            memory/1904-76-0x00007FFD57AD0000-0x00007FFD57CC5000-memory.dmp

            memory/1904-30-0x00007FFD57AD0000-0x00007FFD57CC5000-memory.dmp

            memory/1904-15-0x0000000001090000-0x0000000001091000-memory.dmp

            memory/1904-14-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

            memory/3228-2-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3228-4-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3228-6-0x00007FFD57AD0000-0x00007FFD57CC5000-memory.dmp

            memory/3228-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3228-11-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3228-71-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3228-148-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3740-182-0x00007FFD57AD0000-0x00007FFD57CC5000-memory.dmp

            memory/3740-87-0x00007FFD57AD0000-0x00007FFD57CC5000-memory.dmp

            memory/3864-178-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3864-185-0x0000000000400000-0x0000000000457000-memory.dmp