Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/09/2024, 12:53

General

  • Target
    d467d354d9de3253b8c9103fc2187cbc_JaffaCakes118.exe
  • Size 325KB
  • Sample240908-p452dazand
  • SHA256 a661b06feb97bbd02bf26a03a2f24fbd9a004b01c3340f724775fd75cd438271
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • madhack.no-ip.biz:82

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    systen32

  • install_file

    svhost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3440
      • C:\Users\Admin\AppData\Local\Temp\d467d354d9de3253b8c9103fc2187cbc_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\d467d354d9de3253b8c9103fc2187cbc_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4672
        • C:\Users\Admin\AppData\Local\Temp\d467d354d9de3253b8c9103fc2187cbc_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\d467d354d9de3253b8c9103fc2187cbc_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3884
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:2660
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:4548
            • C:\Users\Admin\AppData\Local\Temp\d467d354d9de3253b8c9103fc2187cbc_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\d467d354d9de3253b8c9103fc2187cbc_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:1184
              • C:\Windows\systen32\svhost.exe
                "C:\Windows\systen32\svhost.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4312
                • C:\Windows\systen32\svhost.exe
                  C:\Windows\systen32\svhost.exe
                  6⤵
                  • Executes dropped EXE
                  PID:3748
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 544
                    7⤵
                    • Program crash
                    PID:1564
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3748 -ip 3748
        1⤵
          PID:3828

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 74f77bfd3c0255ae2cd62a9ec91b8ff73729f5de189b150ff242508d5dd0a366
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 488e76dedda7ffba1bc60e8fc5c6657422d08f55a127fe68b39a291eaad56c7e
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e73478f2c8317c462513cc19fb13467c92d8241124115bd29ec007d56f8263a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31a7f31b9851c8bcb721339806aab8ebeca1be738df8eabc17e189b37fc24ba2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec693e2151ed2722f040fa9f6381c5f8daebbc96bed866820d527165309a1b61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d58854ba0ce40d324293187761a26e0b4d7f0d6f00d3c1fdd600df7122dc552
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c95bc81ae0f693ba98620396a4890214c8c3983d7a64fe392eac2f73550a1c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1049f11e5ef75f5b15b99f491c44958c49b776b2adc985c2eaab7da1f63fcb69
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e86a8e3ce97334624fd8dcdd557540898e8085f5256c2b610dbdb69d5660e21
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a309d6e5e54b1947c5a112ba46d02aa999f69f05aa1cc0af0a8265639b3da87e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b864092135773ed8a324684aacb14f7c9e8e877c0c7c97fde0d19579b8ae5ff2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b1a8549feb202ac63927257ff8be977d907ccaeeaa7a1b4d85c161ab7dfd1dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c015e55aec8151f05efb68557654d6927a09dc497057ee5f72ba51080be5ae06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22db32f22bf8c6100081f4484cc16d61e8f3e6dad0feee1bfe0136cb88c4b08c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b0cfb1b9027db92d2398fdeb3424b254a650d650f1e94fc3dbc3a30e9aba1b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8256cff828fc05a2750b31f550a0dd3deaa9b9a21852619bbaa9658d47426041
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e679e1f9dda916afe120b176a7c5bedbe07bb1c9b6ba0921efbd7be74a640e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba969a483f71a934f9cba9f48d9741090010cb5b49d75db55780239f0811ff96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89633d804004efd3b850e49a5f30ee84b3a53bf7e54bc3b456720170d87e22b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b07040604c82d805fbd2e4212296d8642e21f95362b6fa560404524434af7e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5f5ea9d33b96edd111c6f15011d86aa6d6f41d37878edc143a174dfecedd0eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38398843471196d3df77498e600330a06e49e6aaaffba2f826bd464cc798e59a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc1980538b18a5f884969be16a0d440bcf5e1441a2990d9aee91d28133b5241c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 055b5122bf3aaffcef4e2142d506dcb2b331a82deb6b4975ad40fd2bb6db86f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c31c578b827d8aa7617010ccf9b6c96c59ea065802b62880196a85e448c8ef08
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 845d3b28b40ccd6c9c7b94139a9517973d39b6430a103989799ec872b2bf17e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65a03377332c980f3d039dc8a9205725507cd41f9b9f52e57e520177aabc8274
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffdc34625e2faea7dc12e322d390de69d3bb59286b7c47f464255cb0953404c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd7466a152404aa39d9d06b721127e140f7108bb7062857aad6c5fbf1fb883d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4521b365d7655f191621ee1512ecc761508e03d9e92b42e6681ba49e50579f1b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e14dbeed09ad97e283004862263e35f640e3d5b064cc42d069859ad99acf95b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acbf73b86d642c1cc55a653c34ed566d1037a728ae53266e04921b92f866ed82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f9fb8795b7f476fc182054e843e3ccc0ed9047ec83aedd31e485da557a1592a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d99782d1274ca902d7bd92e25d2eed7e7d8c55cf171cf52ce8a68e39ff4edbde
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e785f69c17acdcfc115ffdc627de39b42ab12ef396e341b0c2e4d1adea46770
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46982a6e3626cf7aed8f783aaa50eb74b4ad08c620a77483b573cc224d02a0ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 781fcd4f66f339d7379f87aef7cf6e015c6db71cc2506a7cdc9675c787a09ce5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 340ea2c3d98062cd5b01399abfa0062d050161e62c240a0e2f705d077dbe8916
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a8588f24a74a4c40af5971e62912e6eec8440ef6832460f9139574b43b81b4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e44406bb89eca2cfd350a4ffbf3b8c4072adc54da85da0d3a50fd36c1ed7cac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7b91f24e1589d33d81d018083acf2a6a7a6e7a5e0ab2146a76aa9b6d51e4dae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 687427675895f5b6d1a98c9c1b5a225ccfba10e4afef37eed23d606bf48425d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd495ca94f1484c308037c21ee4cd3c979a973c1a8f8f761eb19b649d8b0f4ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 19b7e551a979229cbe280d0d04368c17c2888c8bb88d3df8c441ddd1824ef512
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b98e0bc7f57ba21bcf32f4070316b13d0daf883cf7923c66a2ef44006104f48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 180351004d1b4b8d270ff1d4c077b866f829be91609b48f90802e9fafe3fb1b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 118a71a06ef50349e6ecf4a90c0f516e49de97aa4c0de52e0806c7a0879a511e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ea9b172781fa632498f35b95597e0aa4d8bb78b759cbd46f3600fada7bd60bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2e47176e53813b873a9246f7178b64c1e9bcdc5a484e02d31862d510230e8db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5560babbb607e77bebb94d2fbdc62d0702d9e47ffdd72ceafa2d386bee289364
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c55354e19473d16251b95cb4a7b5af20656e3662ae55a9ef7751ac09f61d79ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 109a1a71fabb5665402235b5e06b3461865f1a08f8420ac2351ff94bc9cadf53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da9aae971ba96e5968bccb589eefb0c73e563fcfd967dda9c7394173e921363d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48743ab7898a1cd02b20c156901dc062dc46de9ded4ec8df92a0a4f240d8832b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e85ef894b6d2871f883bf918a7ed39dcf1f901b0a08e8bec4242fe8f2ce51e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b49dfe1d5df53b9120f5b3b2b5080ca4cd8f5f2297d754fc0c836d5e2b7e9c8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9de906ab1c3acea2b567994b12dddde03608bfa0adbc351548ab0eaecc035c1f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c62213206e46fc85adbf7013c2a2a1b8465bbd55031e7349084c24fbdc16f0b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63e646e6bb0fc262127e11c995b98f89b9c73638497ed73ac1bce6656fd3c80b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cf3d55af0848f82144cd1fe6a8ea800f85484509311c6eff5d1fae56d55bd65
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60cc1f1de63738f418c385db15d228352f0852419652afb2a36bd7f08b518a16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba7f6f4eb0e7c47a677b0b691ae041e8723e8e1472220a4a632db681b3c7a360
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f09d0a6a8f97b6b6232a0b5432a34c550b5790d35b53ff8defbc962d465408a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33382aa988cb948f13410ca23d497176fdfab35a55284b84535be5aea252a828
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ae0d0bde1612ffb081d53136fdeb339707bb1603df0563bcb30481766187c518
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13aa697882cf86b54d292dc7028f883baddcb6a9e519f93edacd16e711ea01b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa2718d65f06bf3c048f44b4fc406281f800d536c876475e6c2a49012bc6c604
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca17e8a3299ba871543161381f2d3d4c3273503b6b6f2c0258239e1d547e9986
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7747b6d8e47b9912b143b696b6bb0844cec45b2dc54f1fded5c3adb754bebbc8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e027da8e0fd23fcaedf56cd957d6bd35e57115229c55669aa153f53117f9d0c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 655d2fd5612bff1aa7ad14a4ec6df00df1f47d48543bc42043da45503df3399a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6f1003d9d8661e81bd7b0821e5212f657fcebaf82771b39c765f9b819e9e7e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f327486bde3abbc7ec9507d4dfd51201bcf6de94877b1334aeb95ac84181346
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3d7cce64cfe5ad26f1bd40cc3a47b82838f8cdca90ea15dd54848d49c40761a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89ef70efa0ab02fc96fecbdffd96980b8b1341fafe136ca187563ebadb069d44
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58e40555960b8dca6801d7f91eb3c4b4896d47c3ca48a59acaf8c8516d9477c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e00870547e6ccf3cd0e7b641b09552b03c8872f0b30c812aa1299409c9cf13c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6cd7fe27f0a5f36b1ba3e98e72fa63d005412135975a4a1472b65e974d712bea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb26d9fcd6d2a388bc053077268b4166e365260a5bbadb57e22d7726e7e58173
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a81f61d098c940bdbb4273c56279795710edb70aa0a3f48f3da596c09634703c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f669ba316842654619a24ee30db1a77f7bacb73dcdb4748f83522567a16db50
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 777c7a193a257fcb103d14cd5089a72202446a4a087c07135c996a45769c26ae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 128eb5573f935daef10c15975ac55f4778507c40e59bd5df3ea97a0fbd524e37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1458251b4d683b400f02863eab6ad80bf1c925a55646000d59d7ebd05ee6a100
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b8a5adaff336a6c3402910129f6fff65e89c7f37827e89995d039a25a335402
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ae20389497d0234f8f035f6e649701913c9c8be2a9ce7ea8d3ceec7501edf0f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 03e312d1912f15926fac62c1add8004bc46b94ce3952e46ae7c9212b33038279
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9b722f3862570223bd4686c0d7daea57e098d744f1827bfd98c90b640dd324b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f236bfd25318d481c59d9dd5e898678d7ec2f0d2e10f1d49db1a579038ab3b45
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab3d8e87d995c1b0d9c5150c8da13cdf36e40c5d962dc82bbcfbff7aec2a7e41
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb4069484abb4a0da149a6d45ddde2fb2054995172643c4c2a5a84638740663a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c196ab9d2a26c4846717ee79beb83e0ebe0bd04f6a72950360d211cbe3b54d8c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b81eb38430ec20312d5778a9c64a038beb953734ad6cb97b8308f5a067f2ce9d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2964c8a52d98c3801e7cccfc750dfdf6b798cef5f6cbc2e210bd3f46e33af7ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5663842727558142b0a5d2942e220d8d79e855e5802dffcccfd3ca604c58e993
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7b57bf9d1fcc1533b3a3b2c3f53bda801951e9d7a534b507143d46ae9677ad1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3d95aaad6e7658c8c7749a1ea7897a05ce99f842d3fd90c71ce171cce2b8d82e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f16177d6dbc8c848b0d845c7e84fc6c97f0c950c8bbefae5b482e77af0f518a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8affa07558a2503c0019fc8b288c6970bcc24bc1c070b70e2bd094400680072
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5f2b7357ba9c343c20f93abb757582e8ec428757640ed0abb9a62703cc3560a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7b12d95309d48e0cac4e635c8dd5036d4405a4244a0cec6b9389acef1488548
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ce86855a3c1ea5adb9aeff2d4a3b6a557330142a93694fb5afb22254c461c2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 011ab592dd6090a929555fd128938751fb3f4ddec318b5753593c3600e1a9937
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 144592d53ef30ee0344244a442471f977b74171e68b8b39882102ea2ddfea024
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 174b334b938e23d4fbc4e11745a5faea79c9438d3d2b6196a935200b530fb8a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70b3883abc3f9dbb24b47add11f9616bfe12e51415eeb0ab8ffe48d7d0022441
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f9d03e6c36e0e5e43613eb9eae31a3cf6e997707253f577d726f07eb0210aeb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d834a5c65bc57ac22a09506cc672c7f4abe9ad0337e780ba5a2702ab46d706e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ffa7cb67cbf1da75a4aa380326b7aa57953cda2063bcdd00c71a2a658557493
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f95d1757a7fe698c8cf8c90f4faaa512708dcb5bace46e5c229290c20292ae1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6641050c76ab2520ab7b33ae1e18bf8e477411211300a0bae4992d0ced15d1c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93575dc980af5610809baf5fe21a15deee97e5eb9f0eb8cb889bfd9ac517de5a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ada805f033fef51345f9935f6899f0ae45b2595b845cec6c1b408957e822c372
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 561b1dda3ce54f5112172dca18994a233bdc116c0c2f076902e3990d56863b2e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 023ee8a4399b912b38a6e90dad92f289c08e1b0e1b47d4c18477a696600d25ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 860598e55523b2fc372cfa40d34fffd9dd8aabf9105187266bf204f1a0cae88d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e5a12ac5658774e767eb338cc0f49a144b63bf8d71e5ae39092a7e276ba23d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72bb10acc3796c88e47c5d007b80855231aad6e5a481c8c1eebe1cccea037159
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36c0179c6d60e56fe65d7cc3feec703f0a2015696747459ff1ef981a0f1a3dfb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9f424d9a785550f72cee87c0f6ac39228ef79df105ee46566c750a8e05b68f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b33e99dad90eb5f4d195db6ed7dda711580369843a738b4e448f2b1c7690b86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 687aa68b06cf51e4bdd65bf9223b26fd2364e75e00bf94514d4aabfecfe8ce2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e43f298363e66a14479b588403234ac4b73fb78500987669bbda3e735a0ec7a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4a0c298b4d7a23163b4bb7dcc7febf5bbd79e2d9f9e90b9634294cf6e4f227b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4d0c5f70ab0fe2fcfe4bcc769fd36995dd06f0b82890ea514b5a57031ee1ea3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a55424960ac85d46f56180bdc6f0050f936c7c83125b11872c9f14e95f1c002
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ae3333a48dae8996d3c136cb4fe60b506978d4bd70356fe0cd66962774dc88b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c4a49d2bf552295d8b41725af5abb952d57011c493b510d2710bed384ebb9ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 61943f7d9a23e92fd55f9bd99d676570e9c1a61e2b87d047566dfd00309272a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 910935f8873b90023214c731572553ff2925ad064278d261958b6a023fcb1faf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c738b974a7c7d78d1806a62666c29cf7a69917d6e9e1f8828e9942bdd4adbbe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa5c9b4f6f9a5de381c4d2fb33aaed25b437a183172b8a71bd4d9c8eef8066f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 96c2d4852fa169d5896fc94bb31c735d2d4a4c00026ae41bdd49c0025cc77be9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 340038a4e1d403d2c29152496f87b4ddddc830fdf27a2043f44a6d458f4d4607
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a85ff8014a44d6d42eaa4aef798966eafe16abc1c4b82e80211289afd2d2fedc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 637690edf178410d43b854ea7cf908ad7ee9a177a9a6c85c51474e48a0fc3ec1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d94975a8a96a3e5a3864d52a539d3abd4d4cfc20b4585054f6bd5000a165d3c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e6e8f87215920b69248eb099013cc10926636651ce48f23d341f8acf53e99f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 96014900737f1c7c2db31de4c6dde7fc6664cb789063c9813e52fe34b1d0f73f
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              svhost.exe

              • Path C:\Windows\systen32\svhost.exe
              • Size 325KB
              • SHA256 a661b06feb97bbd02bf26a03a2f24fbd9a004b01c3340f724775fd75cd438271
              • MD5 SHA1 SHA512 SSDEEP

              memory/1184-147-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1184-182-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/2660-14-0x0000000000A30000-0x0000000000A31000-memory.dmp

              memory/2660-15-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

              memory/2660-36-0x00000000001D0000-0x0000000000603000-memory.dmp

              memory/3748-178-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/3748-174-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/3884-146-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/3884-10-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3884-9-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3884-5-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/3884-6-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/3884-4-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/3884-2-0x0000000000400000-0x0000000000457000-memory.dmp