Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 22:18

General

  • Target
    df002e556aece11920cde3f7e7cb112b_JaffaCakes118.exe
  • Size 336KB
  • Sample240913-1783zssblm
  • SHA256 78764b1be72a82334f06946dfb0e6b834591c0e585f6c83787aaeefd4b8af54c
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • oww.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    System32

  • install_file

    cftmon.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3404
      • C:\Users\Admin\AppData\Local\Temp\df002e556aece11920cde3f7e7cb112b_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\df002e556aece11920cde3f7e7cb112b_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4216
        • C:\Users\Admin\AppData\Local\Temp\df002e556aece11920cde3f7e7cb112b_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\df002e556aece11920cde3f7e7cb112b_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:116
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:4204
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:848
            • C:\Windows\SysWOW64\cftmon.exe
              "C:\Windows\System32\cftmon.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3992
              • C:\Windows\SysWOW64\cftmon.exe
                C:\Windows\SysWOW64\cftmon.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4464
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 564
                  7⤵
                  • Program crash
                  PID:4536
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4464 -ip 4464
      1⤵
        PID:3900

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 c59a13db003b2374ccc73df5797ea2880e409a8098753d09795a86922e7001bf
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 82c1d4a2094bdaca928be49f8f3a5f6025453486fc45a54df943036e2d4139ce
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e9e3e22e9789814b31a7d2b4b0673c6937984b8f338144d0037b27c0632309c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4caaf30fe063fd418fca175005bb49d165404e671f91cccc70060f4bc691345d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c8573d82d016a9ec815398b9118ca93b0833873ec0b4854efb0d5a1c2166b16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f019b76b6a1c8af81525f5a7db79b46310990c802894ede77595fe3df1a47b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b3e1bf1cdccf52cdc1efb7fb47ad78c5b0ba69c58d3281145b9cd0870c8f1c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d645e52ed43080d47f883dbc04c10166a526111f3f65c12fbc1ede25262458b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1803980267c43e21ad8b689e7d85c686e6ea14b5b699e1af93c36de487d796b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c05b74d7c1a2bc81f0a78a0b142f4b7d683741c5cd56488990a29ca84c176a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca4729e36d3edd9dc7ba115a9b928b1166cbec3bfaa358c27e3ffafcca87f259
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b852526bf1cdcb67d4ee3b09c3a04c2c2e8e9147df28cba7402a23e7ece63106
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8da739dd66cfac09bfb5533d260b73e7836f19817699eb0f9c7e12caf9975f1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37d482724804985ce0af3cc218f7134cf8ddf05e8fe781532599ba58798ce4e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af00c1332a9f39af0fba9f2113df3012a4d69ee02fccdec26633ca275f7fcd16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ddcba3391f747d9d87dd3fb7675b8db965bd7baaa614462e5b15d0030a82e93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3ad30c464d8b6b1baa600f16f7a53d692d779c6dcac84748df87958491bc0c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a52ac58432d03030a2cbed7bb3dcb2a430b323b8f8eae51848ae618425fd5073
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 192ff219d57f9aa18b209e5a78cfcc29c72ebe413d14c76da9fabee6df2d5b92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afe673d0324ac9fca04e080e0cbe1d72ecd2bcfc6044944b270d985ac6bf27cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cedba239ab86655f2f61e216b16e941cae676613eb0fcb9200fc441c0a13b3e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79f0e7975e3ac86237903d28f0dd7c3ab1e59cf046966bc3a5919bdc2e4197dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fec01453588ba2c72d53024d9975bdfeb08cf89f3d00d26998982631c1aac07f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc0a5d8505ff6401ea32272b711853bd5aa29f017df7dee26afa7eb2b1f4d471
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3e7cddc127a9a4faa527cedacff0cce8aa9d77a5109692ea82531d180f51d09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2575aaed8b314667fd13a22507793d828256d7230156beccc9f4736fc2a3df9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a922d59cb8635bc5324ca72ea3e9aa89e6de6f50c929a52b5983ba9437adf64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1806b8088eb31138ad94dc025f37f032eb096ae327c93e618256b228a7b9832e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85b60b1d4823323b1fba4d414e63e031fcbb739754b6e297a495dad9aa0975dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99970dd125a5b637fc7e935bf71b3c35ee2755b004d20c412c30158e1cf03596
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d825eba944c7a7c631b1b3e07346eba619a1ba7f70287b0903c24784ab8c8076
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f8bd14569caf89914841a24e0d6f8720ee0c1cc987bb0aba29599de80d4f9fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0763f270df21df74ae5e02ef6f4b75196e39dd75bedde186275573ef72c275ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16c563838e7662930148529bff2ac6bd56cde3c6dfe1c62004e39f42c5f6dd30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c7bc6b30f3d0d61ae2ce794434eb7365c40986f223d07fbd37d0c6e8d3e1fda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea337b028cb0f82a40fd4de8d51c082834a2046e7ca27f9bd965217b3db6c2dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e65bbb05adaf65e12283dfc460af3557451c5dd34635d3166391b7b404c5a336
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bac7c39a79899e4e8f6ba368f322e1d5791cfebb87d8610045d2e5995546170
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 deba2b53acba52697e67d55a0947ed37fb646523caf10c3c86ac42d9dd94da9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc26080be6e82aaeffdfc959c1e94c7c4086247044ccb12ea010e6fc0ab0d04e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fead2d7813750aa0a0536cb739cb383703d1bd3b385c4c19949019b46592b06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3244d51ac6a0df3a609f6b1a4a984a8a51b79d2c3e3ca46c1f50488bcbc2bbe0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef51aec178df73f84e6b81f908d88ed5903b2521e18a64d44a5e74f07273f1bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c0e1c4651b4fb9537a885fba2841b8433a2a62d50be5e9682944952a2ad2e53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70ee731903b030ebf09120a95437caa39505a603e3d33ad58f38d71b8441fd54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f171210773a4144a6d103fe400812fe1842873c6d41dd4bcc18c9c56b5b873b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 230dd43e7284bcde5661a621fc95ce5283f3a541dfdee9c5dad462e85c7680ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7887e2b4bd634ea20da50f255b2a05a91db2ea934e58371535a88c8e7eb64d25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cf8c961cc1cca3a5c2ea67c3fa3895732cb2174381eece80c28f9c454592dc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfe29894ba4100e257426ff429d73773187a4e3489268e5f6cddb070c89887a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e59af2451040b03047984bf6a1ae437e037d09f6c5eeedb832d6f2b1008fa77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ef4f350d06b779e817dbd63ca69341725b88dfc8a2223aa0a61f503d1ce39b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64b1232f8528775011cd070c47818fe091e4aa0bee5251e8072f961607120012
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c76ec253f44771f22cf5bd67e787d1493025e7d2c280ea820e6b743bcc3551a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3122a3a2f0fa2ce5a4292ee0ac57f77b91eaec1e55e104809b0334656fcadae3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c29b9f714ed7f4de4adf23bec17b0bebfc04f960f08aa4e1f613be6bd18434d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f854020cd00665d052e412e6d08d2b8ec3af4547cb7052071cd858c4100b9cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 011156a3e81030e69eddcf360ca9cdb2e9a6dfa846299adf9eacbec7ad5ac02a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40d38b18f71c549281eeed220e15595f590f875301bd0bbe8fe537660bcdc7dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb15183f9b7eba201d34903bd863e5211d716ed5689d493b6be4ccea5ee0faa7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e468f99a2aa206755a4351fef50f4dcd2dee350475ba235638647623c9afb0e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 976d36535499386a9c7fa669f749be288b179c87f6632182b0288344a182047e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50979c7a1770149bc9753d37f8ba7eeadaa21cefb83eef0bb1a3b3d369887b25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 411db45262754c383e50551b670a3f005fb3d90f6240a1c9deb871d6a7b2e5a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1df414008b038b32f03155809f227aa0facfc2a259fa07b548e0136a6da43fec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 944402622ac05c749bcadf1ab4ebd9126b0496884ded1eabe5c6b28285973126
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c66b9b724d3a6f2ff59575887b28c4d6f15b3be789bcac05bfb7a075b355747b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d5e9266755da865c4df72a9a0c55de50596289283933d09d0b8a32dd9dd8f05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b9b54eebcbaabd7c409010ef294ceae7daa3fa2685b80ed93ee82346a32627a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5590ad9298904375685a4e3052a5e8bc20f811990300e387c5e8a123d7febf0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f83a19c24e8a85ba7312bc5f2df55d4a612e70f09fd6b7a3f680eee9eec9fe68
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f563b745a98c71110f2d62da9e8458b12ac5b6aad8c78973cb50127dcd0a98f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c046a86b4944d1cfc775d2bdf51247e3ea67b3be4d2d8a047fa756746f6b09fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 578fa466fe0847fecbdb9dd7d9e78c747c62eb94f68284aa4459d3270b58877e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2187bd76f519615c9e9536f757a3d6b03c45ebc280c507fd25ee20c4ed7a8764
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13bb143142639137998058b8e9f986fac33ea72c150cc1547f22692d7827af00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7329e88dac0665cbbca27f69e19c0d24d117df03765cd0722e1d5bcc7ea3bbea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5faf6e03564bb916881a6251c94d11802698e6ba3d27cc691db95ddbd0862149
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd2b516801adcdedfaed78daf0776e29ea3bc769221f71fd9223f50b00fe5b6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb37daf2bf825ea1eb8166b7058dbbf13bea7a5266c1367f46339db37551722c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 021dc9c876cdab461507a6225619222e034d404b141a1a1af1b0ea07c169dcce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebfeed67be137392322438e15104af781844e0b51816cf53531ddaf00004a064
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0159dc0c2b9b486d90b2ec21ed2a59b159567d0b3f6a0c7a187b144254c60ab2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4f75427549ea97e21e4c170855390a8fa8b1a4c9110d9a729ca479fdae3f464
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92b5124a4d7d85690311763441580f3dc0eda6c1465b0c71f4e406387fe8f79e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b8cf1eaca470b7d2c79970f7b51c8222b95bd86a90bb77bde3fc90cd8a18196
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a771f8e3a8d9d0ae24752868567c276f440a93ac39b5c2e218151e4f3c833164
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b23da7d81f98e3fa8cd291fa890632dce72347a9c9bf876802a236ff5acb44b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e68ac3c28aa133f59d5b92de9075f341dabebf818192408befdc4ebd6f6c58ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 851c0c06d35ef958af22a99d781b2b1bff224fee486fda33b3b0f57aa9f78f91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00c936432d3170d80f56eaff4a8643028a0b11ff2370d1441d4eef914fead1a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ad8dc6d4e70ef465c74c937b93db337c2d39dbe3e01b31caa85c550e431a6ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8389d928cb1f4d5d9f7a75f78b6a1eb3c7303e9dec8d5e43143ba94c0c6256c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 458d4da4973ea73bdcc0c6330da11194ae25943bd97cc786329f068e04330f28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 888ff9c16b45b2c6c26182f10019af011c1cbb5c96fe8e2c0a7382cdc2f31198
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 222c1569110c4622977719c41967e95e22f226f1f01e8ded355bb6da6f2b0da0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81c9e826b7e6ac6d15ebe62bed2a9cbd06c28124632bbd070453b2480461cc8e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6afb0f27dac9fa11be4898c9c1618e57e308d94804d5c3bc942aef80161ef512
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69154e0011b28452dfac37f52ccefdb1d68f8f8d7c5992922afea1ae00d00a2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a6ce0e167cf07e6bd9ee3072c05abd3c1bcac5d11fbeb9d8683e81b850c9b6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3460ee6e44353ce9bed20ac70488299f51a00403ed678665cfdc7e93406786f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8978f6cbd3d9b2cbc707a512ee02cd9ea11c1a815de657cd3f6eb941af9fd0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5309b7d5cd580bdd1e6c3ec04fd1934257a5350b566c62a74372cdb39cdd8d83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bed23b22c8c59a58a4d325ea56b3a542adf188be4e17468445f279890323b708
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12921b7a62deb589f70c7809b42ec20fc0a13c76a623e508636266b3498dca03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc6ea0400b16a28ec2383e320eb1f9bacf231a50bc1b98017bf555a90ffd288c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a884043f7c842828f5b572375136ed036fd455907ee2300384a46d9152f1cbea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f247dc78e0709bc7850477eb0b972b5fc116b36aba726a7d4a70808c8bd29278
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1645344ec6c42d12ceb66817b7c7483e05b991bfa750f5afd206358fa5c85f4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa165c1be78395484ee0155ba38563c4cbcdb25f377a149cdf99b15305d0ed3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58d298fddb25e8960727675a58839d4d92d64592285f9c9e1ed1bb6d4cd13813
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f571630c507533824708f799750d04ce786f85484cfb386eb8c6157a9eb1032
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 719285b926ab873d6924f075a6ea93d69aa1737ed116b5a386f34d664e1e3b17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b88ebd4d5b48bc9153bce68ca28be1b8b0501f408023e8eaad2cf76af33b0e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5787d5581eea01e8e4da36146a81103633724ef5bb3e91953b6df26d47a3740
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ecd173d36838994b251662526e71e6c03abc894fd42407be8cda024fd17face
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e419770a7d80b68fb094f032100eb5eadace62b2438d80b26cdf2f6652f489b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b9cd3e1b1cb1ad183f2610a194ba0d788a66631e910e47ea778b11b1e7fedb6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8db7d1a9811326905412e189887b6b3d21265abd33a4e8f011d759f12fb3f58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbb1e5eae04011da7e863eb63166a8579a6412b345dc814be5b4f78582f6790c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e428882fd5b83111592fc83c55003ad4f89cc820e06b7683c99e35956fa40a4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0bcea2630aeaeee37306591294943eb5a7dc7b0cafcb06616c8742a28ae9c63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dece71ebba7469af461bf4cea0586f67739b4e7281ce2e282f818ea837da155
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5514cd11ab12caaa648e0b57fb0c2ea2a07ac94cccc4f6eda23a7fc9a15ca511
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5407857be6f048609d93ab534cbdc200a45cc2ea07a9d2693489f95729fe9d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dcac9e948ae46508d0ad75f02d4395d8fde0973074375f3cd79c494341698ed6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4fd4381df792cf0e458ce22c4532540e08e418d1587bb500bf119bb3e11634c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 610cf4a1e287ce77f399e393f1f29a21d38de2b2ee9abeca5c3ccfad4cb8188e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba7a9bcf1beacf854223dbf1cebf9ed05e047b75a7174f2c54c4da0fc91be3ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1917c9a38f6dd1ad01ee20b9ee757b97c4ecace5a60b3176c4687eef0221933
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7f1bfb66291a2588b8d4406507015317db6d4fc4a2c666b9358c2cef51625d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 796e33b566850b56ddf416a17ca5e4633b0f0287babaf7b01ec5c9b390d2cc90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9bebf7abbd3a3428f0bf1590a3b0f15a9c9e99631c7f6ca063fe9dac4622ad6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 511ccab573cd81c8e4d70e0ce628200d6f86ccff7ec048ea3deb072f8b8a8075
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ebf80f287cb4d325853401d26c6f0e59cf0a3b5a712bda544a6502b67682723
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96cd1c7514b70216b3f92a815810b7a4bd60605b32b1a885750a6469c20128cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f48dd8ba89db55491ee16a3aff50470c231541169e7f252c7962d45c3ce01800
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bf95dec7d7fcacce00a885340e0b9b68e6a75f41bf20aacc71d9fff98860d64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab7bb49dc9d137fc5d20ec8ff040f2cf559a950411794426059bc54ac3dab61f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 131b61769fc4ded1559acefb760bdfca6bca5d191c90384ac71d3ac98f89a433
            • MD5 SHA1 SHA512

            699c4b9cdebca7aaea5193cae8a50098_a53bb4ca-6113-48bb-9609-441860fdd0d7

            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1194130065-3471212556-1656947724-1000\699c4b9cdebca7aaea5193cae8a50098_a53bb4ca-6113-48bb-9609-441860fdd0d7
            • Size 50B
            • SHA256 4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            cftmon.exe

            • Path C:\Windows\SysWOW64\cftmon.exe
            • Size 336KB
            • SHA256 78764b1be72a82334f06946dfb0e6b834591c0e585f6c83787aaeefd4b8af54c
            • MD5 SHA1 SHA512 SSDEEP

            memory/116-5-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/116-6-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/116-7-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/116-9-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/116-13-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/116-16-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/116-31-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/116-146-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/848-183-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/848-147-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/3992-176-0x0000000000400000-0x0000000000447000-memory.dmp

            memory/4204-17-0x0000000000690000-0x0000000000691000-memory.dmp

            memory/4204-79-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4204-18-0x0000000000750000-0x0000000000751000-memory.dmp

            memory/4204-179-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4216-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

            memory/4216-8-0x0000000000400000-0x0000000000447000-memory.dmp

            memory/4216-0-0x0000000000400000-0x0000000000447000-memory.dmp