Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/09/2024, 08:27

General

  • Target
    de0d69987958c401782c9550c1826b69_JaffaCakes118.exe
  • Size 294KB
  • Sample240913-kcjxlstdjl
  • SHA256 92fd3b218ab188228ea0af6fad5b1123298a19963f14a9a943389771d774ac09
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • Yonawan92.no-ip.org:81

Mutex
  • :))¿*&$:

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    windows

  • install_file

    notepad.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    yonawan1992

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3428
      • C:\Users\Admin\AppData\Local\Temp\de0d69987958c401782c9550c1826b69_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\de0d69987958c401782c9550c1826b69_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1176
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:4592
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:3172
          • C:\Users\Admin\AppData\Local\Temp\de0d69987958c401782c9550c1826b69_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\de0d69987958c401782c9550c1826b69_JaffaCakes118.exe"
            3⤵
            • Checks computer location settings
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3912
            • C:\Windows\SysWOW64\windows\notepad.exe
              "C:\Windows\system32\windows\notepad.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4440
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 564
                5⤵
                • Program crash
                PID:2936
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4440 -ip 4440
        1⤵
          PID:2844

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 a78591e42ba712948b49b54d036149d3d6512760066dbc1ac2c553723ddd5cc5
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 fa4d1e77bf806883d64a5c0c988bfa8d7a9cda33d44f755ea484ead5b371db03
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c5093ddb1271bf2c461be4dc9c4ca70df651e182481ae83a966d38d65956b90
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 099ab2019579062d05b91e74f9e2f61923084177e720850805e512eb08f28562
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd962fd2ec2d53b7d6bed1cd6f2033c3701ee051f53ecefc35a990f3a629cd4e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5679681e97c5364e11106f6dd829264d5b02c39fb61cbf7caa43354902d27e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a45f17735282817896c348ffa39f9281dfe2bd76d403fd112ba190c4d037f55
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1836ab31c6ebffe696bd47760820851dceb8d939df6a8cb8315b8136b86c6997
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9005287d4459c2d7f2088c0ef842ff83e1486bbde27bdca9988e64f9a903edfb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba5fcfa57ac3c70f1597274f9690b47d488f16a395000be96d1848c8fb4e53f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33a451c3950fbca78de968357751b99aaa3f92cde7956b4064463a6d809a68c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72ac178b155db28ffd2702a58c256fb8ec54c1c8caab610d6c6cd423ff6ddad7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf376279737cb25e4f77ed1ab1d448f23d748be98667a410d1a5b8c7de5c3403
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38a82f97e8b64aed51333952502b4f15739962bf4d3e9ce832bee0e2c8efff65
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2961cac60e214e79ed88a446de21f10f34f6d6f22f2e248bf659257753d31a2a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0a0a2f6294822fcf26d41ca6bd1a20f06698f29acb0ca6c63acc9453679599c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17cd8cf992a20f22dae7c7e1a606db0dc6fc4a6d96137a1d93fee8fa509c82de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fdb2788b4f2ac0b586aeb942e9973cd11c87b216ba0ddc697e3de6905f1ec7da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54ded9689eda59776b16bd121d236c7b416b141b068e46fcaddd98507ee618ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6cb4e02e6c69ca76beed165f4af35cac8f411b63ea335ac705c8fec91cef021
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0597792179fc6a001ff887659b097e7ba39a30e5b4605505541b1b346243111f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cc8f3edded457c17d0a82e51eb53597f361d5f75eaec5cd5c7dafdcc2f3c9fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc728d4268c3967dd35432ac8b90445e0523b02d8e467c92666c6dc180429112
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6b489f0a24d753d48ba288cce5708cd45f3e0cbf864fe7c9c2612d139a99754
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f303ccb1b8fce133cd28e2d12ecc1b2b68ee659ee02ccdc0c45bbf24096363e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e98b5c245a361adb001d0babb65bbf8738414d51973a2fdd802dfea3c5d5dde4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 381234ac39938fb07b756ae94c66061d42118b2bc479ee93843534bc3b25d6c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d9af00bd69e01c0da61db9cf6d198cd7308f8e38772a8699236ee4f6c4fb913
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8688dfb170bc80a038d92bab376b5f33b08e78c2358224d2ef8865d2c833ca4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab48e1f3167f9ad42e3e2cfc7a93b7097cbbf8992602d2f5cb6e3269b318dbc7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7cad67ce9ab1001212a3dc6e6c18df2082dfb53dd21fa888c4972ca162f0dcf9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4bd231b5c2cf16e47a4b01cc4611cc700c06c106abb72cbc80d79f565769b52
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17ea8d7d7af792fe848c5d27e5c8399c077265e83393f3d7e8b8989144525213
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01e709ac60eefc655252392c7e608cb7fa90cd30cc7d28772bb63710ed96ae78
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df2a255dece8cd88c8dce6fe450ac729d30b35a5f473f657f2649ce81da99720
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2a4270defe5810136a8f6670cf2510538b319d32f132e08f56dc195cd13af12e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22dc6f2190c6dd84c6a559bda0c521bdc0a1d312b9cc99f64acf105b5d20280e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5cda7d41f57187bc99de8215641f9f32729a296d8b648e5eb3e9fcc96a24024a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 613d0d69477251daf370f0d362425905fbeaf9ac534dc927e4f3d1cc3bea5474
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 314e7568282b2e626711dceb6f44023fbcd0646c9dbfc85f7c1d24b0feea4d61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 18ab78817e511dae92eae8b58e507f763d6af15e6dfa259f2369052960921936
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e4b7ae96cae5fae1a7ee62268b85f17744c01ba6b566ca4f61d516a6d760574
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f3a6f06c6c47c0e332a7e57e5bb28592141e7fd1346cefbd445f0bf47b09074
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 74aa61abbda5f2c440a2d7e61ce9ad321c632dd5f35294357c757537377ca683
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 602c3be6b0b616f731ffc5bc6c744ae3ea5816ceb94e76c94b08c0c5166001f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 769f06c10ccf6ad8dd8409d28d867aff4e9223983abed6ac30cb18d06cf8e3f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c80bf47fd3083f904a0a25d41706240da38b0e26b66ce055d4e5fa5e698c895
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eea03ce6bdc081848a8f7abfc1f6e4575e0321ccbbef555285c15e013aa27bea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f098642960d9b09a51f391a195908686d7f7aafccd4fc48f2b9a0a6650d77ceb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afa5d84bc32d97fab39b30a1e5465aa08bd7229334662ecde5378168fdd59586
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02c273ba44927d7ad4e20e0cba342b519899e0875139b140d387accf3bc2053a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed1d9f7fd7c4104d55295fe801a13f58b5febca01071b6a02f4b51784a11b9b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16a5a23d3df302c3a90b841b94eeeb669e223ee077dfef7f39fb6369d6d6a85b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7884bff8e28064d147d5c862be6e0beb1c22d46247382e46e9ef3b524d947c69
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 508997520b5e4d8cd723249b0cd979f6131c59dff0b8184f7b8d5ab661b5a7d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd3110eddd0f51092223be0f5cda5eceaa1413ecf307afad5b668a8ea8ad4796
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7070f6e1f9dbdc0568f345c1ca1442f74485294a7a6166c7fa8d541d407344d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3db920a1c721e524c200803d496638ce35b22ed52077c89602d242cc1136e0ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2aafed88417b7b716973ec29f84a7901023bc20d9e25bf1028776c4354146b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c35252a918499696864979376b332fece3ce9ba913dd7dff92dbea4aa18d71e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f43ab8974c32738e140a15b146c1a953154c107925867524f1b76902fcb1a16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e63e82c82988762ba7c987f4252c136a9285f79087bfa8392513dc6d2a7aaec0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2484e71fb8e8c77689f3a11d5ddd8d58c383379ea9c0c0af293daaa5a43157f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53887e9dc9c554399744c23a3d1be91791dc3f78c9689031166297088fed1da8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57b2853370596fa43db77f1ecb2a1a6615269ec3d114d9f5f82899572aa61249
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3886c26673ce84de8e4c8420c6f14621b113c2ad13253adf200c29e3ee529b90
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98f71a65a06ab7b826a2918a6c2a65b7f8d7a5c4bb38e2bf003da441785afefe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9491f1fb4e815665ac490a32801803fb51c511bb3de87de3a2ebc5896d659d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14a5f0fe5b8d30a4f8a108d46deb00dd178ab4724af9a33a93a968a1dff280bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3dc95bd3b02c515dfa5747d8aab7d755190ea14eee43df179b49bea52f072a00
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e3dc8aeab7b96e7cd366d3d38945cfc8b731298c096f98719c045ca77f381b02
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32b862dbfc067c0472d4c5239feba4e1e57d027f9333692582ecdbf779241a3b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bfc5e85ccf6b4f3ec470fe9c2ec6b679289fec305742f8364343b170212674ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd7ed53c6c7f9005c2a534dee04657d795bc9b3ac79448b568643bd19c37df8e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 663a67a016f45efd4cab50015fca21d14931c6a77e22d22d4a00fc01ce832870
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20f7127d6b024b0116e795878858dbd093734af1ad86162f9e1c66ad0021cff7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 699c631aabbcc1c63ffb7cdeca7634857999c8968d5cabace4dafa6a49c3d3a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb44114773e3b4303dc0e61a87d69dab033a7da58e3069e9ef4ab1df7a3986b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ad372eeffece609241f680a93c8bbf84fdca93be1f1d22d0c9e55ada46cbf4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b86a6f848889d937010f690b4df3ade28865e032e44475923e4721a14492e211
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd8e70c63f93b537c6c44074994f6466e5908624bfd68143a004ea6a9871f85f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7638f373596ab92b366424ec0a529ec7cdbcdf7b0c291a703f20a5c92e66f1d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acb5de5835bd88024cfd30209ff4f2efaf8287a799f0899aaab93f813735286a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d612585640bf35d2e34281bf7ff093c28e5b79947d3fa46f3a689831acf35211
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5db532564f69e39ffdee60e0940261982c6104fa6b8c43b051c65705aa4a55f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83afebc4fcca6ae921db000885c0caac0aef8025d790d929f15d9c1b0a25fa4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08bfb82a0d0373f79d756ccc595588baa58c3cfe646d21ab996e28cfae4c4084
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd393ddcade314db4f2e0b123a2a4afab0a505ec422b942071ee0a393235434e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfedf6143dba42e8465cc71e0e1df707d9286f1c12001f9fd68a3450dba8f1d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8cc6e33c1b88f7c5118270f66d456b7dd3dd1b71a1356b7b2feb9c6284db531
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a99d7377a04117d8a4fbf41ec3da42298f57c63b08fa0c7c3be2da02cd7f3346
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df6558d420d9d2b8ece3ba5fd5b8a5af08855d574ce5cf9f918bb6d76894b945
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cffe224dd3f6488dacf87be714f3fbeffdec62885a7a66fbe1fcbd8c9cc7943f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c32911657507545f8959258d1ccfbbe4844bb42cdf6a07bdbbd32af4ff0e227b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff8414a904d76cb27b738ecff9de65d767afacd1f991765eb50c76939f011055
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 37ce4ff70ea4aa5b8392e4eafe598da32bd412a34005c665e587a52b2deb15f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60637e9e1e1fabb8d0f5c4b82050fd9075018c9a6d7a85e3c0950d741d7fe240
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc42ae1ed5893384ddf7ed89715be670a6c7578084df9778bfd541d7d42b9097
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b9e4d4f8ad1b45125b08c4d9cfc3146f49fe727db342f6bffd9f538f7f5874f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 613ed3838210927aa7ebf16e8073edaeddeb875c49c2ab28cef2c90585cf206e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b545bc7c02cd3dbaed1e8905cf01ce430de26c5be19b366d98fe50e06d7cb74b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db7bc33d739f581f3b8e9448ba84f0e7f9802088476a1e03510b5e5edda62b43
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 886abf6d4019a9874e71ab2168a5c795c88d9053afb9421b2ca56250682f10bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ba2c147a8364d71e79129a2ea5fdb72e720d2d25b263695be9be7b5299be7e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f61f9f6726cde6a34de10e3b644bfeff8f81a28664fe7c6ece288382e10baa0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e60d2bb64887b1a131240e4334223e13afaea2b52640951e739779ffb610b11
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 093079d27e3c2a5a8118b6576545861efeeab0681264eabb5b29e74231ca7544
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe90b5a03fbfb092d71a2b02a4aa29b9fc4e238bc11979d76e4875db547a67bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9733e1cabdafa81489699f1e26c6591ac62306b940be6cd13cff3a08b40ce8b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec429460bcb9ec849caf1953a4bc387f712e33979554890e9e321e4451169974
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0308dceba7dfeef5dd461cc84f63cd2655a62abbcd54e2a112bd7e1a3748b50
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 04b84a1d773fa33f303eb91574a1117264eb9e9bb3a41d6d5efd0011e7420e41
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4ceb96f42784c549970fa87393ce94d1766885a150dbc35952d9aa7bda3351f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c322bd950f94b4ec3542279046202f37017416d26f54f88252b29802ead7b69
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee90ef3c492b19d6749b0f8b514dd240d75a6ed2f0f025fc7d55e2e46938780a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd998fcae3d657f526d69158c18bf349849050372d275eee5335a1d975b387c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b8ac30e277e3839dbe13bbcd8708e62c63999393fbf35c358903b3a63bd9b07c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29030737551e14551541307df0cde8ea009dcf7eb773cd216f0e13fa01dffa69
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c497a0f07b46b611aed2878171d60765a4f9320b3a66815dde907f49faa45a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2923e96e5f7579b68a9b8926bf6042bc8263a89a4ffe8c697cb4c79f73c6dec5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13b7b0f35ac8e7cfcb3ebcba3ebe1e2dced0170cdb4ea22aa7fa078aa0dc8bfa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b545b430e23cb770dbf1cfe88200d2ee48126adafa4e204ce45819e3c33f7504
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9437764e49707624e5fca684f45565217285aa348c5d31d553fff56eda030987
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 699721b2bcdfec0d88f839207bd784e9eeb1023507abe3c43430c9110a38150f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e898f6f91a7f84523803ef8601bdc502e9c427cace0f20c716e76cc58fc825e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 52ffde98197c0eb6ef932169b368e089baf61f1e319a5e69f9a17a62f8a0dfe2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a642fa2953e6b4441a33ec2564c73455d843a3926e1da6394e7d2772b7d5887
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4994233a02adf168b52d9519d78f7395e28e08316d189a3850bf6fd616c16f9d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36ae4d338810816831d609dfe0700de9342912fc09acd38a489308605a7a0366
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e94fcf4e77e2cb8cd7295493e50911f6ca0a97ec5212922f444e7c7870a73d54
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4991bc2a01fd9f11bdcbd6aa19508db383646ff2f338dbe089dd96dd3cba018e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7cad02f27117e515f1512ec822adde367fd4b304943bce47f6f0c755e70df741
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d776bc890f8c6cc9a404c65937209d0c60d17d15c6823aa4d7ce9d8861a56a29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acd5958efcfcaae1c8e6cd4076275ca66b5dce0c41974e88f6d92fc9a0f7f0d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 823d9482c04bd7b631f55080c0a632a6cfe613cd3e5edd4fa33a9ad386098230
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72a72dc53493e9c4bae348cf984950cc9195113c0b2e74ff763c3df2b20eadcb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54245c01130a6c992e19d5532d3432ab313c8dfd76c56d6651f29a824ad3baaa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 733fa181547cfd17048ceee7c649a5979885bc00022a224b117bd38f7b38a08d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffd978ebed039dc388847bf96ccedfdc19593d459a7e541a6e9455f92dce6d58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2ae125d16a2d790e36c95966527f9755427d8acf990763eff62a737b79d2384
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2da38715a556b3b104d410297a539696d31985c8c9264313a058ad2ef2a5150e
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              notepad.exe

              • Path C:\Windows\SysWOW64\windows\notepad.exe
              • Size 294KB
              • SHA256 92fd3b218ab188228ea0af6fad5b1123298a19963f14a9a943389771d774ac09
              • MD5 SHA1 SHA512 SSDEEP

              memory/1176-6-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1176-3-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1176-63-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1176-2-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3912-138-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3912-166-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4592-7-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

              memory/4592-8-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

              memory/4592-68-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4592-161-0x0000000024080000-0x00000000240E2000-memory.dmp