Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/09/2024, 00:56

General

  • Target
    e1625a4441de5ede267b18016ff7bc8b_JaffaCakes118.exe
  • Size 316KB
  • Sample240915-back3sxamq
  • SHA256 87849e0d46c3657e806dee9f762eb7b462b0571ff4ab48b0a8f7d933b3618025
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • sandmaster.no-ip.biz:90

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    wind

  • install_file

    wind.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    sand

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3516
      • C:\Users\Admin\AppData\Local\Temp\e1625a4441de5ede267b18016ff7bc8b_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\e1625a4441de5ede267b18016ff7bc8b_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Users\Admin\AppData\Local\Temp\e1625a4441de5ede267b18016ff7bc8b_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4512
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:3340
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:4364
            • C:\Windows\SysWOW64\wind\wind.exe
              "C:\Windows\system32\wind\wind.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3424
              • C:\Windows\SysWOW64\wind\wind.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3556
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 572
                  7⤵
                  • Program crash
                  PID:2384
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3556 -ip 3556
      1⤵
        PID:3076

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 70398f272210fd597074ffacd9bde836c4b641b0b7e11a5570bc0395594e58a6
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 90aead3cf194930db3debb7cb16987c1366d76e6d4863123e038809bbb8ff786
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5aea0445cec71b651d742e28093ad68bfb8cf158b3b9d550cd080b3288c3333
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c544c32a2ff591dec87f1d995ab2617ac3a7e465da724c4a801eeb755ffe59d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d8cde4d70ac19de6bec69057b37f3a86cfe22d83826fc93c954707864b2d23b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3bb5ee8c898b1c4e4b774ceeec2566c2eaf23728de5f19f6ee73a3a64c12e78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 103bad67a43ca5982bdb7025b6f84f596166a76d56a9d00cc0d9ea4419457d88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1d112689950ccdeb08de460075e1f84ab74b7b748b64aaee1898ae6fa6126d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f787c729d0478bcd78be7f352b89c43e9fb9c6ec5d5fad9efa02cb5c74bc49d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 205eeea874cd2727bf1f8715e9def39b2cb9b5cb759dfe8c339ae15c82fd574e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ead4c0afeca885e9a6607a862205c9e2b45e83209198e802507dc44f5efaa45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc2cb2168e129d70ed862da3393468dfcef875ebbb1ec4c0c81abf28c15a2231
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e69b9ff95ce426c36440fe8df7decc383e94db4d4e02cbd252d8acb00ee3a47e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3368fd77032a45fab02098b195e09a8d35829861948fd527c6b2a78e3c49abd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e208e4082a314fac69296b22c3535a4d49399c5c19dde97ad366485e3ef16b35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 379b86f06d2ccd578dcb5e0e89eca25c84cd33ac9a10d82af0ac24752dec3fcb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f95dcdea233f624d59d799860b0c1c892447f14c447ae7ac457942b5a9ee0fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61f5b22fd121153bae50bd04a5f6d1e7390afdc4e90637ee263ed720101cc6de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff8e03e2b889c4e24d54fac6ea327085fbd465d4cbd2b6989a7920319ffe5175
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ea21c4a1e5f2c43acd39f236de0117ad850191c6d5679808a3381e97cbb859d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be24a62e56148f9442f24cfb4158b17a999a6329f435fa37b041c2862951d5a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e482e630f6d9c626681e4abb226e42233b48c29e436ea5f03c623a47a321c540
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 119b1a9334ea607bf105fb9cd22d07b414d46d1e9b9bc19522940d3472daa3a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c508a38ea0388163cc679e6b50a2b20caf47934021a34fede74080baed8a652
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b431be2200f312fccd9c588f3471365b9921c7379c14d1bcf6c7526a8126ab2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c29417ea46f77f9d3c8e4b15707f0109400370b02eb0a1eca0e98379305e27a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddfafc336c50b2b81d9d9d17a18f3e43885d81936ae42cdb3d28705eb644f556
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0fffe29bf68dcfb4635f42fb51d9b83209ee83df8c7f2ae57488e4d33811842
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4b887db00a0a0e56a5ed69e3cf4423b00039f6e03fa68d95bc36718048870cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a35d3cc8374e1f63665762412421441829c78321d5a4456f9e06188f5389f7e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54600e1fa1d7ba4a2f7de322aef6e2dfdde616d2d0fd792a52acfbdcfb80cdfb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a36009004ec4c980bfd032efad4a3b9651963a9011f30269396cd8f7dfe6bb3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20181ee14a2963746ee110c724721ccca665189c5acd1f4b1238796feb776b77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 304cc2daa628d9d6154fe52f38c300ea5b557b84115c969769308a5f42830cf9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b225a1ae229f2eeeacd7eca4a4e6fdd1a961cbe14b69397704a7f9d104d0b06a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 617f6f74c43d19719d1cc4c80608468a59c2914e264275513a460026a0df0cfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f21b5681d2db1a37437d73525dfc4bbedf72aa078ac31fa94e00af9fb139b1aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ebf0d1e3d1ab51a2cc0e4ea026eaaab0935982248b6f79f8fe67f6c77d11a87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6373c0eaaac86539363e48683de9e52d7efe348c159b9203745839f8aca24ae0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50d3bb9a37d8651664ad8e6e62895b8b6b208fd475cd9e900a255bdc72f9f83c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbff35f3d8eec27119efce94237fcb7de36151249657982e1c89688af8d4b7f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8ebbf665d6d106e20ed5cf8cc95e1069b5568a15af23f68ee375b95ef6cea77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5409af605c6c974fdfe087bafff396f2628c937cea73f646addb51ed5e714b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5dd25792d1e55321cc30d05ca43b71c5d25f3621a375115243b09a6a620e9374
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15b6bf77bc8ccaec80b0b3ae11742b70bb1e32abe776185a7eaa02dd33b4c6e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2ce4429d243ae081a227ee3feae24fa83ccf47ff27b86f239dc3d3db566c6d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea6a1466270843ae56410df3ee6f1d2f74048eb6441d141afe4fd048248b5fe9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e64016cab01fefb9e65652795e0c920d8ed61b516475f5054dc48250d829ae6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1de01250698b90e3c896a323cbf835b4a54adf2729b9d9e34fd647f2c8afd76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e260fae0b9e59d62724a5ae9dd1aa8f1d44ffffd39e138bb502b1e1bceab1c3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d2c612b348940e584029f93be4a1503dff407630c2e8e53dea077d8aa03b2c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e3849a95dea17bf78ca4692b5ab104e78b68cbfe0ee7f1548a626b40cafc98b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0085b459b4247789126f097efd650eee10d25417bccaa6eaea35478e08ca9678
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f4a9276141822a7a5e9c06cfa8cb9c0e4ce5d2dd6ce95858235de500ef968b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82c45d503d06db8f34e6023c27a15d912e16c2724b0153ff274dbe4bf24e983e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 686de25ad4462c797fec5ed078adfa8e685d9339b5f4523dbc581c4c0dc77b9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfa896c58b58834fcaa93bc6451048ae1e059f65dc4078d0dd9cc3e8aed7ce6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed3fd58e8550f06b9536efcc83736603284af8312642f05c516481f4000d58a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e6af89d6d9932787c737ec27b0fdff555a5eec6ade528864ff98145b434ec05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08a9de706e7776083dded8b59032af92e0ca5ad9d5fb60609c2156e0442ef3d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a73d03b2bdc5e0dc75d545acb738e2b40a40c545b5f81e79a68fbb77249068ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 393e0684d813601ed15e99da4f7c338aca9b5221d34727a4c7fbd3ca729e948b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba44036ee20d15755186626259fcc61380dcc00d59ce53efca94106074ba9ffc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd209d266da70c63d22c091d5b65e6b2e449420567b077015d8573116f7653f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0ff4a228c2b3036efdd577018709120c1ac7ef11fcfd0811ce800ea55af7d04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 063538c6fa00161c36d2a37acb4ba98f0b5cf35463111b9540fd5f7ff6d9b7f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d781b74a85d999c793e1f7b69c10e67ed4524e8f645c01e09ced98882d3a2fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c49783e740389377d941b71f73ec737c6d95332eb0c747929fb1b784f5e8920a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2bdb5334b22c12fe30cfb0d291d0c00e7df18af4d0918751a145312e1eff01b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e27882d5304b4a9ad6e7461ba5cf97db326301dbde83e0ab5572cf3be521daf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa177746839117e1c89a9ab6e6dabb12f58bb0e025a28716a89757662ad4bbf9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3cbf10ce1b900ade944e2b996b24372b9f4525f7ff584f251e9a471bd693ebd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a55cb350c0497ee431573fc3c02562d7617c6c72dc853dfe8caa4d2bebc513a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19f1a3b98c7ff74b357fb09a5072e69846e0822fed0626c47d1f4ede1846bb5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa46e98ab8212a8699705b4a59f99ba9d57cec6620cb8fd751f57527f99da981
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afa32ce11a5acfe9f22b672d9b4b587a0084884cb9b4ba2ca395b7dc3b3217c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b395891018627cd7a47781cb08667d51e7fa9d5315a401401799ccae3326afb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cd2192b490a93ab7dddd1a143736a214a68a5704d6c6952474acf0d71338063
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17ad1016ba13c04008243403e0c3ba74d150939fc67d5533d991cf663459c79d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b87fe6010055ee959c1e6f806f83268a8294eea421ecb0ecb3465de5886e94f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f707c228084874dd2d5ce27152a820fe94c6b2a5228d930dba38f68686f77a99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0cd2b850eed6f684b1d4b0a0ff61dc06bf2e15060198c12890eab6a9ffcb969
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26dbff13f3bde7844386c765ba430bd5e84bdacc484f68c288180dc3b4696766
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1ae5050a9ae0737c2e42440ead9a9604185d45336a4c10adc3a145252274dc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e93b686315d895a9a584cf59398c3c0a7fa939479fb36b841335ba5cb645fca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc9f6b029ad937d91ee1e27220b8346bcf6c4b3fc1ad39e742892ff8ca095c6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0812143a2f2c85d4d6391a22050a7a24d238ed50732e5b94135d54eb0df10e57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b59a90efd7670814331f98a6df2984b2a9c7114950a71547e3c8cc2354fae24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64d0af1a6befd34f2b918d41e96817990176a4f06c1445e397167f7e48ecdc0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1a99316b4030493bc34fa78fa2375fa71a2d133771eb1ff7567f23ebd212959
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8a44e2b7262a06825969baf070313711cb4a091c9181d41ce1debf078df4694
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e72742f00924a70391940d637597bc619a07a3dae70bc70ce34478bf6a659ec0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b16ad2dff730e4a463d02e925e8e374a28ea09af69b654148b0f61e5d379b6c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f30d9d151f9ca031ae75a35dbb28234b665e03dac47089c162d0963888b4b476
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e966d07efa235e393a515fe0be63e8f91c5c122c03170d89289f0ebcbaebe852
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64ebe57d85c36430dcb50014fffb5e079a48a2ddfa7805b74f528f9bf0fd233b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f25b354cd0a0db5a399e59226f270ecc494484c4bcdba5e0a91b1dedc1870fe7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67cfc0d69d55859448e982eb2b605d829b59179e65f2cf07157aa018fc0e23c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 020c11c30d56a527e86581b902ec14ad269d5575875e304c376fa865f0c61123
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adc2fac6098d9e483c55dc344b19303e79c8e5df673d83cfb1c5170759979e82
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6648807e5636eb4d77d36a72d28babbfca546eb2f07594970dc897f1bcd9fbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 089d3ec318bc3a6b6e539c812eb5b2d8985cdf715634c1e65064d52b4849d3a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4586d5d75b7d580d4298d187009550446263c4fce6885992bbaf2fa4339205fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87e62bd93362380088003a9d3e768dff6de68d37c09aad0686f68db2020bed54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b01e78ab794fdaea8e7c63078cacff16c12007203cdc6f8ba5d3a579e8c6423
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 217db543467ed7c5bc31512870ffa23cac650b63592d2cf510a6cd4448c91eb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86120d037ad18c40fdb02508cd68620acf93f2922daf49c4c02a656a5bee0126
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 699769411ac898a79d18314a5cfc9c91406da5a6d92a3980722621f99b9b46cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a0f4293d21ad8f9a96c968e84c37a9c64b54df7d2e264ba6d536da0031bbacf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6186c269cbb70ffe3f8734cd5b5fe0d6fb7e6452a926541c181057dcff9a9f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d378d5e4bbe48c42d20d69af7f22b6ec69b6bd34365ee34a6d961d62299ce0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e229fec351740b1c92a7e6a7f20e30da34cadc078ea930c1170808170752646d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac99dc08878a3a36f865a1fea8367e106bdca75d50b0aa20a9667e8d354f84b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d504f6a711403b51452d0315f5173fb7b5159e2f26323cdf4eeb9ca88a5cfcb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04134eb1c2826f29c872fd906967ae2a4f6c63a13a812d477754ce79b62e1ce6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9a5a979eb421cd2cd497fd0d38a8ab93f5e493b194ab6c9917150b4b45684fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9ebb76b301647e986067969bf24e2c1075f8bcd070ba53d1fa686d58f071d3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ddbe147f98142593eed65cdf10b7fb40f3847937dd9bb774a678d568e587840
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a071cb266c4f8a81462d4707e3d70221cb1e53502c257439508ee75d3cb8654d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb3cf332592bbe9d7406513e8ce9cab9796625848a31a1e60a846011320b2474
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed1609575b65d0aad82fd05866af9204e5fcaf721072c624de4aa8ee9f830ec9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba43544d0380f2a49525b2c69bb18e93533c1ddf20f8c59166194d790c3def26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36c2fd0afdd40f13c70704dac38b460c523715b096d83785d8fa0db837dbf850
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0753743282ec00684f356cdb20a34a6ceda4e8e5223b70332ac6c1f8f822e3e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d785d0607d17e21f3e26aa8d0d1e8ee8f7e6857829daf80760659eea4c774eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1efe2df593ee5a9b6bca3d4d31fadbb6e8fa1cad9b9aea36f5e6f9d89dd26724
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9266779eadd99b7a603219dc2bb16b7958b5d4b217a2640e7bea64b8b373ff3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d79b34f2e6712195397a96977012695c4d132bd548f845710f721bec8d864e24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 482cba1c187c5b957aeaa647d6e9f8b04021c41a34369ca98f57dc2edc98b75e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4a5358d03e71cd0a0622fc1dd5def02f7594c713ec3a0fe0e8666f648fccf09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc926ea43e5ac62a39ad4da582e71c0ff9749342a2473057bdb173dbabf8642a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 203fe70e5bc2e3f9164cda91a52ceb2ab3ebf93350bbdc5fe9fd89a9ea82f8de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a23ad351a33c84c4304cf95cab8ef9c02674eee40414759d706c739cbf072f4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a38092f0f7f86d89b80dbfb0de36f7286589553b85fb59e58f5e546fcfa91f13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9af0a62f2ed11da8e519374cd8910a751f0f9b53a975699dcb57228a351e9ecd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41dc317b266e293b2e9724be1e882f4b9ae48017340b8256860604132e9ff08f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85a55e360b078bbd9bab5534f67940925be45173ff1848a6f9889008e1086427
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 266ea627088abe9027cd256406e3f34b1a8a6b6dae6305a7590144ac16784330
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d3330116808795137082b401a314f7b62fe223524b8d77f7ab8bc0f2221051a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ece02798b15c794b71a52415a42f97174c57ffaaa93b3c88e1d165761d47f1bc
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            wind.exe

            • Path C:\Windows\SysWOW64\wind\wind.exe
            • Size 316KB
            • SHA256 87849e0d46c3657e806dee9f762eb7b462b0571ff4ab48b0a8f7d933b3618025
            • MD5 SHA1 SHA512 SSDEEP

            memory/2716-0-0x0000000000500000-0x0000000000510000-memory.dmp

            memory/2716-3-0x0000000000530000-0x0000000000540000-memory.dmp

            memory/2716-5-0x00000000021C0000-0x00000000021D0000-memory.dmp

            memory/2716-4-0x00000000021B0000-0x00000000021C0000-memory.dmp

            memory/2716-1-0x0000000000510000-0x0000000000520000-memory.dmp

            memory/2716-2-0x0000000000520000-0x0000000000530000-memory.dmp

            memory/3340-21-0x0000000000E10000-0x0000000000E11000-memory.dmp

            memory/3340-82-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3340-20-0x0000000000B50000-0x0000000000B51000-memory.dmp

            memory/3340-191-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3556-190-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3556-186-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4364-150-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/4364-195-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/4512-34-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4512-8-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4512-149-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4512-10-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4512-19-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4512-16-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4512-15-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4512-12-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4512-11-0x0000000000400000-0x0000000000457000-memory.dmp