Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/10/2024, 13:17

General

  • Target
    5231930511f0578dedc52319b180cb3b_JaffaCakes118.exe
  • Size 418KB
  • Sample241017-qjf27ayfke
  • SHA256 b8fdff65cd95b08f6e9554606e29bd9431ac279fd688e4f8a08cf4d87d15a9e7
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • sakaryalionur.zapto.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Extracted

Family
  • latentbot

C2
  • sakaryalionur.zapto.org

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3424
      • C:\Users\Admin\AppData\Local\Temp\5231930511f0578dedc52319b180cb3b_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\5231930511f0578dedc52319b180cb3b_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2524
        • C:\Users\Admin\AppData\Local\Temp\5231930511f0578dedc52319b180cb3b_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\5231930511f0578dedc52319b180cb3b_JaffaCakes118.exe
          3⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3672
          • C:\Users\Admin\AppData\Local\Temp\5231930511f0578dedc52319b180cb3b_JaffaCakes118.exe
            C:\Users\Admin\AppData\Local\Temp\5231930511f0578dedc52319b180cb3b_JaffaCakes118.exe
            4⤵
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1440
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              • System Location Discovery: System Language Discovery
              PID:4976
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
              • Deletes itself
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:4936
              • C:\Windows\SysWOW64\install\svchost.exe
                "C:\Windows\system32\install\svchost.exe"
                6⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:3692
                • C:\Windows\SysWOW64\install\svchost.exe
                  C:\Windows\SysWOW64\install\svchost.exe
                  7⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3508
                  • C:\Windows\SysWOW64\install\svchost.exe
                    C:\Windows\SysWOW64\install\svchost.exe
                    8⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3464

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          UuU.uUu

          • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
          • Size 8B
          • SHA256 783794fd809a2d248797b43f5349b72831ecf2be74212e5c92c740cecc060c25
          • MD5 SHA1 SHA512

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 229KB
          • SHA256 a02077ffbede8faa1e7c18dd95414f9cf973283a09e9d5f97b936608375b03d6
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a21ad13bdf79370b7529c0bb184292cbd842bb181962b2f0f6fd9f661785449b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6d83a6ba3bcd3920c75d80d90db636a4d7ef5e621d0095f6407538b81d7ea75e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e4f7e2684fd38b56bd55e009530a0bd3dea6edc1e58721f9dace04092fed2b32
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 57111a01880b64606f9626617fdfb49297ba9f17f4151052c5f369a0b615b57f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 edf61f0574e3b2f9d0e03fb6349c16e574a496cc90f7f473a4d1b786e9a145bb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2514da42ced6b4257898bd5a78c98e1ec4dfe4c113511cd85d41631da524a8c3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cda8183823503a83aeac1c5df61ea15b8015fd4dcbd20412acaf304a06e865d2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8158fdc7fd85fbc6ba63ea22b832568ef4c637f7379a8a6825e1723971abab40
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6d8c53860fc958a390d079f248e72cfe8adebcc03c38fdc9a4ec6b55956daf74
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 adcfa29f19b7dac5609044ff5d1828cab242fdc750bf22bbf81b075ef77a2034
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bef735b9a2197e735766eddb88e4fbe201eca34994c9612b2f21b1b7cf5c5ba9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8430e0662a216d3568eb4b163b6f7bf7fc739f5b55c6cac72833e975c2f19d08
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 05b55e4dda2d41d7e04a8101c87acab444f7bab55f4cc8360de82d085b13d8fb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2db7230ea18de8e2ef3fc7bc01d3409fc5cd5b7084449446d6470847c9210654
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2b6af5b89edcc8f9c8c52a403affed00edabad5f6c64d48d1cf1af76ac14114a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6f2e4fe619a0d2f23aa680d3f3e4ba8d058517fc72193243a7ea85324884ec60
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fe3a9cdb6df2346aa9c92b205a6510dad7c187094e8ac3b9ea1beb495c043d00
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 65922e3efa57387eb0d1cb242c4d608d13ac343cac92772248913a257c4acda2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4fb739d57cb68da05790a1ea101540c2911705d6d8bcbcc3aee2ff654f5b89d5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4cac5da395d1eb36344c9fb6626d21ef1a290d664e211128fb858367d96ac81c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 183d521032acb4de06b25c2cfcf786190bd8f9cefd7d80377199a8ae7abcab2b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 59e93e0388c868fd51c35a915c71df31fa405dee18f2429fa96fc23fc597f991
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ca808f508655f4f7ef5dcc82161f6e250162b32bbadeeeefc889f822deb9e280
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 26f0ea6e032c701bbb7bb4324549e57fbdcec591beb7c7bb0ff8a74deeff2fdb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c893e6be8c842b1738e306251690e22a38e51e533cfd6e90dd0b93d95155dc05
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 43bac45501774d2affc005d1bc79af39c565489f431adfcf295a68a3302e2a70
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d754a449c331bd1704cc42cea2b21ceef519a440bd85d013aaf26517188049a4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 23fe10e9ae1c82efb4639c7e28efd4c14e360846a250ddaafb67c0b198f14251
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ea0ce5477fc8c7c3c0418bb9ffd2c2873e83d091a942c9421cc89957490b5f49
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cca973a710b4e78511b6de8711d07387e4e76c03863cd1e026d1aae3303f0ca9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 032dbfb025605097c6f9cb36204b2bae3253dd8dccd1b2315d78d231b4def0d5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 aed974176f51789249cc720f6cdafc450b61b28edf16525837d49810e175c0c0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 789ea7ee2985e09bf586a802f253add53e16fbfe7ffe43e34fdcf4a22ee1ac64
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 988fbee24dffabc4c03bb06805070b565d0a6ed4c54e2ea9903080dc4fcb9c39
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2d3cd0df79373ad96e8f66bdc9e458eaefbf6cbc755c0f8a37df8cab8b43ab49
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 764605baf668e5fed666efc94418bf93f7e8b48cf4164f654c34848096a07900
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f904e4ef752a17e1799a76af9bea6e1e15fc7a8937f43910a37137fa3d94829b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3ef61704d8d93586201648c011872b392a97d8b650bd544fc44d742ebc904a7d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 78fe27405778a5b64c15f9178d8bf892c622859ffaa4165fc3c97e31e044d78f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7fd9e518df9b355f1ad6dc9dac0c6716dbe1498883f3e4a50cbf83a9ef2b797b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b5fc484d97cd22a832db7514dbf76c47c670e8863699b2cc4c80fd63cac9b141
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0b6ee222fe0722c6d563facaff2805e1577f3e577e5a0709cdb2b09ba0df929f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0a3afcdf4af84f70db87f916a68cc39ebe52b05d98c866c3e76cad999c5d4824
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6223ca71e28b4ed36aa0344265fcfa843393135174a0748543834cda844d179d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 611206ada7182894d2f7b28bab4f2218c7715fef79dc8a23fb3d1e48a688ca08
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5b59ecf7837bf404821a9ff890a2a9847e3a79e291c47066fff7d01a0951a981
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c64f0d68e51a63bf00994b61283cc110f923ee7dcb91ea086c5de1bb5fb860af
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a4feb201f611379b7694cc274cde41d775af5ff1c75c83f90130d3b37bde4cea
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8d0c05508b0c6b3b7e0384cd923032b8671664b9846a197adfed41b0bd0c6ce4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c1313764088a2e0900a7b95d0a1871f51a511a3a8382b3ae5db94d2ba6f32227
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 53ffabdb125c7d0f57f205e1e19e4799a89b64e52db99740f82b4a0b7d655dfa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5dffbf32a7dea98d03f558b15e8bbe89b65ae1ba6857ef6a312e582205a9a10e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9b228c2752f5c68eb84dd66d367ea866a89faa59ebf80aec61c1fa8f08aa489a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a74ebf6a2037a423effed8ca3613f54b4f89c2e504e0b83ae344319564def5bb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dab2b15bfe95c8361b086ab6c9298147ae5dca3f4b95b05b869bc40788ac7e3e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 491b0fb8c2ace15a51f709da430ab1a3cfcdd5c74536410296229378b743fad1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d2433185be510c03e7693fd17baccee1e99782ee930f99960f807efbb7ae83d1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 307e054a254b8ba5fc106916e9989ca7ac39397825981899b26db1175b550213
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 43e5885bac831fe7a0d4b7b1e0f5f36912350c168d93ea07538b74500cd152be
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0ac4836a8e4118a5b753a0fbe2ae67998cef96688ca75bde9f0f770fc25a4934
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 62bb4d6ba0fbe8ac56be45adc6218090dba2c9cb6d228621c0b5f4c7c654be41
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8f14a30475bdc3cbbecfef103c41fe27674a73d0a55065c20ca38a5cd3f19eca
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 273f0fc188827d17f744c00b06a3a220d40289de4629776a5207ec05c9db6c87
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b74fbf9baed363bccef20bb4d0c27ec44274e358280619aad399e5979f4104f4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c78c656ff2a0e78dccdb060f983f95f9058d099d30feb265d319f7c102f9ba7b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ada7f714528a69f601ca4abd796c57dee0244fa52bd3fb6dded2739855c08012
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1b4637d5ce6111b7328a38275d161af9c6e0133043b7e11e912da7c098ee57f5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 94677bbbddc234ca2fa5f156c4a826757e7db52610c0f0dbc8d86d0321157036
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8dc41b9a02449b5cf543fa2f9839dde5c463bdfe23b7cab82096940264ea86a9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 850bf41a944ced55208615672296575eb303680ac89d25cb180557549eed3325
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0e3e47e3a18352be2b2456a5547364dd51eedc85b7775b4e278bd42152974db0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 85a37a9b434699e87369b5d7d265899c53cae1817909e8cc0ad45221aef342d4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d6e43dbf6d6e7eba4299693b488ae2266754ca9075f1d5ef274d97785e61316b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 35133b7c3bab097233043f8348df098a1f0a33449fcd2d1a27a2bd2c83733434
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3380d9f02217c53da2a014bc6b07fab4b588208d8a4eed9a342b93f9480c5c34
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cb3d717a310f9afd8236f6b6c370ff2ad9606d55850f8786817c2571787f16d8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c9166aaf0572b7c3d16bf5aef41c3b466576ef9defb34111b70d59290861dc59
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8d7fe011da05c2958ac6dc3765b97f7bedbd65fc2d8a65e67f75701a0f725772
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7b719a9d0224346e61b45cd6fe78445d374404b24ee45929a62fd5f495e34cfa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8c13526924e1a1e6603c6383f4c1c728622949fc1f4f15c77fe2a41407fb4948
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 44c11b28e9e656bdd28be15eb57cbcad1f8e8b30b3abc3b3301a2dd7322c59e2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0c7169d7a2db4823352e83da7f5868cf920665f13fa345aa90bc0ad6ef6f62a3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 37929b177d196ada86426210fff7955ebc5da209adc0e30b7c690b30497775dd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 564d53b5bf9c84bac055f997e6ce4afe2c51673948f35542cf7e9c0a01134b14
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 164cdbeb5ec0f1b10459bf7d6bfdfc3ad584095912d02ae064a4b874a87685cc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1131d1f708b0edd6618a8ca953cc110bd2fbe0ffcdbd5d53d978b75b7adb817e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3217df484be87d0ed71436f27affb05eeefb365409a429729b59870499b51602
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 68e6fe8d063dab18f30318666e773312694da0bfa58749a85a53f61e8ff7e84e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 af5cd082eaef05fa694795c18581911b79de6b6d1152ef39b1ec25471d4b44dc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 de999597213e1a3946e121eef7d82e21b1a6df725b7f6d6fbb1409e9faf27942
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 156ca8f9e48706b5aaa9efb572679c68b4318eaac3f3767e3ed7a33c55a3b24d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 484f5c0a6f327f138466f3e0a1346657eae93e13f0c7d87316d671077647817f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d2f4f621b951a4c33f8f5ed71582b50620f10e2bbb59c3874559c9a4dc692825
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8e1187c5ca7bb1495d4d3e211d6cfa6225adbfb6ce5aad13ef0d03d83dec9cb3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9487c9e9178260f5b72cf40fa77fc0799fb9e0f704bf87d5ba0970131a55cadb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6a3a606c5c1c5add6a3b83ddc5b71c8a50676b9fad1860b413838d7154cffeed
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c56f8e9ddf2d5461b6b3e465fc4da0517d43a1b6acfdda2320c06696268880d3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1a6529751635fbfe4471be41f8d8feec7ca449dbead08075fa9824e9cc061d56
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ccb0fdd8f000598f6fddd1474bc8158fc56e3fdd2d6cbc675232299752f889de
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e9dd86daabe06ce6108a0bd75d71e6934a6869f87099bf0ce85dbd8de4235b80
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c73f57644e66a1fde1508ef5386f2874e260647e3d0c01f5cfd9b132e7309750
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 33b8a2151d9b05eba7ae7ed087bb4e0328a4c27c1aa13f0e3627b2930b7dd6f6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 81464558d07724500ee31424be956a9f4169ca4883d261efb7ebb667b7709433
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 929435e1dcb719e8c4a442578400a05c07632f46fbdb8dfe82d36e1353505b89
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 44161876a09ac9379d9806debfdaac90964b95366992d58ecc19a65cab0cbae3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 80a8c3c9a4092e9cf132a4419338b472fcc7e61a8f389c3e85d063fe6ff9592d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 432a5dd232e472edfcd4a06bbdc01669c8bc92ac75e0b951ccb83747fbeda8b0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0fbe12816d387a8d70b6e2573bf2b956ef4ddc21c20f0b9a0c12d6bdf34816e7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d47ce7e722ea2dc708a354255ddbb168786c5a4c85876d994b580bec51f5a6f6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 78658e6e62bdd25159b87ac28fa11bef4672b5a836ab2ea5ed9deb28722ae189
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 28a03726154d7ef0f7a0c2e2688ac199097397367862d8a6f17202ce09371c70
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c9a2d896c319eaf9e5e1842a1394e89c9f861b408aa19c29f4391f6ad0e33f17
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b8fbb9a71ee5457fab18cfb646964c5b44ff5e77d90488b27bccccc121c45663
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6411d5f74cc647b8e102d060a372f2e886909ff26994d705b9100b4d06d55ef2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d2561ef60e2eda0272c056698a62f54302cb4072d3843062b6c7069e44343e9c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bfdc07a1e4a1059fcf909c4bcd76184e374ebe91e2736357d51f2c33e11a34ca
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 37bf9c871c048c254985cde97cfef661f0e0158bd63d3dfe93d6ed01c38d7418
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1e80a8e6911720fa517296bce0256f9f07bb94ca8514d77d76cf0dbcba3f5de3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 09fbcbbd10738ece0b0c75369a551ba1576e5b957f8b7d9c52e569da3831a822
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2d979a53e3d0080f66f6bf7197e76c507cc3d7285c8539dc6e5ff0ed88afdfcb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ec71b4f935f3079e6d9beb3926ecf62e00c89cfb8888cf8cf1fe8c7448982e9b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6ef735dd3d705451cc1b07e90e0ee01fe911ca320192ed78028a9ea22efda6ed
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c99ac97d15d8a763d12dbb6e2ab65a597636f71bef0bd972406e85d4eaaa2023
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0b571d1216501d3b75131cfd0de461de2b6a633d5f5a463bcb24855ed4a228ed
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6346983ce02b96222b09e840733e8ddac974992aa31e287146a19bde16c91cde
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 aadb7835fb0b3f115ee705ea83c2c0a7ec448741063803c9823fe2e98f9c08ac
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d44aef6392d9fdcb5519a9420da50ddf1ea2fec4350950239d55dc8b155c826e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c0bd4dd8ac930d20d7a9f0720c33efdcd5a3da7cc8dc1490fec3d35a7e7a5872
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f63cc35990cd2179890cfc7c55fe9a16a7263d5bf2ec54af69c26182234ecdc9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cfdc782a9c5b88d42ac8d52a48d851334f5f2a9f3ab7ca6292485907be6ca722
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1b381bfbeff127a1db0faab988d784d2d9776f333b67bc06d2dad3c79451e275
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 513b3da111abe5b9cd47d9f67590f7f378516995feaa2cf5f30793078a9335d0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6004b1514e762a193b256221b750582355e8bdfd6c05d6b472ea02fb79f33af7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5c63d9d9f8d7e76bfeea91d175bac70d829fa1885063b336f798be02ee0cbe22
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a61c51d7ffcb8a6b9eb3583f7f08e1c88e4de2026be5dc8dcc5a46fc5909d26a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 da0167d2b553f38b8c2362ec037f092dc89e26d9b49fae6902d9c8e7e59b9809
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 608c7665c4248f314bbae55c90c54a736afeaece3538326a0a623d9e34a69053
          • MD5 SHA1 SHA512

          logs.dat

          • Path C:\Users\Admin\AppData\Roaming\logs.dat
          • Size 15B
          • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
          • MD5 SHA1 SHA512

          svchost.exe

          • Path C:\Windows\SysWOW64\install\svchost.exe
          • Size 418KB
          • SHA256 b8fdff65cd95b08f6e9554606e29bd9431ac279fd688e4f8a08cf4d87d15a9e7
          • MD5 SHA1 SHA512 SSDEEP

          memory/1440-24-0x0000000024080000-0x00000000240E2000-memory.dmp

          memory/1440-11-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/1440-41-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/1440-12-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/1440-154-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/1440-13-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/1440-17-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/1440-21-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/2524-0-0x0000000000400000-0x000000000045A000-memory.dmp

          memory/2524-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

          memory/2524-8-0x0000000000400000-0x000000000045A000-memory.dmp

          memory/3672-4-0x0000000000400000-0x0000000000408000-memory.dmp

          memory/3672-6-0x0000000000400000-0x0000000000408000-memory.dmp

          memory/3672-16-0x0000000000400000-0x0000000000408000-memory.dmp

          memory/3692-183-0x0000000000400000-0x000000000045A000-memory.dmp

          memory/4936-155-0x00000000240F0000-0x0000000024152000-memory.dmp

          memory/4936-197-0x00000000240F0000-0x0000000024152000-memory.dmp

          memory/4976-87-0x0000000024080000-0x00000000240E2000-memory.dmp

          memory/4976-191-0x0000000024080000-0x00000000240E2000-memory.dmp

          memory/4976-26-0x00000000016F0000-0x00000000016F1000-memory.dmp

          memory/4976-25-0x0000000001630000-0x0000000001631000-memory.dmp