Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/12/2024, 19:29

General

  • Target
    f56a56e901edc9c07bf9ff90a5432c9d_JaffaCakes118.exe
  • Size 623KB
  • Sample241215-x7khvawkdq
  • SHA256 dac89a4f732266b30a78562e87cac11a941bf6ae1cf3142628eb3afa1805aef8
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • Delphi

C2
  • azq.no-ip.biz:112

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    svchost.exe

  • install_dir

    system

  • install_file

    windows.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    123456

  • regkey_hkcu

    explorer

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Cybergate family
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1176
      • C:\Users\Admin\AppData\Local\Temp\f56a56e901edc9c07bf9ff90a5432c9d_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\f56a56e901edc9c07bf9ff90a5432c9d_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2100
        • C:\Users\Admin\AppData\Local\Temp\f56a56e901edc9c07bf9ff90a5432c9d_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\f56a56e901edc9c07bf9ff90a5432c9d_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2388
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:1872
          • C:\Users\Admin\AppData\Local\Temp\f56a56e901edc9c07bf9ff90a5432c9d_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\f56a56e901edc9c07bf9ff90a5432c9d_JaffaCakes118.exe"
            4⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:236
            • C:\Windows\system\windows.exe
              "C:\Windows\system\windows.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:2188
              • C:\Windows\system\windows.exe
                C:\Windows\system\windows.exe
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:2888

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 229KB
          • SHA256 121f21fa8f3b07c58d15c35c24fe51e0962b4c4194e8382d4661581555ee9386
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f055255eb54e21e5d7302c02dcaeefdef6b40063fa4f99d9b6b56addae7ece15
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e16fa8eeb8720fab8a9131a0c8e350187e57ccfe733c9df327a2e6c18d734895
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fd93ddc3bf45edcbaf721391e2d52ff05045806d861dee2b872fdc128bc29bfb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 303576ccb2b2692af5b4b0949baba8eae33a918e8dbff569cdbba8dbf13a6316
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 34b12192ff0eed94df8752ca84b46ad61b477681fc81f7389391a9b7876427cd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 514bda724d6e804b8a156f04a5108af0d825e56590cef759325a48726289f3c3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e9ffd2b7ae42a15c4d0f63d6b5ac7d9fc04dd0c389e5a85f0a56f69ca70cbfd7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5bdc71f7c68827bbd20ee0b66a3b5778ddfe7ab91325a7aec6f16254eee71290
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c6766307d9c7e5223c70e1ec67437455a0a1bc2854fdd011d84515f61e72ffd9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 260b8dcd46e3df9e32745fa69a3363840013f3f3a33f3fb9111c2c8d25aa872b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 170dda22559df5288745f8f702430b38b0e84cb99a7d0eb0cd2317f385a3175f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 705a8a39e959c798b9e51aac4d84ecddefca1e1ec2334dbccb7ba121d612610d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 973dd98d14b74a89d89fdde9d6d8b13573e58cdf0cf36a2b88113d2ca8bbb0c1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 61386ba4dea6eb0fae79fdb8130bea0ad2a753452c675c3d94c23f4ee28c36ab
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 314b7efa296c3fc585e51a6d55df347413c1a698cd170cb81fd228e9c304381b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0aa2c8e68b87b43c3f47796eb12f8ac675ed30dbd92e57bb95d46e108b01ef17
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 49a0c315bad9bdad2f85f131a087dae487b399fe6aaeb386e210cb5c3cabf632
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0f994e63af2cb34463be035ffc0c5487b08f5dbdf244489256095a159116c67f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d55b6a4f4c67ab5879966b24d9ad453874591078c76c3858d6b64591c3e1ee63
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4d7623763cc46827c6dff6eec71c993694f2ee820ff0188f400e6597f1991f72
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c5dd5e92a485604b7fa3cebed9d075f7896eca093d570d100d2d1c4394d965f1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ba24d9d52c043cab13071e68fd774e95e4daf3cc0a244ab12e630fcec8b0b431
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9b5082f2a8645a619efce82e096532d525536236e0d5dce3df79460cfbc35ee7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7cf86d3bfbcfc05ff1dc713fc9dd744ba6c596ca43beed001b4aad0f6fd1e85c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b6c5c975f75c843054d0959fcd09cfd91b36205348b30830a30cff66e7501798
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dc2d6597f333a6279eb0b21abb6a3d0738a87d38840ad2408265b0248d84aa2f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c5ddc163be884e749ed066595ced3f07c6c8a259203cad230cac441cdde03631
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 47d4ea115283670bdf180c6bd63e942b210eeeb38cde5d4997e14891e751d1dc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9e564fc7931886936c209717bca3efbeb6bfb5d3addb18637e5eab71736bca28
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d78ff614854509f7b6fe79ef515712d94ae6b4ea0b2e4648fda07760c2f24743
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 124533bb5cf558fddeadbffdb329545b90fcdaa9fc8a948c900f7cad839fff1f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c3fb86d2d6b73cff0703a8c884c769714b1b51af5b6d5523fcc0ba8fa1edb4a1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3707b7b9a35c17cab2567b2318c8af193e556cf66377fd669380c69e4e7fe94f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f6bac15cb3d2157f16b2d7901f28b03aa84d85297806077841e7318c7c094ebc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c3a74ea387988725bc619e059ca7dfd4fb9cc34aabec94d400869b5c4687193a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0f730f63f46323b2c2f9ac34937d34b5bebcf0eefa18be57254809d2bb767922
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a73a80403ce2ff5ec100c20e8800d7763587fc88a575f1700ff70c90d6d64790
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 39b5c4f1daee636eb876354185a78ec2905488686df60c23245affa9ed1bc7df
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 00e3f1aadd282fa320aa565ab7eec02f81b52dd6d6ea08331d59fdc618d9ec2a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ce731657983286511d03ba884862c5ca9cda1b8c83a6df14165b4a67a29e7b6a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 96fe67d0cf814e4954c4f61cec2dfea7bf348c84aad508c382b91f48a9e7f12b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f7bab65147f3ed333207d07526a4115884392decb2b273fbceaa0df0d0af1280
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3b141eadbbe5d176a404ad0a8ae3edd2512a6294d88c2694f64dce04242253a2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e6952c04e74adcc924f2d0afcc39b63fea3b72455c4463847a8cda1f5eced6ea
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0e54f85735cc694baa9322e3529ef81b5ed65b64279a1c7f63a911c2e62e21c9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 11bea0f26208189276b2e0f116449eb23821727392234a8e14e2e0ee9c783df7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 40c3db878aa7e4d18cb1884658a0e212faec7091cc5a85d0ca3d2a050e8c2ae9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 18c0b3b4c219f4b2210f73711cbe3184e4391facae8e62d2a4468c67d79370b3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 004080e3ace5d87f2a1290c4498fd7e93fd985cabda39fe102587e20944b23b8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9d56da90480eec7edeaf3ba93c8774ed0da6d7c60bbc6a2450da3165ab98d0a1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a475c04f33448cc6ddfcda9adbaa9870bc61eda65c3c2f3b4bcbf377f10e82a1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b463b408678b10d73779ef5dc9af9b5612fa206d91f8f2de0769bbc71acb1384
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d46dd16768f64680e7b0c0611177b17411bd3a1318164a757587b0d3c020743a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 50258670da07e1023bafedb259c1a295587aa99e7b311c11ad703d6a5271c371
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6cccbb836f46153b4eb5edbb7a53ca9e5e0f8b21b366edb39aa510142ab9d5bf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 71f2c84d8d63863c90f15096e7787e6e0b47e38c9a36644a517bbba6b0262154
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3b589d509a3dee8b050c8a870d7798e855c3272476b972ff05e3ea7a7911763a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 79d8dcc56b81da66a102c6b184809f00ff1d42885e2cb57ac0a841ca4b6bd5c0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 87dac634c2a699023bcd960d78e980554b70ee9a3c40f4e5759fed4541c3798f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2f88b1ca594d49e1885b0d5bf2cac46f348730100e21e68c82e229626967c189
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 18f1420218cedeecf2ff2c9a89302bd77c92c0a7e3440b0d5c0afd2039751b89
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a36a5db5e8995282348a16454fe0ca823e77e44ded68ba370123cf782df7da82
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6060f8cb5be20d783e2ae9e3dbd118796794e0c869a6b193f15996ba8801d373
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e6c1422972025fe39eef75bce2149c6ffa715ec71fe62a1cd12ed77b526810ff
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0072a5d0fe0645637ef454b3cc565fdc4904313b030532d73c8aa7d2f0a23675
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 483247023b9d8455377193eecbe82b08ee0565d67b347cfd996895fc36fb67a9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ebc3992bae8d9f70e037aecf198d5ce14036828017721abd5a6bc09647279dab
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 68e9568e5a180e144196ae5d2a3b63070ce98323e994a409dba17f9c51fda93e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3dc1842368fed424db57ee52e66bea7e451f0c7768510e7dbbd4313cfebeec3b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9619ee0d065c5bb6ac78334c9b6050908be3b0a9b4f51fa0a0e3f0bc0b563d53
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5b514063a4a580d01c80a94444515b7979111d2541efa953fc2eae304f363eb0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bce88d968811662647f205a7ca413748e78d7601f45a7de9c1f5d16e5f9c587f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d5ff792da25618c09f2a9e39a93925a13919784798fd403401986748eb7cdcdd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0fe1cf2c1f733ec8c5d812deb5c7b69dce8b23312cafad478b8f6e6261f49833
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9aec6bc176333c45d61ab6567d3c0974f4fd78c9760ad82fbfcc2fc7c6bfa852
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 002e645986655b48d7a6c25af59aa15d2ab292e19326925a0f05affa8a1fb33a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b17bae914283e4478278703a8c483133bd710a60fe710c3a71d93c85c09566d5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 240e180c42815d2bfebc16dc2ab53b3537c4905742570ba6efd2a715fe9a37c5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d336fefa177d2495876cee1b5d39cb25d578b2e9bbbf6eac3fa1ee5d410f3067
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 05f22a300df525adf2dbc182dec094d3e2047199d8836dc391cf4101bc9630c9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1c8949dab0c4d9caf8e492d7cf7a69cef20a212da74dba19943a5d50c39e1e29
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ca2293d70edbbf517a174f155092eb769a660961db833eb7841a3a46fe566a91
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 24fe8cf3bff10f9a3898c54258d3ea652da2fde71392199ca7e32cbd31e90b17
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3033ea4f9ab0dabdbc105fbc096a6c2a61b1b54dfc4fd797fd3bf99dbbc4b6e8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f652b7d9fedfa54e08e08778e6990f4399a4c54c515d5e33a716ab374bd37d5d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9b4ce455e1d18a91ceb7b1087aac52ef309901b79b58a3111c20c54f934695da
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 514782f32473e7da3c122b37daf79010b73b307d0b1f1db12f9271dfe6c42091
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8f65362e7058502ab2d368acff1f1a09a01ba5972d47b88b57a349efca71dacf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b6d100a8f4a35af837b13cf126137e9563a6f364b6ec71d637b729b8e329f661
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 259e7d1933514e34309470ee7b7215f582a9d88da819aecc45655f55553739b4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c72cb3de099cc6920ca8cac44cf5e41516412121e1958babfc242c4dae0fe5f5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 79cf522cfeba46f0e3141a71fccc7c0bf678b1c0b863af7bc0e2ab94db8ef46f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ffdf4245316858bc9c3e6362608fa96528e2dde4a65263996794a1b12963e3eb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4e5da1f5f9dd697174e215c355cb0a669a41926c845e784eecd3c15a670af0d7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 48d384acac6c6029a973d0a4c6f76c217b5cdc8c342ded8a9cd7d9cbe31098a4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c3c2c7ec7ce51e029b683dc19bd6831cd3b536cd8efd6ccf4ea314a065ef646b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9f22e19a02830b80afd2c6c881889ad1be76348cd377a6d3cd7adaa966f5c892
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4cb9f5f5c0b96b265f3acc7e56538af3c5d659bc7f953799d4de649adf5d6fa1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a48306345cf5bcf7bc05e710c0b33e68b9b987803a54dea6ee0ed0368ca592dd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 efbc09f281c1371dac74c2a9ba8e11ee48d6e5220f7f6f91727b1ec5f7e1e79d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 98df272ae155869a26ffd27128d8487b5d5157f2e4c73140ad11a3cdf41c0d85
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0e38124175d08d105466e9a429b7d900a6397bdb0c5def1e42ec6838ea9ba494
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4bc5b6b72c6fb00352a2d529bfb9bd0d0ceb374d65e037963b265d5439f75941
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8564154f76b1e2d09cf01f8870c4b41e7fdd40f31832e0eccc642a1eda213773
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5ce51085ff39433485dfad90ca256acf894d99fc0b7eba03baf6df13f74b0709
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e988f40c1e5e53e8893aa4cc4cd9ddd125e096430d1519a9e12276c1637bac04
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5238aae949f4837d04204deca5079cf215bab9a53efd3551996cfbeac23db790
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c17b2aca20e56e07cfc9de039ddc7add39925efa0551a0f1741051022727a0fe
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7a1a1432c219c774440d8963a73036617fd03a6f35573485d6f4bf9919d2a881
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 88af9dee731d19b4669082bd445a90ab0de5c8c5631869740a164f656d606916
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 67337dc20dd32055a439a67759da1e1955c06be1e4024c856e9cf099ef4fb39a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 751d54adeb3b0a05f59da6ae679909bf12d6c43157499ccdad49ca95b6cf1df3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ddfef951b2260a816e618090e9b017571bc36eaa7fb5222c48622910c000ea6e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ad00d61933acb34881c13db0350bad01c496b1fc3a0ac62814e025167fb008d5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dcd0b5bdbfc6bbf7e897b56e53ef7aeac4d91f8fb253b636d7da1afa0860a070
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b366d8310b875ab3aa6e336cbb5b017afe98b2048f25103e914d6d7bc3ce350a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 22774f8326bd2266702bddcd1ae8ff37a8c8e5fd463dafd0effe080fe6fe0106
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fef6e96758329d4fe54cc602bc44c8606522b4c28c9a05b821745da287694ab5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 48f7edcbb31e466c293df3bfaefc523fc564f21b439d38026928bb9c6b8e229b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 da84e4440711a8b8dc1af6012ea412a92f5a39e6ca1907b54a6cfff1a1567546
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 00a43a72ffd3aa456dd59e5b765a0c0468d7d5883d7ad1736e4889320183ddf0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 657afd832db995556b32d708ce664d4e872a3d5bfdb12e05906369065518149c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d24511d2d91bc79686c7c7e0e5f5e18fab8f9b7b6b1c249a432f4240820a72f9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 633e5440c0006d744c0b7f26b2b39e7bbf1b51922e8c72054f20a2a964f4b054
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bc8d9d87911f44179aaf54fa4556eb49a98967511bb61d9110e2376eb1bd4077
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a4d4770331fa4aa5ec11855a5426b034dae7f630dc365ca04719c545cb0ebbff
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f43fa1d09368d828d5f63d8f32e95481bcaedec6edc63f936d91c32cfd9aeec1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8a48e48e92fb5bae71b6ac443081a8c4048952b69bd2e68ce6ecf2a08e96771b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 238ab7d6fb61297a0765d871a1f1cf9ef2a6e253984904e05e853b833146018b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f70da7d7ee66f5a86c8cef81d77461b870692b63490f2ae4df5a4e813b1358d0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 96005e437e5fc6a8080864bc2dcdeefcb2276a5db004e72c94ad6a4fa71dea1f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0bd20f3ea836fe1c6a513c763a14254e3816268a3b873d13e0f15ba8e0a1c1b6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 63e8967dda70e80c339e17f14e16a8872f25e4d984eca492e02e4647ca0e8207
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f478cc9e35c2f89121bb7ec1084fef01bb177fa096b043187dba1b0e5921058e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5f3057c65d946510bf5d775c15ebabf43257e458320abeba3abd6bd5e2a73190
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 12d439422d23b52f29dca205cf0a7034a685f4f722d9f0e9df539da68f3ee3b4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5226d414a5bf100cdaa64e11ed033c6332d4be1c6236a62161a41624abc2d287
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3f9d63ce9e6de0bb8f5fe0684e64a3fac450b00ebefbbe5f8b96ce1ebb33237e
          • MD5 SHA1 SHA512

          logs.dat

          • Path C:\Users\Admin\AppData\Roaming\logs.dat
          • Size 15B
          • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
          • MD5 SHA1 SHA512

          windows.exe

          • Path C:\Windows\system\windows.exe
          • Size 623KB
          • SHA256 dac89a4f732266b30a78562e87cac11a941bf6ae1cf3142628eb3afa1805aef8
          • MD5 SHA1 SHA512 SSDEEP

          memory/236-659-0x0000000000400000-0x00000000004CD000-memory.dmp

          memory/236-992-0x0000000006B50000-0x0000000006C1D000-memory.dmp

          memory/236-1020-0x0000000000400000-0x00000000004CD000-memory.dmp

          memory/236-1021-0x0000000006B50000-0x0000000006C1D000-memory.dmp

          memory/236-1048-0x0000000006B50000-0x0000000006C1D000-memory.dmp

          memory/1176-46-0x0000000002D40000-0x0000000002D41000-memory.dmp

          memory/2100-11-0x0000000003120000-0x0000000003124000-memory.dmp

          memory/2100-0-0x0000000000400000-0x00000000004CD000-memory.dmp

          memory/2100-14-0x0000000003170000-0x0000000003171000-memory.dmp

          memory/2100-13-0x0000000000240000-0x0000000000241000-memory.dmp

          memory/2100-39-0x0000000000530000-0x0000000000590000-memory.dmp

          memory/2100-9-0x0000000003130000-0x0000000003132000-memory.dmp

          memory/2100-2-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

          memory/2100-12-0x00000000001B0000-0x00000000001B1000-memory.dmp

          memory/2100-8-0x0000000003140000-0x0000000003141000-memory.dmp

          memory/2100-16-0x0000000003150000-0x0000000003151000-memory.dmp

          memory/2100-17-0x00000000033D0000-0x000000000349D000-memory.dmp

          memory/2100-7-0x0000000001E50000-0x0000000001E51000-memory.dmp

          memory/2100-6-0x0000000001DD0000-0x0000000001DD1000-memory.dmp

          memory/2100-15-0x0000000003160000-0x0000000003161000-memory.dmp

          memory/2100-10-0x0000000003180000-0x0000000003181000-memory.dmp

          memory/2100-3-0x0000000001DE0000-0x0000000001DE1000-memory.dmp

          memory/2100-4-0x0000000001E40000-0x0000000001E41000-memory.dmp

          memory/2100-1-0x0000000000530000-0x0000000000590000-memory.dmp

          memory/2100-5-0x0000000001E10000-0x0000000001E11000-memory.dmp

          memory/2100-41-0x0000000000400000-0x00000000004CD000-memory.dmp

          memory/2188-991-0x0000000000400000-0x00000000004CD000-memory.dmp

          memory/2188-1017-0x0000000000400000-0x00000000004CD000-memory.dmp

          memory/2388-25-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/2388-20-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/2388-42-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/2388-40-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/2388-35-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/2388-32-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/2388-29-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/2388-27-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/2388-22-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/2388-18-0x0000000000400000-0x0000000000450000-memory.dmp

          memory/2388-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          memory/2388-658-0x0000000001E70000-0x0000000001F3D000-memory.dmp