Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/02/2025, 03:54

General

  • Target
    JaffaCakes118_b2b4cb3b0ff95186866221d1ea75a09e.exe
  • Size 332KB
  • Sample250207-egekssxpfz
  • SHA256 8ba3de290a94503b4ef3d21622edfa559019fa459a3ab03ac3b89f21a810f721
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • explored

C2
  • luisnicaragua.zapto.org:2000

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • ftp_password

    ªš÷Öº+Þ

  • ftp_port

    21

  • ftp_server

    ftp.server.com

  • ftp_username

    ftp_user

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    cmd.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    windows

  • regkey_hklm

    Yahoo

Extracted

Family
  • latentbot

C2
  • luisnicaragua.zapto.org

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Cybergate family
  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Latentbot family
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3428
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2b4cb3b0ff95186866221d1ea75a09e.exe
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2b4cb3b0ff95186866221d1ea75a09e.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4476
        • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2b4cb3b0ff95186866221d1ea75a09e.exe
          "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2b4cb3b0ff95186866221d1ea75a09e.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2124
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:2944
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:1156
            • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2b4cb3b0ff95186866221d1ea75a09e.exe
              "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2b4cb3b0ff95186866221d1ea75a09e.exe"
              4⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:3848
              • C:\dir\install\install\cmd.exe
                "C:\dir\install\install\cmd.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4192
                • C:\dir\install\install\cmd.exe
                  "C:\dir\install\install\cmd.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:4636
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 532
                    7⤵
                    • Program crash
                    PID:1632
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4636 -ip 4636
        1⤵
          PID:372

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 40c62a079b2f33ef70a03e704d47609fb2f7af2e220e8a5412fecba1fc3dea5c
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 4263e934f2bb1dc39d6d55639e06e042be014963163b7a1397417e5cc59c743e
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2ad07698b2d3c68a49e526485f8d63be75b625576a3ba6358b4ff8a5db5e237
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70816326be555e7d16f0611a169fe9b2154bb30383b4bfe7dadba86e8fc6b780
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ea7d638545b468e8c2c1f2e1204671bde19763d6e6f54bd340a57e4a1d03270
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e8fd5a8725da52ccd096fe6df7e373553d87406c195493ea32b2c6aac00a601
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe7c758a8929a831a6d651c1df2ec2701a19baa9fce6e52d04a7c5be56242929
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83cbfa772af30ee523d5842f5bf2966efa7f38dcf5dff0f4f4e0be745b0deee1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b20021934dc4d24b05c9e7b31a8e2ebeb38baa467287607da55bfab595f9065
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53854556a5d0ca1da4ea749db8fb5ff9b676ca304059108f30a1beff9e17f2d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c9ff004c57b33c4f81576920a7cf74b4a70dd694ae46f60d7600b1b424d7a77
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b054fb7c1e29b6a873d409bfa6ae0dcc5c5787ef17060d71b3712c61211da89a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6495080d430378d8b899949a1f0a6389cb628847e38914f21a5a2cfb4d32e1ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c378029d23551351ac40fee36508ba98f9d50cc8e886e9cb9d7b456f1d86d697
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12a87ee547d157d1f067b95debf4c02878039906ccbc755155c1457f8a30adfc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 363b10ebbbef45aecc85c9b9ddc9d36dc6ed3fac1501bf8add2902acc0331c95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ce6006227b15d6b1bfb759ccc26a4760d28439f8c84e28f91b755cf46f6556a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c26e0a286a0ba0b675f24515e0ea671f6ce6fe575ba4d5da31d10bd0842ffe4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 26e93a100cf81e8b884a123cbaec579cb4f2edb054b3d3b37a73945a3e0463c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5974dcf6b7b637236af7e40dc8a769b1771ead7549c3edafe252f72a74880461
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7955dd1408c6f36da2b9b782c8de22a8eec3177128e4b61ed05e31efab4e7587
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b905c2911480b3bd746ef5149127fd18ade5153c21f373b76cec97587378b139
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f835718137c8646caafc4d65d285778fbd02fcf921947448668e62685f1a1115
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d090f57ed7932c285b064f6e4acd56df583290fcf2b3327848af3149af5e7510
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 378f042e25447d29aa3b4110504acc8a3304df9b43cc74ca9ee01a8dfde94e5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30bef72d4ed3b4d32df5c5ae4a0aadfe821cc11dafaacbcacd7a6c97bef6ecb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4acf91e38839e0840a426bf6d51e11a0da498667f3f3a2131abe216b42de45b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 26b9662799c22e0368c0bcc26fab459eb2045ae58319ee4a7c2ff36d58d22884
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 88892b3836401cc1e5d5b318a6365c3047eec5ce62c312add84a570c64eead56
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ec58d682e9b8e664aa27b25f1667797c8574373216267f4163c0fb4721275ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2dbb8ca034a94be262b4d3c76cb106780f241013037b1376830b68bc9d56aac8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d2e10a88c9b036a9ce90b99ac5a6f55189f7579f302bde849434e6a4236a4ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5aab8c55611579472c787cf81ed875f6263ce5d7f2a22eb46b73e48c937bb52a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9d8617c887e436b8890e3c6f38dcb7e67ef69c20663442460d867f8deab2d51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fbbac7fb611e554d78819c52ebf4a83f763e2f557b26bd2120aa4b014dc755f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 807682a67a3cc2bc10ec763593fc7423e034c9e0e8ca46e056419c3b023dda5c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 05ba31fc0561f05826a55a44fc43d44b61d3a3cb8996a8ab73a7b98cdb668bfe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afea5b7606615f66b77393c8decd73fa5e4e1e5a5e1f49fc84b69db7ecb60a1a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2029e43aac1bac22c5ca1080e07256ffbeb9f28b48eaccfcdc316fe8153f336
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 059e811b11f285b0da546e53dfb27699a09e5c89c30fed4ea38749bae042cf1e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b35e1657df85712493739fa9feedfdb42e0f63d5f850c23bec7b84ae8fea544b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86cd984938ba337ecc5a9ef5520488db9c6d3d1ecb7915851a27b2317fd10e31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83bd68bb69051caea8d2a6166237421735ef227a248706f9957a659ebc113f09
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3443a3f9c61c7c05b4358e4f40f1bbde5c2927ca16bb8b80483c0177573a0ce0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54f211e17f07da78a7f445831a2a3ef93a5e056c3d848daa0de20e49d326ecc1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a6430b5cc45de927a6f9302d438e2a74c59efbb17bd6227f335102ce8f13e937
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6bb53fb78a82742c0f4204f3421b8f1d08d038ad50ac4445a69e520b4dcca59
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 111ed999435c1f1d432b45b856f5bb13cfceac10aa844cdb2713b5d7cdf3ba51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4674beb7313e8cf158f54ea1603a67b198d38eaf28bb6fdb3b3f88224e6a5708
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f0af552118ddeca7a1f25044aebbaeb09f44ccb9a990f617417e2adcc9b9281
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 edfd9a92ced434f689f2ac99f50bd2d7707fbc4b666d3d5e4844d80aca92c32f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e856cde126d64ee97c3a63d7d7fd6d2d6496c1b69a2f8ad39c0a69c388aa523b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf5724c599212ab0f26b4cff52a4069bea73f840d05b775d138ee254db661be4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe401fed1d9b1bb37a75a86ed642f0aee929a831ff4839c8fab1fafbe9054f58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c033bf63a8bc94570482a2a7d48b7cb86cb47cf5b156b3b90b2fcfad0d8190e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 626ecd20c93629fbc3ea8345618a2c9aa5f65132ed0b883f9e8a4ed3c82421a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cee200ed0c958c5a3024f667d86eb5d42ae9b8976ede6aa97d069472869f08aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 862ca3585099cb826f264cea15cb12612519a9da33b7673a8588a32a0b01a1aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff779a6d3e76835c90bbaa6f02dd93a92ba3235625e2b982e6c020799ef5e1f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5bdbe798faffbfc587556543cece3a0e798994b9f166db8fb15779f6487507de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aefd8bd3e75e9094d2b55a9f8516b0eae86398781ddca160a4efbf45dedb76f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6fcf3bb2e221388a923fe71cbb0b0ab4d35a975c26b79b43e65445a153e2ca49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 402e6d4dfd28b910cf4e0508996a9617a90aabcd4585b82c6ce2b05365e0ffda
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c66f75fdd4d2c3f8528338f0c9bd6441357d536ad8e09521d69c1aad11a0654b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1859430054979240ed1abb3cf1a0146a6795bd11b0540dcbb312b6c9ef5f83b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a6bb0978250106983a0d67a9cf7663a4fcad2d2f35eeb05944b6981a0a19abf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9bc03da628ef0b7134b999d87de734002577225f4a6c0d252a2fa20730225061
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8339ba172063b5feb30363475a5d12ee1d4fb3ae9c11262761fd29093b9f65bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be29c970e3027c34e28c02dc23173d650d83ba1d8d47b2b946bde419b48b986d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f16d6fcea21e6987a4ff3dc3f2382a396e8a557b361ef77a8a913f2881b8646c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14d7ab31556c2274f8445a7e55751bcc69b22dec62415663ef3d82f66a5d4f09
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2be37fa23df180b4a537e4eae1c196f2b86dd2d6397e08d18cc2ebefd2345923
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c5c5cd9414984deda0cb986c5fa0c9b588c6d982a27104e35679381a028678a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fbd6eb4456943c9e19d04112d983969e14b68d0798ae666692b7efa0a2fc81d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc495380bbed038aeb2c493984827695a7b40ead219382468b8ab06f3028c5eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6edf32b14fffa602740c2020c52fef1fc52ac5d208efbca3e52139a21af30cee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 04538707aedff175b138cd13ada5ff54b8da8636ff3f3e3a6dd1613e3c4e2ebb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86cdbfa0ef495b2d3c40f2ce2ed3926c94088b206155e0cd4366f71f922c5719
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 07f42e3d62d7d1d7cc4535c289c191ac804a0cb80a57cb8edf31dd3ea6d8ee1f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 538007e5f0a12472967b73308d11e05d80a1fece29c9259005cad329d45dbf1d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 461a071b4ff871c03c84cd875bc78a48e97fe29ff0594d079e7f361c2f53b91d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffdc5deca65543a8522342de0ece4d82e2d8e2cb2241f7c882665d4d37dec170
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c89b1a9869e826e9c336089face2d2e0965cc9874cd1c3d458315df3c2657572
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0dbe270a2080d81c3c25e2418d76e5abad07c142fbb17e5c229b8abf3e9bf080
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a9c8e7da2c5ff31be7729fe1178b0af92ab933fe9b655bc2a9c0b9de0ff9aea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c6a16e959a10369edfe32cbe2dfd6f8fa380892443cf4253c2ee2c7db600921
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f35d7c3db13c4dd6e1ab00690b8bed4b3080b52da09dc88bba5db161e2b32fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b90ee573c4136ef70cdbfefa3e23248627a62c133b3df2b904eb1625db1293da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0129fafeaa5b77924d86c9d7148477c65900d2ad6b4db2222d28de259332867f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33c93ee6f73642bd10f65721eb391bbad9c5eeaf508a109734b47b2c9558bf4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7494a72debb716a6450324eaa1881b0fcd76abd265bf294f9d11053dd4ee58b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9f723f3117fa7954bb4f28a2498041b674f7ba93e05aed3377354d74b7c039a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cbe6d7953aef1f2470479b93d1c98428311beb3e265b6adeb8072c74c900af38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43902aaa6ce93b107f467d1a69252840631dee1107c0bc846773f975ccdd565f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 917d2662743aa0e84d2d7e39594c823eba08294d70ce7925810e08937fbb9f0a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7bca2201cb12cea50125b7a05d58877cc570c0aeb83158f45cc8cacc3337493
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2aff53687139e0130242af40662c0644b57e9e26cc92d372060b20dd010ba828
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 617be1fe7f3a82ac392a258551861d59c2d643a7a2a0aae256800681e590e90e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6d01000b0b7cbffe738f5c11cdf53a58beadceaa59f33b8f690b2d8b9d68704
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 956bb8569f39539d346602003ab91e67f5a1970d6fb2c793a29533120b73a12b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e668ee2eb401e1291b31092226e0a2a0c18c460eb29e00b6fe1d3658ef8e3b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d93c8aec4178975f8b81ddac48fdf693f4e096e0100dba19be0c23e87450843
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffdb42c8c34b156a8dc2ab73086cf751f793ab129022786ac6fcdc8ed58f1eab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6bebeb9ebe8addec986e2aabfe687301c2adcf61681b13e013630630d8523643
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 546f0fd31a7b84bfddfea7d6bd943699ac590df33a9be7e3d337371d6e77959b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e136c6732cb5def0697011a34597dfea76ace98eaa492fb471ab442989ae193
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6619bf4ab2cc6341b902ee57b1d5bb6980e10c15975267fb22de5d8b8b4721a6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a25ebdc542f37bc6f1e6687159617776bad3ff12768ebfb705ad78dc4160f957
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d974dc44a452875a96296f205049bcacce7697d808f60d8714130524dbe3c61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ccaed95264b450d03815b743dc49ad279a0db961c70a61e38ef7ada3025a246e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a83c2fe8cef5e65a4bd96918e291e54729d39f0bcdf12cbe59b59d24e82c9eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df9f8f8318f325722bcc8de9dfb7e2fbdcc21be595b14e9278a330085bd89d27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43f3a9bc459e784fbc1a125bacc25202bdfa593647d8259582b4198f3bef7aa0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b51a132f3e31e6423c3c518bac05477f5f9c464df6d024a2a4739cb18a4a1bb9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5dc4279870d3998ab1a373bac9339592c7fe40d79384b5c948360046979416ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5deae131ea435133ed98b2a607057ae247dc0b44f1b966aa133bfcde8db51e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 62f75148f971c56be64ffde7ae949811010d0ca1d2a913ef7dba27d5a44045e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 99d9783126cdc70c006f13997fcd5bbec97d9236d781cdc4edc1ae58b3ecc19b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d2fafb3eaeda1c92d5b7f8f58834b057ab69479e35ba80ed46ebdae1502f7797
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a73af86a1b5f06cfb8865c0b649e96384af5e130a88e4dbf394d18cf0d7c361a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9355a6d35ab064c70b54e71039db955e63f99fdb0189098176b10300b31c6add
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f3e88dbc709c92ee8c4bcc189fff08fea695acedf0bfa9d267edcfaeedcc78a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b544528c3623d8a5d45008d447883a2628e990b51747c8841cced5cd6f047023
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c56afc51d23a30d52e8da4a3e9d424b148ce61052f263796a5d0eccbdccf9397
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9bfb07a7e51c93086121f74caf1be3e7ef05232bf45fd5e38b359698c12bd60a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85a16da2d3b930adc3b893078cb9a5c970a45a42ff4572a4d530bcd8b07c1666
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d33f72ccabe4f9650cff7a9c11cf25f389df7a7f8fc3ccd5efd314f404595828
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 88b70cdcb615d5dfbbcbd244fd25f2544b8ffb5c91d9c954a730dc6b7d4d4b10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ba847e9a0b206730175900a154431643205ff92d958a8771dfa7de389631107
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee96be23a6c625461d3d995befbae9a9b4ae1006a19b52dad8ac5f40b6523de2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0608e981261de79f6be3dabebaa157b3cad6d40fad1d7024fe540cf171589df6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e56587d3589603c2e62f24a2631143c4f4e8a1181cf85bff93172da769173c44
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7531ea2dbe6c3ee8be81804bf90a2e141065c70acaaf32b005444a17569eadaf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82ed16f210339a22f007a4bfbd46a1f1d277ec7b78ab7c921e7870e6b5d83519
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db7e9c56e7801b3afeff194d7a2a5e71e970b32fc73f42133e8478b594155f9e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65a85e11f6de942820aa2d476a343e55bce995e3ecbfc5957820d1bc851469e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75ab894901d6daacc559809744c74e26d6a49b05799a407ca8f55e3d52ccf34b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 199b8d1632fe1bd0ce881a8f04c277bc3199ee74f25f105dc603d746a1e1606f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 628de05ef82c58b6ace63812916e7b75aae722eb5c362c84f4529de7857e597c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 118ef5fa197921e7ac8eca6e27962b8524dc1ef5dca82c0f3d09c3049adf3956
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              cmd.exe

              • Path \??\c:\dir\install\install\cmd.exe
              • Size 332KB
              • SHA256 8ba3de290a94503b4ef3d21622edfa559019fa459a3ab03ac3b89f21a810f721
              • MD5 SHA1 SHA512 SSDEEP

              memory/2124-4-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2124-29-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2124-5-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2124-6-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2124-7-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2124-148-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2124-11-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2124-14-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2944-15-0x0000000000E50000-0x0000000000E51000-memory.dmp

              memory/2944-77-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2944-16-0x0000000000F10000-0x0000000000F11000-memory.dmp

              memory/2944-181-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3848-185-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3848-149-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4636-180-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4636-176-0x0000000000400000-0x0000000000457000-memory.dmp