Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/09/2026, 22:50

General

  • Target
    jaffacakes118__295e9c52ed56f1bf067e221ae4d3961f.exe
  • Size 282KB
  • Sample260920-2sb1dadf84
  • SHA256 5c0ff5f3953c729bfdcaa5fb704667c8d87b7d7832451f7f638bcb5e2f5e335f
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.02.1

Botnet
  • Lammer

C2
  • 5509.no-ip.org:888

Mutex
  • Pluguin

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Microsoft

  • install_file

    Pluguin.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    VOCÊ FOI HACKEADO ...SEU SISTEMA SERÁ FORMATADO.

  • message_box_title

    LAMMER

  • password

    123

  • regkey_hkcu

    Avirnt

  • regkey_hklm

    Avgnt

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:1472
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118__295e9c52ed56f1bf067e221ae4d3961f.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__295e9c52ed56f1bf067e221ae4d3961f.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3448
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:2208
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Deletes itself
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4200
          • C:\Windows\SysWOW64\Microsoft\Pluguin.exe
            "C:\Windows\system32\Microsoft\Pluguin.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4484
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 636
              5⤵
              • Program crash
              PID:4980
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4484 -ip 4484
      1⤵
        PID:2876

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 8d6df2011f9eb16943be4b72ded2a7e56f78f2bfbd6689050418e70863190966
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 221KB
            • SHA256 7583d07553d670197086e9151f657658d6c43c1186c640a42390f2f499867830
            • MD5 SHA1 SHA512 SSDEEP TLSH

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad4546565065adf8648721c84e4ae46bd79ce03486a00530456ebeb044103889
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9327eb73ccdd5dad9f50764384712ae5012a4b435759c3a0c6f7e9d21c6a141c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3a2e658f6a9cf7eea15f5aab0256548c69328dde6c40406caaafbc70cec4d70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d60cfb0a43d609e1be1bb99722860ca4260bf355018db7a4addab57f3b5e01f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dcdde8888c2f4e8f636a1c1504ad61bf7343f92e8c149bec36d5b5d8f1426582
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6b2ae9a2c24ceec3bab08155cd6262c3c60542087d89c61d8ae5c00e22cfbce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 374340f26a9b029db1ba5a4da8c39a120537903d3b3381933c29f6da2b4ca31e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b9e354436683440d2c7222e389b7797f7b85a6fcce6ed45dd7d5fc112f3488a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12d32ecbefdeef27c69f8aaf659f07a1dbfe3fb0db867380edd4df80649c80c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5073bc7a27bdd04114eefebd02afe053f14bcedcdc4ee8e6ccba43e7e7b635f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d616a5a85ee59df23d65fd637f00adbb6ca93a142aeae580233d1ab5fed2c033
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90f4db602ecaa0aabbe162e9041b8d5057e9d001024c325f6e059294c7956ba1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be605f2f433f1cdb90d4b1cc1921f3e31dd2d019dffcfde80caa8174a6d9c5a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3987bfaaf091ba26728be26bac1d04ce48c5c5995fbc1a0f0f47de449efd3417
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8a3c575c9d35b55f5fcb1289ad6d14d2ac6378257d4a75620aadb8178a3c814
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e67fcbccb1a22fd92f4bdf9016db6610ec282a30db7e73daa6fcbb8704f43ede
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9b9b275212eb6305abea89e04986086694e13a93ca96e006e6fc72cf7065a99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3d263eb5d93440ce26fc58fea91597dbf30a35297af05960dc6319c63320b1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 892cb200971a6f0b526b70398b036940af0b5710e04d2b37fddc472f503c8e9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7e05ab129d70dedb223868912eb7e70d1d5a64d00c8bf5b6a070a51607a05fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8cbdf69814a5a2ee868e52d66192d343d7179bb981c419002a96bc846b3dcca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ca917ae977580a9ec17b337c32912270735e002032f82440cbc53f2dcbdf3ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 107878f35631fc73d14ba785a9dfa1afa443d157a4fee2d24a2fa24e1fcc38b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 507103d46904f6073aa1c27e2884394c3eb3f8152336c6718abec6adb5cf1307
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d3dcc14c3ffdce9860a9eb39d2a9422d933c272fdea3ea766aafb2913cf1928
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7868548aad7e9a798dec14f34d67056d236e725dda1dd540ebaf2b87e3dc82f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c5a9a2ad208f08808130c8e751898d3cb3f3d8bf2ceeebd4f70a019ae8d8120
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c001b6e5f4c43fe5d9fe3f50932a66085d7ae835916c61344a9408676555be2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bdad4936b27151793224526a0530e8ad9c856bd289027a3423f7b6cd75ce731e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18724512d96054ae273095fd5843ae7811d7f9eed8679a10575748e463d64c89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7dd6a8cf75a20dc8091ed943e3d7993dc25494cbd12814478965a302986f04e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3e9c572f2cd0ea8ffa8fcf2dbb0012a5be1e46be7ff4a31b1a06aad7165653c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96f9792808d67eb6a5ec4fe95cd359f5a2125ce9f6307545563ae9cd0596f670
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ec4c7c428f6ebe704e4f06a64bd29bd2a8ef0d30946f9928db78bd56caed088
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b287f545680e41ab434b2938559efe6f26e2c29fe2826c372b1ee97545c08913
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5454d9ae63b38bdc9b369303fdea1d2d7b9c86322f53b3bc0e2edfa69f95ea5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 505254beffe6c3741e6fbcef15c885b0386f25caec746355644e3df5e9406fa4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 846184331a165f56c7d529a63cfcc7e7b21780858db956ad4e24bd98df98ce3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e87d4c439abde2ca1eb8da75d5e5c764ecf57374774276e01a67be49d4f62441
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7360360dbd0e48297c815d32f70864188c0f5bdfbceec052b7302e685614283
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 781a7b51760810bf5c9f5dae9a3f77df9e20bc7cdd11ee93462a892dc94aa110
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d29b3c5621ab62b23012b9d91b6c20bc18544ec56f0fd45dc8623f50ebf5ccc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa32394dbeaa3889521a12b2172e16e28b0dc08f406c3bde9ead6e7b5b92d9f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10740cebc08fbb6839b0ae7a57bcc371e9fa0299921ad7ebe4b02922687bfa1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5f9ad67c94966ff9e1140827642ee1c749b4ec4d2cb47860d31f0a70eb5b20c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 676774ee3104008992011e9ccba6e3835f91d1d0e0b7e31cfbec1db13c439a82
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afa3e0923807206d4601f3346b4e9d4de32370653822f83af4d1a7017d8ac286
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc325115ea457d112ca6782f880b2e28cbda7610f8fba615862bca6f5cefed62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2580c55a288159bcce2711d79daaada36bdc81347552140ddbd63255ddcba8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df7a0c6c27dafad9ccc31caba3e6ac01750bbb7d53d64d289accbeac60b5203b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 696db4c2008355699be93bbb604711261bc88a873de07368f965d33acca4048c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d11cbc731a415f934f69a1c2ca696774482738d06ae45f5e5c420bda6edd130
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4d133b1f462ea40a482fb617bb0dd104d4b9faf0ab1ebe7e1532046f0ff7f06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 916110557d028bbeb6895273600ab752aba4692aeacefa5733089695de92a941
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c90627056749315c5e6824bf5140e784d4156760de17e9bc193532309b55d025
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fa25be1e42d2c070f1492e4703e0ae454876d86dba69db40cd8595893645c6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5be26c25a6255ddf7ea6429ab9573994f18919baa6adf881eada4983ed68a116
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 446913c8e5dc75e451fa5617a772c81532e5b4bf4b71de87cc047730879c3891
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f25b5a65344d14e5e3d97ead25f645764b1cdc23a1afbc760194bcd9b0e70d10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c64fea4c1bc19e0aac849bec80a164fbb7304e1e0b1d3d5628c05d33d9a2c120
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb08bfa2bd3e095f66f4034faaf997046e56fe6cfa5127a0f8d756047af44ede
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fcda164c0831bd35e0c11e2cdee52dcd763434a44c79808cb53e8900d5059860
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67df428102a126f6cbe471533cbed68acc541ffe3428633b7c9013ff514b9cbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb5a77406d664fdfa2432fa56a956e79641f30f9b7fef0381b66d57e4b12d1ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe4fb4abd99e6bbdcd3348d1e8c955f97bb1a251bd87388df4520e4e15e6c85b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 177d3786fc867eff636260468e3a8e9d468bff7963a59b28aa1aad820e116fae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2afafb674c66344f764ca90b476ac2465c721a410034675d6502c6635e872324
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84b350db3d879f196cb896ca61a2488b2e303a50860eb948fd3f294d8eb5752d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9adbfe6b7d6d80b4dd211741377d418651d394fa1f8c37237fe21dbaa80df896
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85938f4496da22057d8f8308f01cb9922dab389cc431125dda8080fb243bc145
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6399686d9b9d6f643fc5c01521187fda3a81f29e72b8fd0ec581212435bc3950
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92f019a776e1906010d7df4f18354ee1ccf90ca6562e5c22bddecdcf81086985
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf3ed4bb88940e4b53ba72cc56cd5d0bb27b0def7287977c8795618d4a961027
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae19b088b16fcd3207551405536eea1f0075bae3dabaf0d184df398827bd770f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dd2ba509c6d8dae045799365f6d66ac86bd39c379ede781dd6407b811ba37e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70fdb5a97781e205866655c4a1b9af7fcd4f1d762acac0315966930fffed3351
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 049590e221ff2ca54eaa56c4e5ab7f453ffc3bbde533bedd2f7ea1a4e9d3c4cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1108cbd28bef2ff7dba2bd1a9bf4dfc560eaf98a90e3d8465bb08d39884d6096
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5999179f8b582aeabeab6dde3daa4a07cdbd78e337293ca50f6c51c41fdce5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a61cb576cbbf7fb50f06e75f7f93786cee4924207733c8de84e4e3d88c33652
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef1e98686fab9e2f6626e79beac361f9767fd6d2ddf2b0dc86fb54dbd10b055e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a60d4cd8a0af75a17249d9f857a7dfe18bd2feffb73ae7b681fb9469b22b9fbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bd6a87889421feffd4e917f7a6467f911998c30ab5fcc52e03cbc8c036abb30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e41081d8157d3b4a6ea843dd14a0c7162a20c35a4a7eb4fcdc57d0ad1a3019c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 763e10fb833bdf416141b3766e62324a71a8f477059fb2982d4deb7f544a2549
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f3225aea124f41c2aba9c12c5cbf2da5dfe3e5a99b48c16a415ba50a8365e54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5645c300f6b53b6e3781c78991b8b0f819bb42ca2a34d3ad0776778bc8ea9b78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc3e93c53319b8bc023cc0440914e88bd050cf77a880168c23d7655feb2bfa17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fef3e8d0af68507576a0a68a95fa329bd72627f96bb182cefbd485be56573960
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 384bef723c513028e6c004a9704e45ab81ae67a448d3f8f297f18db17539c2d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31fb1efe108005a5aab22bf7c16f5f1e8511eb00f5bc3c659e80ea663ec225b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c97ddbb5745ecd4fb00b59bf4346bf51234f002d2e1474bf6c5afb28ad6a4471
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74bb35cbcda39eebf263258f0cae22eebce81607c568e99e5823f2332519cb1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32ef9d8927b05c7811aa78c694c90447f2e72c34c17b3dc216320fd0c5dab93f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f2368be6709e342f5c60e99b177a160661461ab1fd7d4ef4984afd962156346
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 609650c2d063af26149a9fd505adb5c354da01e70dac30a024cac72e96b8b508
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dbf0a79ea608d0a4e9edbf8e0727e40d433bf64f8c672f1f523cdc10ad843cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95f683a453ed099ed661c58626d978296f799f1b5787372505ac89df8ef320c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2a7b311c749a1ff305ffdfe7b3370f1ccfa714a562c54c7d46c88a02a8f6706
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8af79bee8e64be990974cdd942239002a5e9ed70027977c4afd414e5b4ff533
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92842e2b638e8d6ae9d4f5429f0a0f0323299615e66060a7255e687b3ad03088
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df5e34ae55799b12db05e1f4c8fe81364cf34d01e4a53437f4f40b75ed3fb0a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d8ac4f89324a5056c693314bc86644127ec84828812169f1c6ecf618852c2cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 093318eb2c7a14c594696a916bdecf5be0bef3c7418ee44550d092b841257a58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75a13ed2459ba6c1d612a72410de4108aeb5a67080b17bae5c2d6b87b0ff22fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fdf31950a8dbb50a790b38b88caf9600c5ee59299b36534e403d050b0bf73b1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c20c6642d07b7bb906c237fee5fa4f603b3166f93b59dbe40a6352ec2fc2842
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af4db87c7fe001cc48662914b417da3fb2551c287e4f65fe843929eac4b4dc57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80b3cfedd2b4b7f7a1f974fca565bfa5cf753cb08ea854dd8403faf2d2106dd9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3639e4480a1d893abe50726d12d378294f587408a90693cf726f615420fd3f58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a89cbd5fa31b81e3f2310982cf96f645ea2b47962c01dc92cfe6f87cb2c5ad4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b616f6e1647bd191cc392dcb80ddfdd20ed7a48de58cd80e52167c40aef2b22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26f05047b7981847eaf4856418d5562dc058a695814b6bb42db7f667ccf486a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db79a8c43c317c00d6edaa0aed351c36f553e51c4ad968b9a06785ef6d1acbc1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 705f6f7e7efb162940beef5b1af16f5646d450d611e30317d73e9fa497d2a477
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f075950875318b04f36ad821d7dc375e585f629e4b462179f7b9efbf7aec6fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6de3977ad89e479c69c2c2b2f8469e89b924e48d8410d61fde8325fdb846686
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 686c50b55365ed969b1f6998a22af1eb2e602e980367856381106d790b234a61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0eb917de758a4065f8a14ac353b9749d7361cd43dec80a1fc2d9f721194c187e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0f61accecbb9e1de4cc5166c9307dba429d8fdcfe23c0d7734706331ade8ccb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 790b98b158dff94cad028410418b20be783be7b50ca49730cdb4c2d0616a5422
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 522e9b4e0bac66d0b910bc8079a70c916677b45bcc964bd99181530c56b70082
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 490fec7b1253c0cbc2665ea559011850f2b646f1b3b128e5548fe91ba139392a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8819b3b05de3d617e2e3c6740409a2f2abcf76f14abaa485ae46bc3ec289702e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c4aa4b63f6c3f162794f6539465f24036d2dc3f35a1655ed43d14bf95314650
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f89ec6b4e7df44d16095aca6c43eaf4b6cd3c185e123f40cf85d3d708f8d9b67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc8c0eb21169a13ee307e1f382742b48818d980ca039442b3e9c7e3e1289a515
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0587790515c15343b977a66b9284a254447647a05f229bb2ae0fc6f33de3c4f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 469fd7ea9df451367540c7420f659547386d89b8222df90d600f77f2cc69db3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6037a7757f6ff6eee1be6a7887cb2b00b10d7e06e9106199a7d23a9d78562cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74bee6de0f85ed8ba6943fa706e93da47d916c6dc0c2110497d212c88a09ce07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd0a16f8e27b0f9534aeb3876b538dd1a7aab5508905e72db03188bf1d7b54b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7667250c208eff2b2c6308823e102682cf226cd7fe285c324f7e0dbfad7b008
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec3f153f539ede9e2644d0f9622d7668cb356515a26c00f9554d6ceb1037093c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17d4e4f7d5b202ee28f875118e6b7e3c5663c43c8d15354504b17795ac19b8a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42be338012a6721bfecc5921bc0b6c517d75a866eb184bff57a588785239b61f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72306e2218a8dd7a0437618e9caf483061a8338bcd02103cb10163bd7b89a12d
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            Pluguin.exe

            • Path C:\Windows\SysWOW64\Microsoft\Pluguin.exe
            • Size 282KB
            • SHA256 5c0ff5f3953c729bfdcaa5fb704667c8d87b7d7832451f7f638bcb5e2f5e335f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            memory/2208-156-0x0000000024070000-0x00000000240D0000-memory.dmp

            memory/2208-69-0x0000000024070000-0x00000000240D0000-memory.dmp

            memory/2208-68-0x0000000024070000-0x00000000240D0000-memory.dmp

            memory/2208-67-0x0000000003BA0000-0x0000000003BA1000-memory.dmp

            memory/2208-7-0x00000000002B0000-0x00000000002B1000-memory.dmp

            memory/2208-8-0x00000000005E0000-0x00000000005E1000-memory.dmp

            memory/3448-71-0x00000000240D0000-0x0000000024130000-memory.dmp

            memory/3448-64-0x0000000024070000-0x00000000240D0000-memory.dmp

            memory/3448-132-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3448-6-0x0000000024070000-0x00000000240D0000-memory.dmp

            memory/3448-128-0x00000000240D0000-0x0000000024130000-memory.dmp

            memory/3448-2-0x0000000024010000-0x0000000024070000-memory.dmp

            memory/3448-0-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3448-23-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4200-159-0x00000000240D0000-0x0000000024130000-memory.dmp

            memory/4200-137-0x00000000240D0000-0x0000000024130000-memory.dmp

            memory/4200-144-0x00000000240D0000-0x0000000024130000-memory.dmp

            memory/4200-143-0x00000000240D0000-0x0000000024130000-memory.dmp

            memory/4200-134-0x00000000240D0000-0x0000000024130000-memory.dmp

            memory/4200-136-0x00000000240D0000-0x0000000024130000-memory.dmp

            memory/4200-149-0x00000000240D0000-0x0000000024130000-memory.dmp

            memory/4200-133-0x00000000240D0000-0x0000000024130000-memory.dmp

            memory/4200-135-0x00000000240D0000-0x0000000024130000-memory.dmp

            memory/4484-155-0x0000000000400000-0x000000000044E000-memory.dmp