Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 18:42

General

  • Target
    e59adcb8e6545e51ff215bf358d85ad2_JaffaCakes118.exe
  • Size 608KB
  • Sample240407-xcn8jsbc5s
  • SHA256 9d770e78ec3c860825969b08e376bb9e7b07705b23eb0d103933b1e40838f272
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • v1.03.0

Botnet
  • Victime

C2
  • ilyessdu69.no-ip.org:80

Mutex
  • UR6446G66E10Y1

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    ilyessdu69

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e59adcb8e6545e51ff215bf358d85ad2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e59adcb8e6545e51ff215bf358d85ad2_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Users\Admin\AppData\Local\Temp\e59adcb8e6545e51ff215bf358d85ad2_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\e59adcb8e6545e51ff215bf358d85ad2_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:4544
        • C:\Users\Admin\AppData\Local\Temp\e59adcb8e6545e51ff215bf358d85ad2_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\e59adcb8e6545e51ff215bf358d85ad2_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:4164
          • C:\Users\Admin\AppData\Local\Temp\e59adcb8e6545e51ff215bf358d85ad2_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\e59adcb8e6545e51ff215bf358d85ad2_JaffaCakes118.exe"
            4⤵
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            PID:4220
            • C:\Users\Admin\AppData\Local\Temp\e59adcb8e6545e51ff215bf358d85ad2_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\e59adcb8e6545e51ff215bf358d85ad2_JaffaCakes118.exe"
              5⤵
                PID:1272
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 544
                  6⤵
                  • Program crash
                  PID:3276
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1272 -ip 1272
        1⤵
          PID:3468

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 d5dedfbe1471090b080628040eed4377058f0af0a9da53ead65d8bf629c53e63
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 221KB
              • SHA256 0a1ef4555f79e11fac27d669113f34aa7e0c04c6b440876b41851696efe5a19a
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 981f7e141d86597f0c0f55898e31bac8b29cd6d9cfb1c85833ca29de91359fcb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9fb2a1a6bd85a5910c1acbf34aa103e253b3c79301c203a50117ef493dfe9e6b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2df5b7f1bbe51ed67aef1a3b4922f25efc0068781b78ddcdd3ef42a98f801e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35626069d494fa3bf0b7e8ccf0897f7a633f3997e43687b3a320fae1333a1f34
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e737b2961b789f216fe2c81ad8ae81973654af0bfcd1457dc9ed7e9dd36d22f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 053c5af3cc997a628bf57af4954bdf31fc65d6946278b1075a2f56399cd011a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c91088daa377a278276720dfe96db603a1c9983ac75e8a327494b18ef2f6400e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9aff153008808f80210e6e7845a35ca6b9c5094e4932a124b89e452b8fa3de3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d79eda59c2b4c3a1cfe778e3c7de490dca614d4e660170bffd908a0b413cd678
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4f300278b5c5cb07914475a2c3fd15f2407bde0ecfba78804ad212f013d61cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7154f11a4eba24e40cb3dceda96cb3b714fd5dcccf4ab62013076f4a79af620c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cac6ce6a80dfd671245a49e056c5d768edb4b490b5504413a422a7af1cd0d272
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fff9ef5ebb70887ce5211571bc1da21a46a1b55411828d043934575ce3127679
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eec3dfdd96029a944873ba070e661c130b4ee35449de30caff45c26847030c24
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f277906306fe002e178cdea2c75de7e201a96449d8e3c9cff9815fdc701e404f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e913fc2c5cd25606bf35b23fdb403db42b585543d80e8b2facb2a2e57de18f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ab6bd334cf76f14619a5ce40736c2be239378445b43eb70a7ccbd0af63c3ce1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f6a214a2c141c907caad882adc4047764bc4f061195b464da4700d56d864385
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa346fbe433ddc37c66bd7dcc7aaa01614f1ffc92dfeac336189e7880ed9db38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 05e37f5d67d40b99889d9836e67819250eb1492ad94aa7d48a7a7eee65096bde
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 daaaea9eebc95adf331071fd80e85dd6c3520a5ac5964cb303a66e76d47747e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1156f1db945653bd703532f58763064fb25419f30b6f609fd3d77e08856e4ea1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36a9452c537cd3192db84a1e90b25fa13fd98573edaae75478fd17cf46d1a594
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53b0391bad4d372879b49f627da843e2775b207fa871e89a89bda941e5ef505a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6eedeb87f7f88e8a517c6339029297aa3896c98c5c298f02f6710f88c58c2603
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 641936db17a943bc084b05cfa9202f90456eb73c138d84b2ab228d8141b07a2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8c31500e3e88b361cd903a7b1d39a337677bb4a73bfc3aa2826d595f410be6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 95fe91d620a490b1e7c93b98cb7b0f567b9f11c8ed939ffddde457a07861aed8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c4adf1299dc687fb92abd42cdb66e8176cb25ef4e0dcbd4b9b6b041c364a6b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f946f01bc04ddbaeedb842be446b232d7f0f5316c730540cc5aa5e77db423dd9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f1e4e388d08e0daeb0041765b8a79e32936c0d37765935d5a26b03020fa378a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50219f5951904061b061d0e3da4fb13defe51d1e4c06c1c3994f420025d3b3a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa9806b52ff04c7e93a5a0d805d60e151a12127b580817dd62af7f4be75f37f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92d484946b06eb78c117dc6b3cf3f939fcaabad58fffce74f8cb0d5b32a26842
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 baf6d99fb08302a95ef86dc1d073bbd0df7906bf5a421a57a3567bfa4966a62a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 677a44e2689c0bcd43543226344e5cb615b718b11931046dd59cb09fdb2c99eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9064318d41426aeb8b29c65566a0f425757df97811576876b49b4daa118407cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4ac158cc3ee1a248f9b93033ea243c3e0257db20abd82f183abd3275bdf1e37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ef0f7d417e83449b9d837081ee0129bfca6f7a5fa75e0bf6d6aadc00d6c8fac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c3bf0245754d702cd21cabdc0449e114c546fefe64f68cbe422aac1a507c006d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e66d5f39a0266e69facbbe49c201bd3a941827946189f960f166fd1c8b4cf06b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de75084666131f5c631e760fbd466d56e07ca42f0330709e3272938b4721a2b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b14da86dc6bcf7443696f6acc833d22a581fef54c5ad0ce3d196f2fec98df99d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a14d8c0e85b322b720d6ea3c29a32d8959dff5a12776109077e7e2268dfbd966
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5590e1a59b1dd96e140e1c8a2e09d55b160a270fa9b1b5926b0ab5c32a9f1d50
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7f1962a7467fcdd4e36c2fa8841483e26989ac59b67c78805d52298209a48cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc7b96046214ef031a3f28d170ec02b827118f7af13548f9554ce3a5b530e30b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f5383cdbb1c90b29a0641469ea589e884789e2bdfce4ab1678505450e8a046f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a03ee23ee03df8f0cc573493959a1aa9caf2cacd56d908ef6b3b030b481d3e32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d384975e47c5c1f8f921dda1c9a57ac9d555901bc77959f1abd08ae1a099d22f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f6947178556127eb6b3a332cbc483ddf9c659444da2631d7d4e44c08d2e02a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 005b56261cd1b4ccb93c85e5b79e4d057787aaf55c647b3cac4772b1e9eb47d2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acbddb3f0bdef5ceda4679bdbc57fe6bc36f7d10d4057ed7d4665a63710119ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55845cb7d998d1d67d391bcaeccf86663d0d95b14d5918f6c65783d8bb6cc12c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fec88ba761a3e9ac778a99fc467ba8f82760fa4877ff979dcb92b056955eb152
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0611c29856747a571536b2e7fb8c2c3182c77d7e85d3abee2778f2cfb7332d28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 207751acb62186aad0e83011ec453e07eb20c3c3bea268f5eacf89100d396486
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 944486f987c0d386c63b0b2d4aab613136795de7903ea8cdcd7a78897b41112d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 275d5f77c793e795f076976f5b8c4f0913daa116157adf3be9722f4b1eb6e8f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17c83553619c1d84dadd17a4cbaf0a1e74d68d8b7831eb539272547f2833d980
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c514ea4e3f3642e27d143390e87493f9d23db8fb3c22360083db458162cad897
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ce53b4bea863d77ae7b885030a758edbf59fd3b7905f25b7b18341eb477e4d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63931a2058e7cbc9ff56487969f484630b87a513d39f4bee2f4ccc1a30791a67
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa6db4946a873eb4bd1ff345dbdf4d1ffff893ecc0ad7227b367a184ac204b8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ae5504fa7e9b7783d488a49866ea867cd568900cc530cfdeae73c4b1557e0c54
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f264fd136bf65e75c7f3473b6fcf7152d5d4be93f14d5f5ecf77e538fdab55f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d03552613d8528e490b4878be221ca59d10a430a3d541d964f4df04d0335956
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 51464df7a4774fe441f584943ec59ddfe58c66d5cf458df29dfe45f543be78f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 616e3f75ac4cd4ae742a21b6331008fcfafad3d037bd2426325a29881f9fa756
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9a3e80c75c02203ca97e759f481bb06609a0da5696145ec9f322a7827ebc94e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc76750dad402521b463ace753192d7a7038230b1b676903c69b9403fe66a273
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1138d307b1dfe7ae827609d8f2b017de783771c50f63f354077e7d8ccce6fed0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d8a000d5dfcaa89736d832018839eea4e96331065600f5547090a599cd59dac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab0bed7768e7e66c814cd63a675eea5f4409593bcb0af95c4812d13f0db93f23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84564f92555623d0ee014c6ec1a5a2dfbd673f9aa8cda7db48f2831f0f2bc6cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9d8820ca2f23a6706ed8bf956d53f6046021902299340c084e4da18cb416068
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea9a87ffeb40cd95397eca0b27adb95f7f95aadc85e8b7c804c9e5e6b62437a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b979508e45782c33bd63da72c10511c46c72e1f3d7a277df95b8227d3e9cc0e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41c7f44be6c2e5338f5feaef2bca52d7dcee221ab46cafad5b21823f7c725b2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd868616e7affa0b3a47c51dcd46069dd9dbeba0dfbab312c7be7bd0a4824b4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d9ca1b66b3b7e799121934b16db79c6bc49930b5331f2f7671210f64f952ef9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a234a92e81626f7a470c0e921c2fc4807c8117ff67f55304e0ebf00082b32ab2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 805bf384d305cae89495db1b0a359e19aa21e33e1b912b9880b7639e966e2ba1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca3058fc55ffc5c6408f6a8de0cc65f5d6d9788434aa36e9773088ff4956fb10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 19f79fae9da285fa35443fce2435cc4a8f8bf121057aafde3073fbdf3d83890d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a6a236b975a85cb559340d31cfd841de9304524e6062d49b1c8a4244c96892a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef71d42d2bf538e80f721118ad6d750dca99980cf72c599a3c13b9f51b800164
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5599af52474643261649b8b3ebac1c11b3fee4896eecd72116cba3291cfef976
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9deeeec23d578f1d2f5578f063ad436a2947db99a2b1d938e428e3f9cfc0bbf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ec754a2e6dee730c99e6d979c365eea40ad6d556f89d7e4aa7892407683c427
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c8bec35eec3c0dd2bba737215051c272cbc227b1bd14e7b5a9b155f8233b2600
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 249b4d0a1647204cf6facb0385dfa9a524f00c15baa7f7d9f7f496b58a89592e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5476cb36f3b28942a251cd5d3e1388e432c961f03f091ec6c6c53e2a2b7a5fa3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 732f1a5942ad62bd5942ee106e18a05557acfb9c412bc2512ec5eee8205c3974
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8195c62166d6503e215cf77a46e4253a7c4040dac2f2adad6334401f5aa3114
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b79a620593440f266a184ba00fb483921a27220317ee77237999595f4089913
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8fd8901128b51054f85ac129a0ea4754f760d4f7d7ea78ee9f1455b801bfffc7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b321e4c040a43db8ad4a35c836d1f59904ae0ff9ee615fecc27d86f840014e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3368634ced58912860140b8aac18bf39048ec67e3b8c67d9e392bcb86f84872
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d690651339946a475821127638d178665578df4d376749a146cb341933a70b28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e62a218b7b56c837efc80b8a37585a0c08e628ce9c3454584ba41cc491e0210
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca39e106fc5aed24aa12278115d30bf736fff99e0ac8abf17fac5d3f8073ff60
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4fc60298ca5551e9d5dd070682f94279f7c8934ef6839507b6d592dc4f225207
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01bcd0d3dd120194aea9079faf73adcd4502c1563bacbad018b96f82db14ae4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8a032a644ec263654da5d19ef21163fe3771c0447bede4683ef6d0e47e951a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 755fbfb25b33804fe558bce0d0ece318ea63f36406f448e6bc52b05bce38444c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1f039e8995b0fe4fef7883583447ef8dd67d1bc8fecb38d0a73d8a37b9cd0ae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ad7ab28e97ba4aadbdc4f16c9998490c94328fc9e64d28aa99784a7f68619fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0bfbc34e66e9de83dc3d5941d236021b5b9eb82c0d0c2623ab9823e04340e166
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 04de4c417655c2ee07916e433e16d402c26bdfd3e79cf026ce98d38883380bb0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a12cb48240235e556d0cfad19d5480c1cb611f658212a4aeaad75a7e14ef8159
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7dbca9146295eab55b3f11437bde80495eb11e6880fa53c3aa02959478da076
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d33e58a87a8787d80f1b6d0240bd40a31e222bc956d2307d2352e2fe244279ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c6e22029cc6c5aabbccb60126e1870ffbf13ec09e75ea689537e19f78003634a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa58957a18354d1f4608d805c50cad5ca3b5008c574fdca6ce7e68bd80b6505a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e4baf32e087578f2669ee81eda386eae41241e414cb9e4de1d2db191aa4cfbc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 04cb24f197bdadff6e1e5d040d99fea19bd9d7a038ddc60524a3f67f6a829dc8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8eedc4e196c39d987b1c8ee41fff267db4463fa2fb04b7c6a8852bd8233e55f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8d1457e15de9b333e5d0c44d5978c75f0cd66e368a6ce9c94ed7f7db0dece23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1393f7ffc4a8f3adb04bb61c35978aac135a59df0c7296824c60344c01985f01
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 96e096509e7a75d7ca76afd1ac853266de36ea1d41ccbf3e0e72dde576f91fcf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4775d9b96767ae74eb743a9843ad37b9289f76b1a017f73b99d0301233b24f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee6f0f8efdfad8777ff3cff05011d318ab852d1f01019d7c3687bd5e86e6a2dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 350916bc739c4471b7e756597da0b0893499cf9b01952199f45fe0a6e99a236d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d08dc044744d66bb5d955c427b005667098d9c42b7bda02859ce4184ce536824
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfbbd6b0ea7546aaa520c8fa7fb99efac572c575920b0dacb86588571cf54057
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c6a75c68d4a512afbcd0281dda0420c3a4eb0f8293f3db5f62fc4e21630e058
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 011d3bb1edd9c7db5e8d45fb254b79d4b1a1ec3e9406bdc1be0eb8b01a84cca8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a65ffba8388b920a56776ec55f4bf5608bf83ef515c1eb4e1d2fdb50bff9862f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c12485b73aaaebe6631ded7f69de1e27f116bab73ba3de08d98e4cceac70010f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6ac3059d83a8864934a0e78afeaeef2363e98f98604fa7b53cb7944e46b0182
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 26303373d970186bc679e10319f0164d44188ba3055ea38ada1ce3f42160c8d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 370c42f6d3805ab929eb5adcb211750d1d29de9c65ef3064e5deb08d9e383459
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 99f7148d2ba558e40bdc6f708c708d70adcc94acff44eb6e88bbf7d38ad2bdea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d131637e5278ced9c9c4e3fc5355a03b7de9232ae3204eaaacf93e69c1e435a6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f22a00bab14797d66be2295462aeac70e50cb09ac50264b19472632497f3bb91
              • MD5 SHA1 SHA512

              88603cb2913a7df3fbd16b5f958e6447_c7fb5b01-fcfb-4c9b-8aef-df586dcc7345

              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-513485977-2495024337-1260977654-1000\88603cb2913a7df3fbd16b5f958e6447_c7fb5b01-fcfb-4c9b-8aef-df586dcc7345
              • Size 51B
              • SHA256 374e0e2897a7a82e0e44794cad89df0f3cdd7703886239c1fe06d625efd48092
              • MD5 SHA1 SHA512

              cglogs.dat

              • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              memory/4164-74-0x0000000024080000-0x00000000240E1000-memory.dmp

              memory/4164-1393-0x0000000024080000-0x00000000240E1000-memory.dmp

              memory/4164-13-0x00000000001E0000-0x00000000001E1000-memory.dmp

              memory/4164-14-0x0000000000600000-0x0000000000601000-memory.dmp

              memory/4700-5-0x0000000000400000-0x0000000000500000-memory.dmp

              memory/4700-6-0x0000000000400000-0x0000000000500000-memory.dmp

              memory/4700-4-0x0000000000400000-0x0000000000500000-memory.dmp

              memory/4700-9-0x0000000024010000-0x0000000024071000-memory.dmp

              memory/4700-69-0x0000000024080000-0x00000000240E1000-memory.dmp