Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/06/2024, 03:31

General

  • Target
    026e64988476bd01dce3611c08c8ae0c_JaffaCakes118.exe
  • Size 283KB
  • Sample240620-d23mpawerd
  • SHA256 d6f3dc540e862647ceb2201037f777d077196566e535bf1d865ca7a7492433aa
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\026e64988476bd01dce3611c08c8ae0c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\026e64988476bd01dce3611c08c8ae0c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3152
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:1520
      • C:\Users\Admin\AppData\Local\Temp\026e64988476bd01dce3611c08c8ae0c_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\026e64988476bd01dce3611c08c8ae0c_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:3668
        • C:\Users\Admin\AppData\Local\Temp\026e64988476bd01dce3611c08c8ae0c_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\026e64988476bd01dce3611c08c8ae0c_JaffaCakes118.exe"
          3⤵
            PID:4648
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 544
              4⤵
              • Program crash
              PID:1260
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4648 -ip 4648
        1⤵
          PID:5028

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 2984d372fb57e5b7e9d8a658d1b0246655c8b38e1d2f0be290e0a7ecdce363cf
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 30a02982a1152c528d13b1d0998c6a4171f288904aa01a98648e4a8705a813e2
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f607f156ff3123cfe244ae6f3e347d1429b560c1195d3cde6b7a8a6937b058e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b61c4e263a8e3efbb65881933b5fb3da3ce6d39380c24d45ba7659d4927753e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0a13d584d9ea4236330f1eb63be6aaba6faff18a8b0a092aaf30f2bdc2b6a76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7263b088c0d8659973235201a3041795448eb94339cc2fdea4fb545090d2dec2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 74e83e12af577422fd5c7af1219cff91466c126bd8a03bfa62dc12b89ff2300a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f380dd7049d75f05e61ff7c3ef68b467dc2e7620f4f5e404bade370bc046e543
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 406f5a9e1bef226183bc3521b544787bfb8859bffd8304e485406870b5838c39
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84f37c901737edd9aa3ec1c44bc716fae046dbc7e7af0759a4b11511194ac507
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7008ff8f8524ce7fcfacaee009e6a66db99bbbe1a216c8c190d2a88a469efae5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c8e3093fd31f46bfbbb782a0ebb8e0b82197cc8e353122a5fb8a56bbf525341f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b2a035b5d61c49264f3a0dbb46d12fbe91bf0d067f13372065e6858087fffde
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e05f9b43d2590dead4cdf878e9dadc068363d0af3760ed183ae82e8e75068c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 742575ae231e80b9cdcfc8f1b69e916aaf7e6d38c86d30a5a3e78b26764e14a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40c1b97e10c7761e4a481fad96d66d350dd0d1a9fef9bb568f0149fdbbb2eb39
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec1ab53dc2f96cc06dc4ea0b8f04506fd8b33e8dcdbe499ee1e5ff737b1148f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d1b148e06a997f69e52759134e530e0c3fad62cf4c3dc488b4839e9d524e249
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b8caba2f156834180f68d28fc23affd0afe2c0b5af03795a9bf4b25a8e5f0498
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94a210f4e97307bba0ce05271d0bb03bf6d2c545e7c9f91776736c68ede56b7d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2cfde3e2c6504cf015f12d109dc037648560667ea04370e6f27c2a4623749046
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9da1a9c1a0f03b83578503fb8a27c9156a108e3e6460c023e9c70afce5beaf39
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd07ea828fca13778203e868e1f1ab6a6ade6c6ffd3e854b8ff7d197864d483b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 084d94d48d16f81ae26d90f977c409d5f154a5ba45da9f57a314cb4d403c1b75
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc3031e3ff5ea7c628fe2c00f350ba9d8ade8510c8d317e9ad328a75d0c50d74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 012c73b175dc5e817cc73bbe0ead82fe6a302524aa46c2734e6a7b98bf05c883
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c7a2565d6a8c36b1eb244a76ca69794869671608c416f6fd3448cc3816ca26e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2eeb34522283ef877be877f891f8cb4a32df1493636a32225be033cb7666c69d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f8a85bb5bf8e67e9e237dc3a513eca5fee79367def372035a79c1862bf3a118
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f71ef7c59f2601486ad768e6c5fa592e44773bb8144b18639511606356c6c605
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea21b37784601f0a254cd27bf1e49329bb510d29e480b8eb8075a23459989338
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 03487ff20e0b4e7d4409dd8b372062b796789a96ef26c07a60f751b01f4ca067
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b0986bd2982cd098097ae77127d5cf3b5a99f10b0873d23ab7bb855a306b0df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d876ec58f5bb595ceec841e2e0a17f02a1e0b93099fab645d8fb11d191011ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5083f53e9de751764cd0a6049fd822b29c826226f4b402092bf9d55302e20983
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e36a0e49eca62d77669d2e8ddbb7b1ba47bf7cc5c6877624a90d4599a04f529a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa5b7056669e00960dd544cbb7e16d39bdb0edd2664b17ec60fe213890f883bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 922b9335d89fb9e9de564bfe3021ad7cf82f6689ced6b4e08f45b05306ddc24d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 608a803168e7164576c0c8bb99b04ab271afcef127e835adc27d885c857101d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0a2cff76ad28d5d851cd2361d4861278e2570048219cdf70c7a53a3c5a9527b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22d23384adb813167e9c6ccddcc8dd78c84c1a2ed08e9c096592f03439c27644
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cc95bc206f0c285686436655896a9b39f6121ffc298db54d55ffbb1f855572d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c7ab74bd139e96a530f7b0b55ca3abc852288d66f30b2e2db0ca79325e16224
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ecb550ee15b6278751142ccd6495f3214e2ef465b219085f55a5995e1ee44eda
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb4f06219591e14a05f6baa265522112490548a0c005fc8b596dac5bc24e1484
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25dc226cf2975c8757dd6ccd11705c383c972c133c13c6a2bff9ad00c1aea680
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c870249c6b07b50c84d2b0d5fa80125dd71fc2ee5e59704c6cefa5dcebec7e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 588f5fa57fdc4227924d2213b0775ef90ddb1d240d7b95b7b41ba897c1b1c864
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02caf12dfecff9bb48e4e36328a13b1002102ae61baab3d20fcbc60a843c56b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8aebdd39f17fe6afa5ca03d7659cfd596b77e254049b7e6dbfd39f8609d6bd64
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87fdd2231f31449012ae9eb5fcef21a9608fde75f51a701b0611e2e8d15a7328
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b821d3e84147781d401dd83c17d6c7448692f06ca7ef5ffc16e1a0590554aa9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e28cacb32f61d830ae31122ddf9ba492c2fc4f988b6985eb42df1790ec8a93ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ded9c7194d22162c59840f9b668a9b1b7eec07cee33c5fce6b3951907dd02590
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a55c49fc938e5725d9ab13230776e16aec38641a5b58459175b76eca717f0ec8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 abde21d233b606ad767156cf9de195dbe936ee2b4d54c16f34730b14bcbde1f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 135bbc5f923591aa9543160702b31dfc65b87f37dfbcadf3fef7b401ad9752d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8062a4e0cbceebdd52b1d22f3f1ab4240caa6b002d35ec386b5dcb26fc52a76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 008de4a9615c5e43ff99f353197bc505d2a0f7b5336cbe0ea3d3004b5633afa4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7c05cc2e1141ec8a73b9e2f9342783488ae43e2fc9e5ecd225a0fcdec1c226d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 282b79d3520aedae843419156ce693df265ce94bc29b7cbb186eea329e8ff6da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20408b98d60cfe2c52dc78f2eea0a96c1e17226af81c994aaa376f0f3dc4d0b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c56a23d669f535b4321b5f7ec328678c197841c3ce494a543a9dccdee74f20c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 701f7af51cb8732d2cf0bb3e5b8ba635d17624947497b5af35cf7ee450da78e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8eade4e76a927f3f5406e83a2d4b85c8aeddda93c84e42382a4b76648746094a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b83b512714587260cd6d418bb0f76c024f73abb5b603c283546014972a41c251
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5b04c1fb77fa00bb91d0ae6cb278e9bef013c05ccb171628289cd5676230c6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 caa5d0bb955b6554ef5171ae230687dace9aaeb7c4bd6f4b161d0ee08834be9c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec010fb1f42b6d0d89df435c3c1c5812a989659e4b649c8bdc38502b8b344a17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98e343d06a06bc9e7a418eefba58d2338e50166f89476f8a8a1cad2a3a8500ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54f9e7af643f5c11182a69b986cc4a39b72a12eb2237ac07a7dc9d2087e9dc96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 79cb2e2044c9b0b987d33f8bd28689df90e95d020f3f6b82986a266ba2289de8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec496feb2f31146de99dc7a147e74875e9a0d5736092948b824af280598b97c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ad079c5a5abe66f001dc5c925805531a222b6c25e3d6f7f2a2591c992e3114a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3619859287c543d125cc638b3909a42936fe4ad793bfe274e0a599c02ca6fcfb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d91ad4f30c306480c26185c42c424942e9884c0714f51a6c450b8b0591dd4c95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd143f7526de29ebfd0cc203ec32f9b3a04533ead9ae2315285ae8d366713a00
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41520f6e60d171c0bb3269510202ff470f324d21fe2bcdc8a6f20431c2b092ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6fb6b256f6a120ef83dc3ae3512534b11a2e3b308807919d67d52fc608902d86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a16dcf8232365f5782bebb59ae2bab7f22cbefca46aadd77fb98a7a249961008
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b63ec89dbd7e3b0ee3978ced90f7b7afc06544a1e199e9d959f07a75e234f53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba2c453cbcbf5eaf63a761fd83945cf1a22b75a2cd30b66ffd4e39a6c884f349
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89ff51fd88362357ccfaddaf0dae40cc5f2ad86f1ca9a06237d1990492f524e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6a3f53de846479f1f63ec697e77472095492c175492b7ba40d1e19b20018ba1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9337028771e22584743b1fdfb8e91a1390102dcc0298ee1dceb2c316bcca88db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d155f84bc12ab0dbbefd66fd4f4e3c4c98c85e2b13c17d5edc8cfbdb2d21ef5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58ee44df043808620c2856098a39cedc441e8ae7f05d7123a2a70cd30befffc5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c74688ca194d9c8e3d9c0185bc2f4afe1f1cc900950b5c8af89deda6092ef111
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d91255df38785ffdc13245aefc4552caa60fda9fb4fc8cd51e2ed87dd643778
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8e003a5047d3e444febf7f9a5c1c75f5b71c53776b9f20217a1017e8d7e105e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72f190ec41fa8d47b54765571dcaf53f167e0187967b82ceec73b6245be5f4fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ae17e8926f28e1c7d079be46e0d59b734f650b53d05fd90e44eb7b6c71375ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4a3839adedc602074efa6b5e81933127c4e39fbdfb8bf6361ed305b2855f536
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b59d59bf103379ac1e53f48f7970967b070231670f2d1677342f49bd0a5037d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83468ca08ee68e4fe54adffe17dbd776c267d15b70c6350090f58b1f50cba9a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82b594fc46eccbc2e5dd8ccab0423c4b79a3b934566188e0fc87bd035bfb3273
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 efb649b5bcdfe99d43e8d2a1a606b0ddf5c279ee1dc3ffe13dfc40457673c115
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e23fd5dae46818a4a34df8ac0c2ae6158fb3fe5a2cbbbf031bffb1feec3d2ec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25622d467c8aba5fa4f0d419e94377e667a538e9119c4046b18b1bac7d3bf6a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 413656aef2212b80ee5ee9a7719c744b15e2089e991c211475d8720fe63d2d37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fedf048a044af9ca4ee930510556912d1170afff603d466bbf427c73b3257bd9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08a85bf63053a83a9821a2ceca06330970af083e017c163cbeea54a978bd8d4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 490f0ce60caf94e255d6e5baa5b26dac4c62b17d50ce8c526bdf7f34256dc4d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 721bbb74deb3251fdec631b65e8b620cb0e3e5717d37f8d87626cf1895a3d40b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9991db1124ef577a0204f8178767b57bf7052f7b217e177e9111b377339d5b69
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0386a7fc634e588a51b75db60c83ccf524c6aeb8faf53ee5de72f8c590870544
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 407a16be3fa2d79940219f0c77a3094d28d058e92037e337411c22ff58b40f87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b626b1568011b3e6a26f139347cb50b54e63a9500550906593c90a5eeca39317
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3864e01da3e8d2e01a887725dc03d05d975a18155167a15e882de6e4397dd024
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 792fbe629245a7c4c403342defbbc82c3e91f922207ddd946934dda28fb00251
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 379e40a22c4ee481030b1f43aa6e82366920c48172ba75de681afc7fbbeffea7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b94e063794bfc8afd17493b1bff6669282f04e71753b4e8ec5edb8f3bed70db9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4bc83284f3cdd7085179c9b2494bd211e155700b864b4476a40930fe45bc6307
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40f4f6561afd81348e1d94c722321d5dbb7e03df264b2579a859f2eca53658c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2482098b52699a001dcdfcc3849acd2bd5723e822aba822b269a67f0df6595e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee54ea3d27623696f74c270056c3376956e7a8ba417a2d3fd2931fcc6d989667
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1001ff941604597b505d6e263f1f30ea2a5d7a7c69e356aa965222a8f4e7cc8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ac56770bc50f6e96a9bea787472da146de3727cb32ff356d9c9440b810da79a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8bac29562c8005f2642817981e65b0d5946668797bcdc495da5ea82f706c65c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 918741a74be9a60f9f1e0f9fa5611e4f47cb18280efe400eccc27df217145313
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5070781b33a146c8b7835480c182210a010f242086abd52ae5e85d8abbb9f326
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7cb43c8a5e52ea47efc49eb35bbcfe42a9d2974e7ffca5401ef2c38b58083536
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca00cd2ee0818d1c7a6365e590a059e99c436f0b2653116a679cbf904b36801e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33193e0bb5edb762c601cc267f1593aafff34c338878b5ad5bca6ce6b9556b2c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fde21d930637747a9a856c9ebbdd65fc7bc4c23d8a7f4d0a96a28f5ad53888e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab8afa6015be68e328f59c16cbdcab1674218a242f765ad5d4d89633fe22f5f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ebbd52a6b849c2f4550d978274e54a022fab02c57b591b2274d06709b17aa2ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 05ae447ef5f14b54d35b7c5782cd94bd9f8cdb97bf4f0e3cbea840438c26eb96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffad02d2dc97ac06ac9ea6a69673660a561bcbb1609693dff4161ef6b118b596
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed12a376f95b1517acde62e445c3c4c923d9e031a7ef1e458a1f437f994d52ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 996045660c39f4bb0be397a0cff0abccafbf1bc41476ca1ab6a04a31ab8a2e96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 413955ac293cf3a5dcc633a41ce9c606017a58941da5d7d2f47321c4553b5413
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 751776808b8315ae0a15248300a24511b9304affe558ec9f90a6afc69b72cbb8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e305fe41eb9966040d167ce042fe0d38702653079a4a22324784df0ec30be9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5da99336c729b95670e0c0b20817af117a96dc2ba38c2ec2a2684c26b2437bc0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ae46c360e9774fc63a80c907968009bff3aaa913e38c97459405c73c66602ff1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd444c610c7d31d9048afc9cea7174a9c63d26c4c960246cd3bb274781698974
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8a20d76e8acc8e6e25e4ac0ee81d6c6f55749c8b5144a2f15c4f8e60854fae3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6af0e7d574223a5657db87a22fd8d61391c25ae35df2ca528384de50295df8ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7491b8452f3c209e87491d7bfca7cd3fd965177ea0b89ad8e46ac5a818b75682
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5a38f09071ce82bbba3c72f919d5a91f90efd0e15efe71d9f50b9f3805a1857
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e41dc16a8451d1558774b285de7a5eef94c76ca8fde53c4ee1f3ca785d75796c
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              memory/3152-5-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3152-62-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3152-2-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3668-68-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3668-6-0x00000000001E0000-0x00000000001E1000-memory.dmp

              memory/3668-7-0x00000000005B0000-0x00000000005B1000-memory.dmp

              memory/3668-65-0x0000000003DE0000-0x0000000003DE1000-memory.dmp

              memory/3668-1383-0x0000000024080000-0x00000000240E2000-memory.dmp