Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/06/2024, 04:33

General

  • Target
    014660d945401b5375b2780cf7f0f69d_JaffaCakes118.exe
  • Size 403KB
  • Sample240622-e6yd7sybje
  • SHA256 c113953b85a76548655d0b128d9def4d685e61c4bde85cc02158d9a0ee0feeae
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\014660d945401b5375b2780cf7f0f69d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\014660d945401b5375b2780cf7f0f69d_JaffaCakes118.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2576
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:920
      • C:\Users\Admin\AppData\Local\Temp\014660d945401b5375b2780cf7f0f69d_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\014660d945401b5375b2780cf7f0f69d_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:4164
        • C:\Users\Admin\AppData\Local\Temp\014660d945401b5375b2780cf7f0f69d_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\014660d945401b5375b2780cf7f0f69d_JaffaCakes118.exe"
          3⤵
          • Modifies registry class
          PID:1368
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 584
            4⤵
            • Program crash
            PID:2484
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1368 -ip 1368
      1⤵
        PID:1556
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3368,i,3144109701624127473,12586215149656995128,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
        1⤵
          PID:4168

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 53de06a547cb3335eda9b31093c74058f7aea79a4b08ed13f13a3e2c6aefec88
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 4461d89a0a4419bda99039f559f11895d3755e25fe9ceb2e0c6296fcc01c7c9d
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d641d793d666546d96816fd9aed7a101d69c3a1ee1bd6358e10c2b5cd0d9c26
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a42b35f1b5459f1d26edda12e61ecf76e26648f7d155442de1dd49c32c6ab90d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 675bf9d0829f943ae93223639b50b64637e5f8f675d6e885a648dd377c5b8309
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 80e46a2fb61527eef17e5a5228caa77eee4b691f44fd1b07a47897c6f3377ee6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d13759f8828c959214ec7cf10c5afa606aebe597365373440fc98daf83caeaa5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 090774d3d9d752b34db01b2832acb958b4df01095fe368c90118ac2c140c4923
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9deb60f7208587ac5b4af00efbea03714aa44dffed52edacc013199a9f3e36e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5d36b9d2454a5f63c5819635be6ee7291793ef1188c3b986d0ba984b1d1f00d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 548fb44f222bf2e35361a4a086aa84f4deac738b7143cde63cbc3a40c2961fd7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86964c2052cd22103a2b1e25ee2e69f7b7727625a59e204ab9aa546d1fcb308c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cb9e42a8f0f9793afaee456fc9aaec5dc8a8a2242edc864ec4ae61e6b25be442
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a48b03acf35ef7b97f414eb8e66b481dec822b06bd1c03f4065844e06aba615
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c948e117d51829bd19e4ac57e6931c87d58d445b9fae537e90db91ca37f1f537
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85f0e45b36b65ffb13bc1adbcea4b5b02245e95152dc9dc8ed58e21f25c502ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d29547b5defb32b42df2a7968abead7370c2ceb6b2117690f2d789995ba29f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a36ccead364255b3ff03beb287d7b5a45b8abb23c553b432e3ffccdd8a2a078
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c56db97c270bc4f3a047e9404618a33b22835706352625ca7daec5c76a80bfec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e4fae8b56b50bea10a78f32687d85052e46c717f8f05626b84f30e634b789a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e590228d2d169db4125def14fba0be59288509d4885e1f1a91e839b65290cc01
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b360786e47189c10a647812180aad7a1ec110127f69216e6f73f5fae1bbcf22
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b2820ce48e24fb9cb4378aa99245a962498189144530628ed32e7f31f709717
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a51492b21d73c0d5fa9cf33b1511a5ea91453be2e950d70022e971ce50696fd9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 212e4b3173d31d54a7fe590a8523acf1083a6a3b6417c5ca4ed62feff560e31b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b278b674d747ac00d9268fe1188d2382358379db1a232fba5dd1cc38eec8b349
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7424c16526495f79f53b109debffa6042c9f4ccf3cb910a2de82dac5db4d16a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 815e4cfee98995a2a366185700deac12e18d47701ba3fb3e6a91e5b0634946f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e0a83565b34854c4ede32681ea5635227f112c9f8ea175b9f9b5920a4296f70
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff590270fe7fdc1b97e7852af884b6087722ec109ee096b3844d02cfa2184507
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa1d4c0501a614f96e66c0936ae5a2a1e41baaf0a22602ead0a4a17b07457ab5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5180a872514d622cf500fe7a04d3536c1c74033277a24dfe5c28925c73ef91a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f99ba42109133734bebb17b7df958b261a3637b3686734de4f87de845f7e4834
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9238473f35a44fd3d809231e3ad1b92bfb7515d24fbffdd5b4e28b7a92d3b52
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 abf1f0bfe0893b708a9d99702a8c66c18605ca58d48e3e05fd683eb23d53b286
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5a453f85f04adf3fed3a00492af9921d8bb9a63df4af5a0a9739d287aa83030
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afe17cd37c47aa1bc8405a38839ffeb2eb07e916e1e7f34b66f07eca61263e90
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5fcca7ea331f811dc837d28aea22683cf47cfc008ee20ac1b8b98fa64c905d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0710c890ad62c592a14ff24c6088ca0dadca2d5d5d01f789ae32c23a8abb22b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d9f98183057f60f11966097e00e3034a1820b93dcb2fe3efb734684b6739d56
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9e4c7bf48601547ec49cb5e10f7bfb209319db2fbf492a19537e7a5c8c437c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 efcc48c2e41de6bfd0de08149aae25bfe4e86737d343236539d0ec1f1c808560
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 99310d165884c8ced0f4fdae093bd3a10b28dc6272dd422f7fa88c7a29901a86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f96d9cef282dd240abb81e10cb85f9c3c69eac730f5f9f7f146f297e86e30b8c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 105a8071ad1be6ab186db259081e913ae33f309a7d950bd8428cfcfbb3966168
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c28cc06c73fb69a5b0342857680567bff41b8d4fa30b69b71443bd716aa88c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7432aa4448edfe217be2460693260a1c142d62db77bd5149936d42f13b51f991
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cbbd7392249e4ea03f04d7ece48a1ce25e50f2d76391b5b702dc071a209a6502
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 efac19815821b173a5984020275c1b5064189cc76df5ae86ce9ddb08d63cbec9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9652aea7e8a18b0f1c5f33225af1a2fce6f2970e03ad1673cf91e3826b9cf825
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9cefca298c313cf3f38cc84521e37221e8c74fb973a35d4ec43bc78b2ea05d79
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de715e76aba4584f2b1b59da912f1cf3e9f564632549e00272aff5ef7962186a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 304ecf42f684e5502e553f76f66d14eb47952aed205984c57db992c40505cd29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d156f0d65d46751e565c659126561d244224bc56c3e2a84d005b95417dd6bb05
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5bcb66cf4f96c8e6cb1b352f2c092921e66a773c8f0aa5ac831637739d65f8c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de506f1f6d142acb4160e64f8233d603d8237751f30e3c7c996d337b1755afab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef46427453e1ed479a3b747c703a16af307b3eeb10ed9343014b4c0922be914e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be05d8b021731d588847bb903d3e1b291ac3988589ae1d0351a55ff90dc0f49c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5102c81edf73849fdec3312ca9714c9e32b44ba9716fd3aa5beb3b37d7c658ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d8e5e84aafb5d5ec12385ca257e83148d44da6bbe9242641effe2f070d84e45
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 000a6639769824c6abab74e8f0679e6d45fe40bb60fc7152b443a22715a7ec02
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e56f51a201ffda0afb94fc169cf528df3e10bab62a2f95351cc6948bc4eec730
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e84ec1fdd828ebb4a5fd2fce6d345aaa3298bf01054420d704624965511af84
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a6a76fecc4cc8c62e6b6992181f5a8ad619711c2fd3f83189aa32de735ebb7eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db35d3b2419015b717db9a75a5a4816cbf111a128a27589d44bd360ac7ebde23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d2ddf317d0ef3dcd3d86e452094116b51beee37d74b082e2bf3e4c66b567c579
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e763c4eebea3aa63cc3584146c08c0d8bfda2600dca095571fb1937bc84e4c83
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42ec53a765c4f65669108012f584cbf46ef3e053c2e942cf98340e5ea098adaf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6de2cc94365f7b65c2f643b426d5bc0429634749211a40308fdff42bac4e3ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f748c2e369b87ccafe84dff5214e78400e91f61451672968a8330e1a6e7c585
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 baca9ef23240801a3c6bc4ce25d60e07f233a9a954482bd2fa97c8a3e2e0dede
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84ce92c70a50341491cd00e9d6241e4c416a72bc4c8064995308f83ba0b0b5af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5511ef0e2a7459c18705e2e94d564c5ade94f1ee27e15720b07375d14cfa45d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fcae1cab3540ac0c070467a8331fb049a37dc53931a6e3f7b5ade288b9649095
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1657dccc30da31903b9dbb4df2bdf398a1a3014fca42d5dd7f73c8ee42ea30af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86348b7a9944654bd6775d20cfd3377fb97d9be6230d2e78595b2f5302cbc046
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b825ee575623a0d61162c20f6b60d761f623b92579583a6b088b305c3f83d4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0d80b352a545eb6b90a017b26aa5ab5692c7164ee7544d31ef1c3d3617890a5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4a7f32c257c641aa4dc2f25d728dd032d9e5002494c6d81a60dc40b0a779625
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ce98c9c82de9d6173ee28d5e8a568ef46ad288346a3104d1257c373eecb20e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6c61e375c8b8aa3edff2a3b4f734ee40fdd27fddfad19e2329cee955fb6b26b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d009fe419598e7b28c68db21b39daeea3deead714cbdd92f90ff6a597700d1f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e227e6b9075ca95888ae3b378b320da7a234434f1987e291029e3f9a3c863d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 735a29eb81b17db3624e2b43d056e216cf2b7df40810821d2d43c8d0dcd82fb8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa291f7f6d362db8db412b7eaef7bd837c5a85357c9298d890c0a641e98534d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 203041126b1ba2acbcbf1ba1a87a071c8d12f476a134aaeae9fcc8890a209b04
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 782b0984325d3a97dcf6d498736c8f1b8d0a272c2d1107fe7c931fb15152fed8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 81a38b98180397a2b30d6645ced8997bd9311692080a17cc324fedb6d4374241
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ba4dbde8c96cad32f51368daf901ec87910573d2b8f43e15f9b705c59abfb41
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14f3a6109e2d7bb02440322dfd8f12d1676b4b0d2f07d0a15f0911f8a9e60d55
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d04c4a978bf5333674abfdc9b9b77536b1857b4206fe2de77f6ef5a079983ee2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 614b386af9163a7c5365575679f73052a029c9600498dc42432fd5ebc40031ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 028925f920a62899938c52b19c37f0e046ab565b4fd22f40bfacabdc9ef41cbd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d21a4a2f059faadd3f93d099c5a4190d9428ca462bd6ac26a4b40b983f8cfe2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c7cdbba6917a5837609c032dda382ebca26612ea4c60689bb9a4551b460ab6c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97e89abf3474b2d9a9d60f5d13310ca9ed90c0a71a7cd901dc2ffa81e24337fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1bae5841725b98283dd2d5ab11881dac4d5123a45926870516e21443822d5036
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cceae0015f7a4cac541a3573413f08d0f0b085e4fa3eef370163f0c3546a633b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4921d2bcafeba730b84bfcdb6a2ee2497cb557ce0f96dc68865140a89414ddd5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c3d11fc360a6bc4409087b8932ca65b9ab2ac61357e666f58bfdda0451700601
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3bad8c240ed24d63f2c548923ab2c50d16a649ec75ce699f56dd8289727644a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56f01e6688bf1f46cf971fbe9a037d61ba5e90a2b3ceb796da350915dfd3643e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 257b5c86a09d48aa328dc4b6f55ddb718ebec84c8bd5ee0b7233f3ae4616de98
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 314b270dcf5e55ef62f7d4ac4c4f23b522dd4b10a32ba76b284245470fad0a9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 756fde3d0fd76ce0c3474df580dbd87b6e66853e187cd2f87cb8d4c10f93eb6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9afd0421f0b4256010d3478f6316d521c452a2f2b92cc1de4883e6679f41aa26
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de3ce98a6edff5f367edd3bb7929557965b413b40035899d066e8987b0d753e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a861b80e7d3d2176e07a96ab8947c1a3487e2dfb8ed4bf6aa6a2fe2241c7667
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 45d0ff4064ac03a22f63c1e9ad545bb977a40ceee2ce5b24db9775972f5a5622
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a618f08449121738da174bc003c269a65e08ed6a34f0f92a2f66e62462cd3cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b21fc9d12150aff6fd370f4a26ed906c9e798f93f93fba2127b1847e00a55f77
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cff7d7f625219cffb62237b428cf2c3fbbdb7786f5e43a64a2cea1e377d85bfc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a9497670e01147e2cf73b9bb56fe1efe482a701f0adac74acd06e395920bce5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c85669234a2e491055f610fe437bdde2cafc2e58a1871ad20a24578ddfa417e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10f8fe900703cf6831c5a6412f16e697e3879b62bfa8f6950381dbae8ee9723c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7724a22c290871bad2930b71784c1eace808217b8f7132c9277a34050fff48aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12066dd0f14a322c59cb1cbf9ffdae09d0c0762106ec9d464319d445d9fedac8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf577d7897fe5567e9fe98283abd604a1bba1c6e1a3d589bbb7a12c25de4b4ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df939503bede271ad68106b7c0aac30a2b1d5d743778f0c956737e5d933f65db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 daa2073b0df305c67b569e8581e3139bb4014f9a95bbd41c620eb7055d2d3c11
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b8bd96bcb374ae1061693bdc5892ba3333e0b864b5d6419a4afacd3a14a08d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 90c28f511b5b03a7ac4ecf7fb826e26af0e2f063ac36176a81e69598872042e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9ea7120f01d39e176cf9a7412a7619305bb85bee79bf3c3396898aab016bd8a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3905491ca427a0640b3f577a306ec375e9864e04559f37d861ffd67912056352
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 292feda01c68537b191c07e95fb6ca04a5703be05362d3a5d20df63119c58a74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 487a62580ba2a90d63651c014fd85c7ef2e653019a5928bc86668add300c94eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7e27cc769f6fdebf2b98da2f8a9c72fe76358bb4707e08b0235013d74d57fd7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db0ff16147514ad03bb579965dc3c3b95279d839ad39358c384667554cbca190
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1766b6b60ff9d49b121d1fa9dc79841b6aa376f9d9e0cf2f8be1f17eac3ed1f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aaec44d8bbf416ca1e5ae7c1261182a9d0ef9517c0bd1b3e8b8c5416f2a55bf0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84ebb8248e7c9a98c64841f270019ac07983bb3210b4fcb8138ada40fcf1bf7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2efc08b97b5b4fed38e65ed6965380f766888d682145c468dc4fe0e62c2379ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe9c3530d1749b9ad08813f351b0dfa5d80a154edf2809b38480543c97ca54da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 abcfa4634429586c181cd129d4097bcb634f868deefde91658fb614cd4246dbf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1be9cd5a32f068280f758496b58e60da1b76c900bbebb9d29807a99905d7f577
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fcb83594e84403d8ec095f40834f73a699681c6df37ae139467a5170daad9de7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 002aa187e9d1e58325d963682fc03d0a7f0c8b66ca708b5a0a2e423a108618c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f35d3cc477d830012db68138191019100f6359ec50927ed82d989a0c54ef621c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fea152dfef0b0f200fe03d44c882463fd758e7c78d6b2a39bf5f2527e0ceaab6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84efbdf1a1ddd32d6b4d40aa33578305056c1dc2bd9ec1952fae8945671d29e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0375133a2772665e63a922ea6b865e0ac1e3d0f3d2bcf728bd3599eedb2f66bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a97efe3692a2a036158732d1a2d8934b3723b9b0c9c1a72ea52c6e65fad06abe
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              memory/1368-103-0x0000000000400000-0x00000000004AB000-memory.dmp

              memory/1368-105-0x0000000000400000-0x00000000004AB000-memory.dmp

              memory/2576-2-0x00000000023E0000-0x00000000023E1000-memory.dmp

              memory/2576-11-0x0000000002470000-0x0000000002471000-memory.dmp

              memory/2576-3-0x0000000002490000-0x0000000002491000-memory.dmp

              memory/2576-5-0x00000000024D0000-0x00000000024D1000-memory.dmp

              memory/2576-12-0x0000000002460000-0x0000000002461000-memory.dmp

              memory/2576-6-0x00000000024C0000-0x00000000024C1000-memory.dmp

              memory/2576-7-0x00000000024B0000-0x00000000024B1000-memory.dmp

              memory/2576-8-0x00000000024A0000-0x00000000024A1000-memory.dmp

              memory/2576-1-0x00000000023F0000-0x00000000023F2000-memory.dmp

              memory/2576-0-0x0000000000400000-0x00000000004AB000-memory.dmp

              memory/2576-10-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2576-4-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/2576-74-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2576-16-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2576-13-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2576-80-0x0000000000400000-0x00000000004AB000-memory.dmp

              memory/4164-81-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4164-19-0x0000000000400000-0x00000000004AB000-memory.dmp

              memory/4164-18-0x0000000000610000-0x0000000000611000-memory.dmp

              memory/4164-17-0x00000000001E0000-0x00000000001E1000-memory.dmp

              memory/4164-1185-0x0000000024080000-0x00000000240E2000-memory.dmp