Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 07:24

General

  • Target
    072be7e13407a85807e2076c13d2d059_JaffaCakes118.exe
  • Size 528KB
  • Sample240624-h8ld7stfpl
  • SHA256 8da35883b0c065258b74c01b9305c70143bcbe81cdc4b55d01415beaed03b8d4
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • than.no-ip.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    Svchost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3580
      • C:\Users\Admin\AppData\Local\Temp\072be7e13407a85807e2076c13d2d059_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\072be7e13407a85807e2076c13d2d059_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2556
        • C:\Users\Admin\AppData\Local\Temp\072be7e13407a85807e2076c13d2d059_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\072be7e13407a85807e2076c13d2d059_JaffaCakes118.exe"
          3⤵
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4692
          • C:\Users\Admin\AppData\Local\Temp\072be7e13407a85807e2076c13d2d059_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\072be7e13407a85807e2076c13d2d059_JaffaCakes118.exe"
            4⤵
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            • Adds Run key to start application
            • Drops file in Program Files directory
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1560
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              PID:4996
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
                PID:3216
              • C:\Users\Admin\AppData\Local\Temp\072be7e13407a85807e2076c13d2d059_JaffaCakes118.exe
                "C:\Users\Admin\AppData\Local\Temp\072be7e13407a85807e2076c13d2d059_JaffaCakes118.exe"
                5⤵
                • Checks computer location settings
                • Drops file in Program Files directory
                • Modifies registry class
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:2236
                • C:\Program Files (x86)\install\Svchost.exe
                  "C:\Program Files (x86)\install\Svchost.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of SetWindowsHookEx
                  PID:4044
                  • C:\Program Files (x86)\install\Svchost.exe
                    "C:\Program Files (x86)\install\Svchost.exe"
                    7⤵
                    • Executes dropped EXE
                    • Writes to the Master Boot Record (MBR)
                    • Suspicious use of SetThreadContext
                    • Suspicious use of SetWindowsHookEx
                    PID:3800
                    • C:\Program Files (x86)\install\Svchost.exe
                      "C:\Program Files (x86)\install\Svchost.exe"
                      8⤵
                      • Executes dropped EXE
                      PID:3836

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Svchost.exe

            • Path C:\Program Files (x86)\install\Svchost.exe
            • Size 528KB
            • SHA256 8da35883b0c065258b74c01b9305c70143bcbe81cdc4b55d01415beaed03b8d4
            • MD5 SHA1 SHA512 SSDEEP

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 36ca96515402c5d095a6c094ec844c89cfb7e5bbf0ad91cd9078fb3c0b57cf41
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d9ae9faeb32bd20835cfe896d84e2619a0b63e3e1fce96f1d474bdd9eeef679
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f68f35fff0febfa3efcf84e0768f2d5f3ed8c0e1aaf9ffea885d85aa1af697e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c63732fd28d618bde0175f158bff5fc24c1f2a496bed54ff1ac74d94b6d5690
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0dbe5c790c3552e4dc85e19ff1c328d7cd8d777176ae52a0502712fff50e7947
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf4da11fbd41b380a0cd76fb1d359e9e36b2c175dacd8e2cee7dc6ef098d330e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dbad7849e3860d9b1924786be3f0313b7a9876d7a28d903501817a087a836eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e2555429e3af7e770816e916f108cd839021289c7d0a4e3e93e2f12a41cd9de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82a6200424d506d056912bf7729282aa476c8869f53e55602b40836c3a820b4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edd81244f22a0785b21c18794fcbc3bf4db4fe421c5d1944fa0bf00a0ed423ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e173ab00eda6762a949adab5d6b4caa699c6777357fc870e7f2671cedd1ea05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 194122e8a6fcab4dd8addad634023e0ccbb2670130163ae3e79a877304c59b05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51bac0a63bb2d5c7b2cff49859fd232f81eace84d9a56cb11ef8e3589333342d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3bc6b7aaa14a1204dc37327b233f59c471ce026a1bfa9518a969c05b98f19b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5f1eb82e9383ac09944c3b9d82ff86f1d9a4ffd56232d436098652f5ac20b67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 486771dee0929602f68c64792c7c056388ea60056a34288eca6ee2d8940921f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80dc8a77555a676b534a8410374c0d475050799c7e86c6f727136f22ef566c96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2b75ff13f851fdefca4f05d7c128d3cea46f8e30bc030896c3312598897d552
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 838ba387d7ab6cce5ea2a1c22d4aa8c21934cb8a75538d47d4f1d003dbb643ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc1890f4f936eb28c760c5a4c18abd76eb75d83f631a891ac39d5dfd8fe32f1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bba518ac1e1a26dceddf005c408cf72d944c82148fe26a72f8c5f50eab71d107
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07f9d0e07df880d5a2f8b8d5e2cae2226bed20eb4748c858d729438636e63f41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ee223c14a248676ee7a469668f54e980027c22c27287fdb773770e967f97014
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c395a11f83b738cd51c740143d80966bc2c535f3735c30e8ed26a4398238fb72
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26d7583d6651a90049e13d97f44985502afb361e00d08ab7206f53724834feb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b04baeb379f0c648d46f36cb6f49d4761c2f63d653fa1e4572ec8abf6915de27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d41275b7156667c6c31d362ff95e72a698dc34a95a747e91ca17672fa1ffa7af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e2d707fe8221de880d0bed13b743f4353d7a74b32fd02ecc35134ae90a51524
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af1523150926820ac03cadf95991dc7515db77e201154a91ed33c7ee0184f608
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58a91e2715230e37c2a33393d641c3529885a7e23a331d2ae8920e339b011c8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a772f6c653faa1b3e87bbc0d114b2f44d30f2b016364829fdd4af56757bc60e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb9cdab74beaabe929278e4accd090c385ebb99d344a67f8f7993fdce0dc3116
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0c882a46b9bde7f6a54db0cceab3868d9f016ea26f2177334715a3c96696a49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a1bf9e47527046868c165aaef79985fc9bc821ebf630e19be4a90b0e4e34a89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecea58306bc6fdb79649d707507d93e4f060cfad0a7c245ab5f57c4df45997b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78af1c317949b37772370baceb2e5a82f7953226f82f023cfdc3ab5c9c7af5ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b18c2b35e8472d19c22d6a725055880851b426ebbb4ffb8eaef6089004254019
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce509a28a1cc4f452fcaacfc9568bdb8afe9ded40e5729d28eb9aca938775560
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30da7817e9434cb9e476d5f1ccf001e55e7e529b093053be8a4359604e55d33f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7049eba4eb5f80d7c63f414b2278444075e1577d519782e131048e1f5b722270
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b1110dbce6b8d7ae0bf8273a2de29f8b4f204552a7e9682a9745cb9cc3314d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 328104d93b7d807fcef1a6c88901449d1d8c86f4a91f2359aee6ecb9df3202f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48b4d27649282abc25a8030bfc291d1def6d31725a9da5dbd91b5aa12c079b2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f3269947778dae19c8505266ede1b30c10cf4a947f413b9fb2328f38ef10568
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8f77e2feee87ac82c98cb4c095d1fd8f84238b4f738aebdd0e6900d04021548
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb2907fbf189227b72887ca30ba3f8d08fa5ed2cfdd93db86cc0a4bd7bcb018f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fbdf3e041faf4cccd315640cf80183c7003678e02dce9be605632378fbee2b41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07b6f22b017ba72f953d1ccea8401ae3cd758d6bbb91352f9b97575fa7e3e398
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c75033f13742c6afac4cd3bc0a7f17890bd81062e8c01cc7b81b3fd38febb765
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b64e059e7135a1a9805a925dee5c7a115ac242b03a0ab6bc7a4494d73980c02b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2397f31330d6be4c8b61092a5a4bab5b194c3f6a3629701e1505becea1bd7e18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35bef85cf12c7b871dde8698708dab9bf9bc987882476f40867ac6b8e3bedfd8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 211a3b5e9895a07719631048e53bf22285c7906d6bcbf07777aa3548bc95a1bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 608a0b8344af9cd93452c4abbc7f9294f5cf7eb49e2fa01a78ed0f6904a0dc0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44d98461bf8ec2747c447174295c0f4bae8a26208bc989c231a8775615f86734
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 538842a2bd93fec1fb20db94da19a498ce61305d0c7e89f1e88fc0ff708ae510
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9aada95b27edc6ad5e00f26cc39244ad3c4e3ccd86c992b440a6fa17a02f38c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89ef21a62cec5229378c755ff30f5bf2c058b418455b76b3d11c035f512c1136
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c6cc78ce1c9b301ff181c448f9a5220f9d9a307ac8f1cd3a1ae9508b2b43af4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e88176d9348dd3fa0ae63e62c12bfb98e781b26ad85eb6db4348c7007cb105d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7586848b28b86ce84133a76fd5de7135c27b16458ca088115b1cbb9f807b3e2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9685d93e8b6fd88cc402288a2bbd135a4895e4ccccf4ef46e821f96348a5cc3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e40bd9ecd5fe74ee3dfeadecb6d67f884fbd697b42e9fb5036255ad9cedfcf22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea50a950f92b3e8a1f21aa9604398dd964c248bd9969962719472464054714bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9c6f4251ed56ef6c9f1c2e3ee2af75ad30a7d0f5ca6860c30cd0f417b03540f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f09231c84b1dec94d37cf899f97e61c965f940c8a543f51fadb6ceb0437beebc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12595026bf35a9b60fd9a7489c40ac76e7f66d300fceade4d6d541e1ccca8949
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d01cb4c71d3b201aac9057ccb5bcf3a21389469ad15f767a7a3ee47512f27cfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ceca328387f84b81ef7359926986fffad96162c62ffd1a63948b06ac9d91c9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47cb41f5c007b9914855bd0e5cfa196c210fbf4364832cc46cd0a093282bf6a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45b8b01c5e134e0aaefec4cc85b4ae42352deb1d13bc55bcc7f58014167394e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02b946280ebdb6521f71992aec8c1ce494ab4efa7bb84a4f80b83417132b025d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bd3eb7e4a873d9c7ea5a000292096e83a071ec6bd7f4ffd818476dec29a5d2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a445a7bf81c4350f6c1c86dcfa5a19c64f211e6986b4756a0daabb69faa590d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3887f47e1d7f96aa6f5b868ae8c27ab559ccbc2d5219a15fa49798f67477a45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f2ef913229b0fd95243c0eb751ed5de62472b76fb8668073d0da57e486a5c76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53ae1bc8d143ff25b5a7b3afcc48c34c8d39ce6da0bfaaa92c60e2b7388199a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1105c6b99a7d9dd9df737b54f4a90ba01edd4bfe0b650d0215defd602b036564
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9eabd1a7938d45afbb0912eb3795f10dda4687b8d4996c6eab1922545d6d3161
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2b31513ca70bc22af661c1b25bd37fa8c7bf3aed1907c53e1f971c1cd887eb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d1ad2fe556d38ed1583b31b79b638f9a145f22fae2d01948175974d3490fd83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd4aacace516937c45406a2bb14403b8b0f7ebe143a0cd324b4dd7a302373f6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e8f833b7829db433d2fe7dc6eb31606184160558a12a255482d71ab996f007e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10f2c4b89f2c793281dc12f9be68058c69a1dca2ccb7d78b2d7737e8a69d2193
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f185376c78d11dc839c769e0ab829af697e3d2cdff3f1aff0a0389356cd1c924
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc902b82a0d70f0a26be1ad43d20412ed4bf8ce5edf2376b0ec413c585f6c5eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41af7c4050ced620c2ca6cd9dfff612d815dd313fa277bb818be3bb6ae1692b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30015a63034c8594c75cb1ac665d6c9f93995d0bdf98135395b363e44c192b2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 567e1bfcbb651466d8a449b85997585f6604443916cff255662104a08284520b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d643450965bd0027edeeea407f1802f635a03e015ba33bccb830b5b7a1f82816
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d354f18698efdee2adb6d4760c608e4fd745b61743bf8c3d86fc78155ecb677f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd91bcfa779f31eaa183ba21b674f0e0c49e3fc316179c7a6644db4520ffce3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6c91d7930536c59fd1b63fa67ab927276ab7e764a86b57dd6038e6491b0cafb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78ded049f8c09fcad6ef030142572f9635016a2831718e52edd53c656582c9de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 253b6501c97b68e965397caa002471f70d35b9877c8a20834e64202c6368d2eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79ac7db6e9269880895bcf71620c51358cc4c061e656ed6224e4137bcc69ab27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6969bf203cff7fce4d1e694cfebfc5cc07851ac089b30da5300537c33a8a0012
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ece2442eed6a33cb694d928f3c5f2263cc6b867a050621885ccd203488e3f6e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97cbdcdaa8885457e9ebe00b9f712831a0d427a7fb6c43c875f3813068eb6b67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f49fd2b76570d4c69b84c5cedfefb06236cf499608d1dc8d4cf9592c6fe7dded
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 493505efb4221c956928649bae5e51ab0d92c3bf95717516d941141c37de0c0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a7d92235e8c5378629c32ac511ef4222ac431c410eaf24d6d67b4b89923823c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2a25b8b791f4003d1c1273ac2dae7e74327355a7443cd8f2483b909faebc012
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddd093b32670ac5d169c00817b5853d6ed71c1aa446a217d5f17d4c14ec92a99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9470b0c9a44a3158d7fc7ddb51318ff9384b94490eb9ca945dd55d2ac28ba6d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 813156acb772e18e4b50dafa2ca406d83122382e87e4b509c5824c9ef6bde476
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ffbd6df3cc061c596b0d8b1e0797a545e0752bd1d9176e320601706984dec43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87d9f02bcdb8023587e9d0b9985b43828f6521d79f94cf22cb97314e02b1d636
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da30a94444ed6ca7573ba467491a4833a5f54a49f513921cf35511e5547bc4d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6fa33f3913978b5f241cce82353c74bfc38ebfd7624efb28d6ff1e07deed093c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2918a00bfa9a9eaf59658e5ec85452fdc7d4dbcbc6abad8ed0ede8220f20a6e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11c9906a282d2c660df4a5be6801d5216e796a4e51dd9c172a4076a6c890b9e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14d39d11b2f850b8b66fbaf1da09a593f88d0293ffe9f7a9ce7803e85a45c073
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c908fb4f3cedf7492e9c45a58dcfb5fb39ad4c063a402f8f878167715c6eda2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c362fa295497f95a3f4dcf311d27877cf3aee4fc681ffaef39ec1eaa12d4996
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 232b372c6a250e27c7d8e52ac46ada7eaac23e7790e80850d89c987746ddfaf9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b7af0651ad7059d985b5fffe1ecb56a6e6de8d90c0cad91bdda60886d2ddb80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfdc13e76dd7c44d309164270beda5ad80929a1c3d4102924bce0346988c8257
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46de7b2c828b8decf4e7ce017c8a9dbef9d87b1230bd22b3690ca3b65fb99a71
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25dbb06c5dd3c070105f5d6ac2060ef79a39c425c7e65018d20f9d551a375b21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41e8c9d284abf844a4ee1dda7a2f7b77b32564d9242c60527be6f26067be7343
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d0aa03c10b969a66330f04b395ad363df3ba5da32770cc55c529033ec75249c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6cf33d37e7782adc96efdfed5722cadf640c67eee427ef9a5564b3b421adf579
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6563bcbf5566c70514ab049533b4ec75d4d696f3ad78b72f19efdc545c941ea3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2729886893079ab444801991509e084467798f74ea90f0316ecd3f55c44f116e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a472ab1ba62f2bd853f608161b84e80795012885c2fc40ea05c46817612316f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ba0930eba1f0ffb2ee12814df32f7c3cf1b8154f4e8bb47e461bbacbd52692a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a1e0c86eb8df716f248cb9093a80f5d543e7b6f273d3fbbd3f85c7decb13455
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef3497384d8b52032a1fb058f55258277ff24c41ce725c23cf20f3313256c35a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16e08d3219d0c94c809b59fdbf832a85528584f650e63fe3a7a6486b89e6f362
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c111dbdffb4c38e082a0622ca5962728d68c6531d878eacdbbde9a430199c5d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e757ebb6bb4a6e3263652711f06d4fc80fe9cc4beb2de3fb8257812b566b6861
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c8d94badeae5c7eff742a24ca1aa71b75b8ca47515f4601de3998aaa756111b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d5cb65f13182a55b8e17aa9ef71101ad5f4ec815dcc4ceaac64252663a8f3ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3c1a9a389bba48e8660f8cfe6e481b6d6f6c7df80917691975027737a1c6d4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b291da38f0b91415f91b2d780c9763382a1b33bbccea5caa44ea95661a0fd0c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2d4fc7d400f7e2a8cfb01d4d54dc6b584a44cb0242de83de1f86fb5fafd6d0b
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            memory/1560-155-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1560-7-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1560-18-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1560-19-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1560-22-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1560-13-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1560-15-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1560-14-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2236-1432-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/2236-156-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/3836-188-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3836-194-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4692-12-0x0000000000400000-0x0000000000451000-memory.dmp

            memory/4692-4-0x0000000000400000-0x0000000000451000-memory.dmp

            memory/4692-2-0x0000000000400000-0x0000000000451000-memory.dmp

            memory/4996-24-0x00000000005D0000-0x00000000005D1000-memory.dmp

            memory/4996-23-0x0000000000510000-0x0000000000511000-memory.dmp

            memory/4996-84-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4996-981-0x0000000024080000-0x00000000240E2000-memory.dmp