Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 10:32

General

  • Target
    0dbdf91e7d0577301efac12840476707_JaffaCakes118.exe
  • Size 517KB
  • Sample240625-mk49maxemk
  • SHA256 95ddaef78c1132ec6575291a2971677f4efec4d8519151737455187994bf8849
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • cheat

C2
  • pizzafuck.zapto.org:82

Mutex
  • HELLOss

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    driversets32

  • install_file

    nvidia.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    assfuck

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3476
      • C:\Users\Admin\AppData\Local\Temp\0dbdf91e7d0577301efac12840476707_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\0dbdf91e7d0577301efac12840476707_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5072
        • C:\Users\Admin\AppData\Local\Temp\0dbdf91e7d0577301efac12840476707_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\0dbdf91e7d0577301efac12840476707_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2736
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:3316
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3340
            • C:\Windows\driversets32\nvidia.exe
              "C:\Windows\driversets32\nvidia.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:464
              • C:\Windows\driversets32\nvidia.exe
                C:\Windows\driversets32\nvidia.exe
                6⤵
                • Executes dropped EXE
                PID:3884
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 524
                  7⤵
                  • Program crash
                  PID:4092
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3884 -ip 3884
      1⤵
        PID:4280

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 53bc0a6217663b50f5bab2103f0bc45d4549117998bde0bfcceb5a4faa8c5a3a
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2584328369b7e907b7606bbebb7fb0b6558c7a43649cdb6452e71b0076a0f79f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 222ded14c5268257ba83cb5895b6bc123c53af89edb61d879d5d757d3579d672
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa933b534162ecd4ce8bfcbbec044c06514d2da70bc6a38262733f4438e74aa2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ac0703d08a45017e57a1bb403ca521fc669bc072a9812d1261ba3fda176e30a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5dd05f9685ee3ec77a22d056c1773f55b38949b04255b18ce9a17455ed7db8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 502a4f6d9ebfcc15c0ec5c4ead12db75b27ed7eec533c700ebc7b43b4aebf78c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ea4b1f2053c3e3a2e3fffccf26ee784bcb204affb1d52fe9ee69b91884823af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 670b86c1a5c116a51bf96214917562af258cf16eafe615e115999152bed5c079
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce0f30e19630e808f4c2c02d45f50fdd0a5e1baf00722743cf655b3251a2fcb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7724c859237637517e99585642c54be09fb75cda14e0042bae0dba9f38c4759f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f5cc8b1ae74a1d25503e5a49042511b744a4b0b16017fd773cdb4a1fa3c1763
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8b234e816cc0cdda5cb9470965f636477b23951faf7e5e43f1de6458c63c212
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 010b30d9329f46cbd30e684cfb7782caa1d41d68a15531ae8884dad330080525
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78ffc1b50604042acb8e40a3cdeeb0eb4465768ee0803dcb7c9739328d40898f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fab4e62c2978bb4d2f924d3e1147903d91f0b987a69c5995735aac3f3d39cffd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83c366916849c368434992c54cf7725d715c228ca4bc358c5931766fec9f73a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 948f9d9a01778c82c6f8487f5cea1b7897f228f0f3c84a5ce862f9c46fee2a7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bc7ba9e870e7496d03de24829eaa4d5ea09cb11e16e3697435cebd396064bbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ef5651b372b856d3d6dc9c5778885f8f823014ddfb2250948f3404ea1c13ac2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bc39a090bacb64d96c0d97ae0f781ce9dce500ebc047bc0f485f71688148cae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc9c0fe705c764ce3df67ef18834c8884d2623efae6c558d8a98d2abd6770549
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d40c8c9f36c618936eaf59bb74162b75555d83dbc7a0edb04916e388f4629d37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6fe1de2c52ecf247ada4e9147fd2039ef6d808bcfe854b7e19ebadaa2956e87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c82550ffbab7f470738d793e198618a5fc0ecf546c3059d7c5d2dd4eb1adf7a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7287d0ede70708852cc14bb54a49e9806b69a6aab3a6cc89672f959904f8b21c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a844d57d3ea2463c0bda7ceddbd7eb117d0e38eadea17359fc6b3903b4b302d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f7f7b4e73bb63d1cd4f414f74a9936b7dc9ca7373db11b8c1c835022656db0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 936aff74cd72b3fe4593c8fff97659c0290606ff136c3b4fee4dd2fd2b6c99d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9ce19984bcec6078c66ecaaa710673051cc8c4671548eb3dc0885b8e917f5d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ce56b5c034c94d2fdb831d862708606a4ac0ed94d8b8ccdb5fd5118bfaf4154
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02794605b89d233748f7d3f14799a551da7461664532ac729436f0e630373e7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61f73d2683e05da23c52395dec85c96635df423f6dc1520fb225fae1a2979bcd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1aeb58145e5828705b50305c57166d0c90acc8af83651143a1ea2b8d8ec37fe1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 433e53e263a84eaf0453c450be1be3c2bae0d149489582eb84bef64ec1c2879e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c99e6710a4c9fe12211765c2a0b612e02a924c09dd8cd9d80221ffcda343a3d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21adbe8bb1be87906478bc0568246e20168cc36d81178c15f4978d34008f4d6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc0f56755a1cc2907c5f8eb7fa3e9e3af6761cd24cfc00c9648176b97adb3725
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c77fe6003c277da521af7db13dc3fb519a4dce7c9727c6dd51c0d61d90b8a44d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1171700f424a275c57b4fd6f27215e2195fa27e03bbcb6f215add20a854af36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e3e2f13d355ef4f998e4d060165525017349610b5f604ead655ab7bb2f0a803
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37be0b2ab48e8ac093680c3919d0a824a80a92c88cac42263dc2d89b954ad10b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f6b3f48a935c405371e763abc84568b43101f64b0b36c04804818d25b454b9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2da7e4de0360fa6ef1a9678f3ce5c2c148d576881791cf003f6b47401fb461a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fdc33d5803d03a75be5e03ec2d06c8e40aa7d169e5a8513f5aed868ae8aee3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c8e88b4cc7a8b0930de2ef21bde48db7cb70187797a5c3bd458744c5e5929b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d88f4c14ba8fc6b751d733c18f80ede82b9516e1318a53d1e1d00b24d9f7d4a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e997b8702035c30615be3801e7a31c6de497e16d5934bc7242c6ec133edfb72b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f465c870971cd67e7509635cdc11311896afdf54836ee760a30511932cc87f44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7184a60227033683c5b518147afe45b92c8212e2994f7457cfacfa438edac57d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a09e280c6ed5be31f747a8717b5e80bc88041fdf27564b96232bbf52bab851a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0df47ef3eccfea6bb79590cfa3663f767bcec745ed3ba21825f29c3ab21764bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d4a98dc98afb4f7f8ca506bea75c018ef71462f44c14c6d9db9bd798d1fb102
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8584241de39f067723768e178b7824e37a4fc3f0e4772971a1bf193b3821f6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 923a71350676aecf74ac669ee0824d62d29925022b10724c19e80d67b8678ebc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b44eab6131a60110ef9f384b742390f071521d0db0d1d1e9aedac4b983c0fb34
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c1e99f5d660e7cd98287fc999c17da8088ecc0cccda81fcad6d86a664b0cc0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a161b39de8ed50143f5d549ca4524130b99994e0548e5d4a7e1025eb690cd735
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b02fe6d67c65de014d1c9fe3ea0be2f177b8e73fdcdf846d5c373d38fdecc16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7d2ceff297efa5e106338e14653506d024eb06a579eedd8dee671b235c6b49f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bd4b1d8fb6ba7d5213a8b633bd17557e33b5183c8d926aa6cd71362e1a9379f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 018fdc2c113909db6776fd1f11e01761dfcb8c29e18fd1c40bccaf7be153b442
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b91d25c13a8ba640d218a07a307c8f040e86281863b517b3bfb88ba28b26856
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b220af9b96b85e89afd2f151177e0693d5370567562732bbdc2fcdee29b81aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50f22fdec421b23db58ae1e64e918662c4403151b54ac155fabfbab0ba937ddb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8d16272466f6abaaf91035d91c7158aef8e984a2a0a3977f9d720ffbb868b1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3bab7029b2c004a436e4f9cea0d8eddfdd4d981d626ef055d0bae03eaf54ee8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e0d570e7a5b4443904f3b4e46bad9ee0e6142433adbd1910879f6bae4a9ab02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4f53ab2c6b1cd3c26c18e2bce9e610248ceda286369c1496600d56f9445825f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bb6215417996b71a753aaeae53537bf1aed8b6f62573997c01e9e09591b32ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9ebdda81fd1d66f57728c7c9cd35f8ff404382b9759b2e5f0f5a04ce871e889
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5754eaa4af6927aa08790d2b11a8cdc509ac75e9263ee15cd07c7a528301cea6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22757205b07acd81f43e9f8cba162e314226508045e5bc27688d459b6528919d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abce1a126f0e38ccb41b56ef61e2c3d71ffe6ba3726019953b7e46cab3c1e60b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f55dc351a495c14ad93b79763f09fa778252efd8f2ea36f398d4e3d493990e22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 970a470d431b6ee11b584b52867f96d5fdc089d7dc99c5060226bbe7a507e61d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ee9c734bc7d976c5852b61491059e3fef4f38b3f2bad1a13d56b458c09d881c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e64a402d7ee7ddef97fc93c430327c13bac7c063716b488152f7c05cdf224c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f08dc2ffc69dc6e0260db60a4f84013ca55cfbba37be38195338faa37a2b579f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bc9c5232bfa930428947d75e37bf04742231e5526f68d30a08cf22643fbd7fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5389e97e125b212904761060b33a595ca39265ddf2b7d5f8cb494e1e377e14f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63366db90c295efa73545b61faa8de8ed9707d87e17edf1f22d3802ecd84005d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef3293089337927ff5111fe6b018020a6f94902993f8e1f3c034930646ba0208
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f495f15a2637597ca3649c9d5120065783b5b7e66ec7859bb1ba567ffe7a563d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 328c80a2ddb101729dac31afcb290926ba6bcd19762f39e3af77d543ec04595b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec7e2bee5489bb4311af5faabd57de868daac8080b5e6927a1d241815ae62e81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34b024dda35a128504d34bcb1de208e785e03d1715af8f1cf8a3b60a59736b81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afc823cdbc28b59a9310821d387ec9039d7f75d52744a84fa9986b38a6a1b3f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f4321d8c448193917e558e3040b55db7a5a8d7e1ea0f50b344eb045a26a788b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8d4be7ebafd8c9d1863009fc005ad285af336b57744f9a1d6d96f257da51820
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfd4fee2bfc0453469f3be936feb64512b350d38bbb84cfef41109248c24b3b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18307211bfc08c40ce6e4f5556ce8558fe5cf2cef688c9d73e1bb6c9075a22a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 675d21d1c512d70c8c29fe071e2b6f2d7aba301c3e84abb193ed32bca068e4f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4850ca1702f6597161828cd8d73b6346943480852a4abc2ff77c14ec3b67e0d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 882d2665f980e1925fdc2fde9cdb4bb85f3a87793a392ab2fc7b40405166155c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 deb9afd004a71e8ef885bf8609d54e9e3dd5b912b490cb2b02e3920d928dbeb5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f32998e2b33d2d1a58f3e45e77e4cc4a17a6e0f01212294ffe2653e3734395d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a092bb2901f6223b5d1b7f728340b51b12fb4b2d9e7654c2bd0e7a4eb91f5d31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 baa66b93f50144ef1dc910999904c926868dbc1ab83b24fe60d894c1fe94924f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d98141c7e1c602dd32a3148bdbb18bf17a75a122fb513cc6c63b5b349a9455c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f06f1951009dd991d1aac432fec6c19bd8b9cc9187ce1e79ce61951ca4a74819
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85a2eb6848abcb9727d576e2b2c2f0298c03c6335a61289bcc0677770bff2135
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cdd7141b25850de76c0f7e582fd93c4153ce056fc20d01d6326ae98fb54e039a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba319396d855d356de29e6c8cef55a6396ddfe03eccbdcded0e50665eff4a3ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9748172c18839f75b363badd80630fd1d2d389ff59381f0f1c1ed52153ccb73e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8263ea724d2fa9b0414e557d2ef4f62337049f7512d4da97a7017e05ee098b17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e284e83978b5b4be5b7e5a15ab81099b45e0ee476289919eb45d0167ad3e354
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3563463e2ac0c5de9cf0ad91f3085f42599a509124b926dd7da14abf1b060593
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3750c3eda897f715b1f9df3b3ab5f2143c731ae1dc45e1db1fe6c1502546359a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d6be6cbfb33df7b96ab7587cee86b226062424359f28db4110eebe04a869097
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0549bfbba2b61cff08105017e79027828e7e94a6ee0d8471f51ce2c6f117c285
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afdd203557dd86c33a3bfc0cb2a393d6367b961d3a431d888e63f7850059e2c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e3b9e22f36da812749d5edcdc106a3bb4a787a53cab56f1ec5386453231343c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d55b77a2ba83589810b08c3e15bf44927bb9d906af2bcefaa9f43e8932cfc1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84bfaaaae5202c0b01d4806e884c1f183d59de2b03ea5aba3e6b30bcea2f665f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67c7776fb4e9404f6b4c1a0ba13385ef2bb82fe823226d9fa0869563fab45c45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62f9d1e6d810173d7a0a0b365f4607c2bc98bbe7f8b4b63af8c089da99ab819b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6aa80a177b07d4c06250467e122ba494f1d84bc3d19a28378d8398856537f23f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff7a80469a59f11449e41553b51b5aa8c09dc8894842a8de8bf4b2ad87089239
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9aee7897a6cfb08beb3e83d701b475ac7b8fc51dd8a39325d9daa5582c1badc1
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            nvidia.exe

            • Path C:\Windows\driversets32\nvidia.exe
            • Size 517KB
            • SHA256 95ddaef78c1132ec6575291a2971677f4efec4d8519151737455187994bf8849
            • MD5 SHA1 SHA512 SSDEEP

            memory/464-283-0x0000000000400000-0x0000000000419000-memory.dmp

            memory/464-221-0x0000000000400000-0x0000000000419000-memory.dmp

            memory/2736-62-0x0000000000400000-0x00000000004CA000-memory.dmp

            memory/2736-60-0x0000000000400000-0x00000000004CA000-memory.dmp

            memory/2736-66-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2736-69-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2736-59-0x0000000000400000-0x00000000004CA000-memory.dmp

            memory/2736-198-0x0000000000400000-0x00000000004CA000-memory.dmp

            memory/2736-57-0x0000000000400000-0x00000000004CA000-memory.dmp

            memory/3316-581-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3316-71-0x00000000011C0000-0x00000000011C1000-memory.dmp

            memory/3316-70-0x0000000001100000-0x0000000001101000-memory.dmp

            memory/3316-131-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3340-1094-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/3340-199-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/3884-282-0x0000000000400000-0x00000000004CA000-memory.dmp

            memory/3884-286-0x0000000000400000-0x00000000004CA000-memory.dmp

            memory/5072-42-0x0000000002B40000-0x0000000002B50000-memory.dmp

            memory/5072-27-0x0000000002A30000-0x0000000002A40000-memory.dmp

            memory/5072-29-0x0000000002A50000-0x0000000002A60000-memory.dmp

            memory/5072-21-0x00000000029D0000-0x00000000029E0000-memory.dmp

            memory/5072-4-0x00000000005C0000-0x00000000005D0000-memory.dmp

            memory/5072-0-0x0000000000400000-0x0000000000419000-memory.dmp

            memory/5072-26-0x0000000002A20000-0x0000000002A30000-memory.dmp

            memory/5072-32-0x0000000002A80000-0x0000000002A90000-memory.dmp

            memory/5072-33-0x0000000002AA0000-0x0000000002AB0000-memory.dmp

            memory/5072-31-0x0000000002A70000-0x0000000002A80000-memory.dmp

            memory/5072-30-0x0000000002A60000-0x0000000002A70000-memory.dmp

            memory/5072-25-0x0000000002A10000-0x0000000002A20000-memory.dmp

            memory/5072-24-0x0000000002A00000-0x0000000002A10000-memory.dmp

            memory/5072-28-0x0000000002A40000-0x0000000002A50000-memory.dmp

            memory/5072-23-0x00000000029F0000-0x0000000002A00000-memory.dmp

            memory/5072-22-0x00000000029E0000-0x00000000029F0000-memory.dmp

            memory/5072-20-0x00000000029C0000-0x00000000029D0000-memory.dmp

            memory/5072-19-0x00000000029B0000-0x00000000029C0000-memory.dmp

            memory/5072-18-0x00000000029A0000-0x00000000029B0000-memory.dmp

            memory/5072-17-0x0000000002990000-0x00000000029A0000-memory.dmp

            memory/5072-16-0x0000000002980000-0x0000000002990000-memory.dmp

            memory/5072-15-0x0000000002220000-0x0000000002230000-memory.dmp

            memory/5072-14-0x0000000002210000-0x0000000002220000-memory.dmp

            memory/5072-13-0x0000000002200000-0x0000000002210000-memory.dmp

            memory/5072-12-0x00000000021E0000-0x00000000021F0000-memory.dmp

            memory/5072-11-0x0000000000630000-0x0000000000640000-memory.dmp

            memory/5072-10-0x0000000000620000-0x0000000000630000-memory.dmp

            memory/5072-9-0x0000000000610000-0x0000000000620000-memory.dmp

            memory/5072-8-0x0000000000600000-0x0000000000610000-memory.dmp

            memory/5072-7-0x00000000005F0000-0x0000000000600000-memory.dmp

            memory/5072-6-0x00000000005E0000-0x00000000005F0000-memory.dmp

            memory/5072-5-0x00000000005D0000-0x00000000005E0000-memory.dmp

            memory/5072-3-0x00000000005B0000-0x00000000005C0000-memory.dmp

            memory/5072-2-0x00000000005A0000-0x00000000005B0000-memory.dmp

            memory/5072-1-0x0000000000590000-0x00000000005A0000-memory.dmp

            memory/5072-34-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

            memory/5072-35-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

            memory/5072-36-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

            memory/5072-37-0x0000000002AE0000-0x0000000002AF0000-memory.dmp

            memory/5072-38-0x0000000002AF0000-0x0000000002B00000-memory.dmp

            memory/5072-39-0x0000000002B00000-0x0000000002B10000-memory.dmp

            memory/5072-40-0x0000000002B10000-0x0000000002B20000-memory.dmp

            memory/5072-41-0x0000000002B20000-0x0000000002B30000-memory.dmp

            memory/5072-43-0x0000000002B50000-0x0000000002B60000-memory.dmp

            memory/5072-44-0x0000000002B60000-0x0000000002B70000-memory.dmp

            memory/5072-45-0x0000000002B70000-0x0000000002B80000-memory.dmp

            memory/5072-46-0x0000000002B80000-0x0000000002B90000-memory.dmp

            memory/5072-47-0x0000000002B90000-0x0000000002BA0000-memory.dmp

            memory/5072-48-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

            memory/5072-49-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

            memory/5072-50-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

            memory/5072-51-0x0000000002BD0000-0x0000000002BE0000-memory.dmp

            memory/5072-52-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

            memory/5072-53-0x0000000002BF0000-0x0000000002C00000-memory.dmp

            memory/5072-54-0x0000000002C00000-0x0000000002C10000-memory.dmp

            memory/5072-61-0x0000000000400000-0x0000000000419000-memory.dmp