Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 16:14

General

  • Target
    22ffde7443bb0485b7849f416ad1884a_JaffaCakes118.exe
  • Size 712KB
  • Sample240703-tprmnaygpe
  • SHA256 d9a841792f06e80076ad2420ea54709feb8b97d7cd39f91b079acbb89278c868
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • latentbot

C2
  • houssamreckless.zapto.org

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Molebox Virtualization software 2 IoCs

    Detects file using Molebox Virtualization software.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3432
      • C:\Users\Admin\AppData\Local\Temp\22ffde7443bb0485b7849f416ad1884a_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\22ffde7443bb0485b7849f416ad1884a_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2012
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          PID:4668
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:4776
          • C:\Users\Admin\AppData\Local\Temp\22ffde7443bb0485b7849f416ad1884a_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\22ffde7443bb0485b7849f416ad1884a_JaffaCakes118.exe"
            4⤵
            • Executes dropped EXE
            PID:1668
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 580
              5⤵
              • Program crash
              PID:1600
          • C:\Users\Admin\AppData\Local\Temp\SkypeLauncher.exe
            "C:\Users\Admin\AppData\Local\Temp\SkypeLauncher.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:3880
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1668 -ip 1668
      1⤵
        PID:1236

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            22ffde7443bb0485b7849f416ad1884a_JaffaCakes118.exe

            • Path C:\Users\Admin\AppData\Local\Temp\22ffde7443bb0485b7849f416ad1884a_JaffaCakes118.exe
            • Size 712KB
            • SHA256 d9a841792f06e80076ad2420ea54709feb8b97d7cd39f91b079acbb89278c868
            • MD5 SHA1 SHA512 SSDEEP

            SkypeLauncher.exe

            • Path C:\Users\Admin\AppData\Local\Temp\SkypeLauncher.exe
            • Size 676KB
            • SHA256 1a0c482cbd67e119881a34465d87d92f9897cc1f256051a3ae24b0a3b2eab50e
            • MD5 SHA1 SHA512 SSDEEP

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 3f5dacac66fd55093d1198600230acd7e425fddbc3949e2dfb55247f52398d7d
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 905KB
            • SHA256 7d41238519bf9e2146b70d2c77c62da13f5310871d269b16f4752bc345a6d497
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a7c4854fb647d984c34527f785a2784ea762628cebaea7f7ac7ab3c9090af2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ace3cb4542a680bcdff3ca9df62780e2746a4be4378123f023410a0bac52b06d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4023a2c1bca8b0a33d1aded0ee27341dfc451ada48e9af5bb47911320f1581a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd8fa1337c9c3f2598b96a1ec7beae9feead1e36e266b419473ee6f4378bbfdb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cdeee230d10b21070e30028b7c444934ee71279194138cf659f2e22d569cf6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73f949183cfcb14a85f3c279608b812660685d2d165c7ec8be698bf4125cb411
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fadfc5e3f7a420c9a3678f44771aa0ad63341c3f5fcef1d0cf000c060af3c8e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87268c1798f412264cc6693db0e414c9681326ebce7468f949add88413099ef3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02ebf2db764d5f56aad03fdf5b41dc8e0a7724b7173938ad5b68d809dc77e47f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d14dd5c4dd569b17785f07cd2f17a4f3a20318ba76e6f706e24a8f801ce4ce2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c558f5d80c9d5c5361e35cef124db08cb8a52e6d58cfd2f28f543f99b4e1663b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32f09d77d773521c8be71942423f173cda7a3c9ee929529e0f07eb1ee4403b01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2fd591b777f1d44c45d9c2dc4f8f37a381b67716e7237a7e2ea79f58b4cae0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 606f40a7fa958e71a13327d4968e2dbe7ee31a2e02dd0452d1568ddeb071f80b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 144fcdba31a83fde304186a9871968c4b584cff43dcc026702c8c46575e4fe22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95d04ba9daa82031547e5cd1325b5ffc8ffcf05ae7d17ca44ab680b410da67af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1247804d388437b2be9ac52d53bccab1d7421fdded27b16bf7ff375d8652d70c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34381783942202cf5961c6d53abe6eb2cb31a3dd29875a8328f59294333cb5a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8f454e4ed23b3acc3feb35632eac9977622c0ce7a9bda379ec71c2898476901
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51ae059e24b4314df6746d20e29c0ed8239ada86de8aecd28cd6ad24fb44974b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 007125ff47614ce7fd1b8a4135782c9541bfabda84ece3104320f81b55e36a57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 346aa4364007018c8ac9665094f62bf58b98dd8628dbc40f856b6535be9d6282
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e555229491feca771ed4533d2d8295188424e82162d0289bd91df7582823a199
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75dfa40eb1f7fbf50567051580b992885269f36aed2a289af40513550d1b0a40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e1e7d0ae2993a46f0d713312bc6a0c82ec3573e41948ce024103909e170671d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 affdca0d19e46829378e340e58821e8bb96e51e83cb54cc2c09c683e61ee4771
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81e25f8c6e45d77b16afb345ed6149b05adf5316726b51a533566f833c14f885
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 901af9f0828cb4a005ef743b3fff1da56dfddd1462d54851c272685bcda11dc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68a51dc1620e3be7a283d076050e457a8dd53061417a9f45a6f7d8ad12794697
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af9a8f9e63c985c2b23e43db807690a6e3a0776c0356432a6a0e7e788ad00bca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d6bacf6ece5f8932565d21b43b740f87c63ef4a1de85f77a03546782524ef54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b395a790247c5473bd37833e39cadc35997f246f218e37df52c122e9f56667f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 893395c0c292c4f4a0807a56c6d9e7da870326054726222da8090886ecaa98c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4e5ba45c600511418c9bd1d0545b5c015ec9138dc4a666c620d5b6c8e45a68c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12041dc8188558925a612821adbe99f4d28c99da86b31ca45ad8401fbcca1f6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 baab70a9583e9616740c71dba7dff0848723c6d118e31a8e4a176a421373df2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7952e93991bbe2dc10162856619e3b88916dbeb4987b9858a3bea5ffee50661
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a8692437ff36038ef81c3482fb4589b83f2f9724a0724356bda8386eb93fe64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7a1e866806ac0342791f8f5546d64fbd00187dc99ac026c06e99b869de89b0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35ba23a086508d3c9498d972124f8ea407e1d6c55daccbbe32c2c2b5b42c61e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 716156a5c5c2443df5f6717d81ff7afb0f0339aa6b119f2ac338501c8df0e800
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8de75c6e0d96b68e00a4abf56a83ec7e2391afad3f53165cb6fda69a6332fbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71297d8ba762733c813ed2938880def42a3af411e51114af7a8cf68dfee7d2e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 530a28e5b00662e501c0e5c9697b18f97d86f7114cb0ef62ca11d158085ad3b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 620a26e0f78e30f22d2f9609ec72bfe3bdea21889086cd0a41f5c55ed2cfb46a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5520094fcf7c94a747fc8a199d14127c69acd86336c86e99dbc4685510477e8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8602e6d40d170aa65a5a6778445600f35c0b06944fa53fcf8931498152abd729
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2e8edfca8c32ab0520188f94931aa914ce449897b23ff50e0b773572a7ec405
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e743119d63e8b9ca6a33406699a6fce69d40df75dbf45d1ba82ced9d5585ced
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84ff22e5824712a549c7b3f7a5ed4058f35f90f2773a44da7a2e9ef47e70e887
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e59bf07ab44da57263798021f016031f89833be175873ce8cb8fe0abaaf699b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fead76a3e807b22e479d15b2c39fc11a88ad8237e315b04e66d18d8e0158757
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69c292692c814fd0f189061bdc367fa1c102a1fb2bbd0a47af2b356bdcfb1df9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 440ce3f13e42a7e756de0ca9f4771df422b748446a29d53ef6aa718c6619ef44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5f8857d5cb83a120494702ea6bdee8ca88e5e20f67ecc37c669cae74ac35c0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99367d42d7ebb66cf9ba459ad8cc6a8a67dd2fc050f1cfa96539ab74ffecb369
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 747c537e1080c7b37b26fce9ebbba4e4e6b390a808a92ff91dd92b3718fd2ff4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 434a9bd778a7756a2203ee8c030629688fd0ffb28c837bb4e761548282350197
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 354d587c3c26dfeff6f0529ce5a9bc4e419ee21f38cacb409f8b06fe3e494fab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d35ddd551c23282c83c518e9971fdaf1673c20f196360699972f2db6894f335a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5804560ab81e9c4711f93c334b55521765c185ccd89574e223b8b8200b673640
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 281ed51ff35e2cebc81846aab0cea559f1c1442b20f59717c9b8f45289fb0d8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19b63b29300d3adda97b04a25800e80c9290c8fee8fda78c46cee7c8ddb77d05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8e6848802ed9ad78616a980596e08134d5082913bc8eb9373931d88e404c36c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccbb4f44dd438f495c6219a5a95fe6ef3526cfbec5ca9057f8f92571379c8a10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7116b46ba2a075a24c42ebbc495c67de53a57579ae2554233e40bd11bc2ed68
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 579d1ba06bf5e339c7780e1a8c1cbfdbb9fc49f93977452503719732a7a56ea4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5941acc955de9190f14dd6728db469d351a3bf15fc709640472a1f04b5ecf9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e2185543fe34e192077467ac8db36036da8cb1c014384e5ac519b505f266cd2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f63547a0a1b562c0d0a3c811887692dda336894bd322850f9b07b4e82d6f879
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b7ef0026426f284da16bbf3309222bb9fe7c163e7d30e7ae4f0c593f9a50b61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 258c7df1337fd23caf516a4961c79f395ed1b36173c694226df93477e79fd716
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1108539e8c3e3cd9e2c4e13d29d35b19dd097c59d212c90e8ef44a09c16a867a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35e87eba97f2d0187dee5959ccbca07f2b45c1884e2d936d263f179763133716
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a23849c79dee1df84b5635a53293463f25708c9c1e231dd1389a9cc8e27a2c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3868bf0ec447d6cd925b907c3b505271b34cff2c97fd4c037ff65c3549725af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd78951252a69eedabbda109abd541338b3d4569074e4ceec803d947f7ccb07c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0320edc0121a045bdb5c42b246fe831bd53e577498be1d4f7fd3d787af24fd48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3805187194cf1c64b959c97fc03b1433b11ed01507e230fe5bf429eb6160f80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 824654c3c978f81bffc34280b9dc1dfc51bcbd1be6f14bcd647b54af51fe5493
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69298349527df421f3084a81d471aa28dde4fa5998d94a3e29ff3d8f5bd225ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6512ee1cf405681c5db21f240eac6bea0457eaf54d6e0775186589ccbcb5854
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c55d6591fc74f674f803d194eddaca96a945472ccdc0e7af9022210bea1104c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c2145ca1e928036203266452857ed739c21431d996215f8a4356f397db9d011
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e555d52857b14c4ea4fe3ea38bda8353b4b70a33b41c0877b036da9c6cbc1250
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c26f0c77dc8ef192aa25c2ed1b5741c5e1e8f76b98c58c92a4bf9736f41a3de0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1a5edfc390c27c1f6006084cd1f2d84f4d35c0aa59f0499bc01ff96068fe916
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e2dc578a29235e9b940968d13ce632304a14b71447cf8687a90918cef8ca2fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13b6d4cf5f9161348477cbf339ea411bfbcc1a8da9614cfbc9c25b46defbd31f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a851b292f3b4dbaa5b32e50f5cd4f9e195eaf71c55f030ad54028d9ddf269abf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a494a173d17434e50e2456fa8209fc47f6bbda12e8594114e743319f967ed2f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70afa696b392e4e3a9003859bc46bab7cc4b1052b8938960ac896bba40cdbbaa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfa27a023bfdbbcb548abab99d71171117afd33e770808640de3d66d450b2a23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7dc12b01c617215a1d62ca47dccbb7b0f9817f93a1e214c8d24e27c724613bcd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f08baab3dbf2acc317c27080d768268c057f2182b6d0b060ab62b8c5de4e98c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec864ed52fb98b219ee49807b79fc0cc56e2afebc4d688bb67e261ed246053dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bc1dcfe985e13efb9b270342d94633e04b17cafad866e74f55f58264511668d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8301e9feee01a8a59cc945beaf015475c41688ff990c5d1daaea79790cce27f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d917ec093b3363ca3cc186dccb7d6b1472fcd31fe7a0da38d351f4d426a2aecd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f1e09314b8f7c6d084b00d2832a57710ac4c6cc7e2552bf751d22df59a41cdd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 baf230824c3246b5379b5694c2d7acf1e53418383a3e0fb9f47428a28781ee5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e12a0f5a0f6558986b08371690f92a87f998a3cd602bea41f50b3dc7594cd0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7c373a8391e4034332d284a9b27a6018bb5547c189f376fb132994f1fe1bdb6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f6773e2aad304c0cbcbe94b4b1e350e044645e22d0f792328ac6c993af4e6da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44b57541ea694e8bb64e98b6dfa7076b8a0697a1be8a455893d12772e79c6c46
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34199b0a1b83a43ad72ff0d253e15ed6e173a2f0bb20572b895e364a3b860116
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4f19ca0ac1286abb15ffa9e67d8612109eafa1c39cb86ee1237a52f85f192ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f09cfbfacab5971599bd93f1ffdc1b2fe80f04ce37ae1ea1a66e15ef687c9645
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38a0da207c922e76244db8286b443cdd1c90a8abf0dd42ee81ac484b2f7fc71e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff422e6ff08e91f4395fed26294b94797a57c8af9c633c0e010df5dd9f5337e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ce79a5d30265011fdc6e8edb180ddc49b9c57c03aac72f0bdba3dad51488334
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b284221ba91fc911c2587e55ab0ad2c0f129ffbe764778f8cb711d241c651a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc6fe060cc837f89b5fe65cca8dae45af76044024fa62d2a64631aed53968719
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc808de3150b41e4b86c392aa113f73c68ef9cd9bc303118bb8013a64829a3a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 670f79ccb676e066a721a7547d5ea0230dd222e47e134d5626337f16fa8b8e7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d7dcfcf8d31b806e575e7215e21d0e259831528c42eb66675542d3682dd8c25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 299611c025c2d8cd9370b807140e86aadff86866db934fa126bf9cb2eeccb474
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 efcd7d32c7a1ad9868a2ffcd4f7d3bf2ff2bda255556c9429617bd62b0a0ae50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fead14d99150ba9437003ff0b642f159414b70e1ea2d5961c17a99f71ec31c41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 540d9d43792659143c01cf7ce31857ed7252e9dab3ef4b936581bce47ee2860d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c1caaac2560154d895c6722024948c15890e61d72c7174b1a960f4793d3a51f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a64c6d498afa0ae502a0eb36741e4cb7870d3762d6a2b8995dcff2d9b8d5a52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f476a9c48c7d50d5e993622f4b2c9505364bffb022292f3c62267cb2fab4d037
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f309ad72042d3610fce2da8b83c5c28d763a59e7ed58da8520f3a0a08fd509c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bca5e6beda4845d6531936d71fb2b7abc2c07f80330151ae623ee53f76d8deeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76603056b7e12ec63c89b14236678f5828152f51a93c18c8afbd0bb8b93fd764
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d849243d845aedadbfe7ba7d7db1afedff3bca1806dc0a2118604cf67ae1f371
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b71e055703349420c7e20b813faf46e825c9f6c713535d2581d5e92189b36c02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b139d2c05093d1554a2acc921b3a531d3df9219916aeb801784b0984df24c8c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02128949361927b7273cc712f2b705997793dd50e429eb630eeb8befcba7fad3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1493c7e1ca91452f56253790912965f9fbee71e8a240ecd9633599367d05279
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d626c0670e04808b69936abee931e3297da0b9d86b805de4c82e3e34acb89a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f92f477bfda7e4ff128eaaabf03566e52d20cd93a9893d05296c7d63381cebd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a15b90409f14164e6a833d928466a8f86f57f7d9cb565b7018555b2fb01f3fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b47b2b2e186f6c57f7501c866425731c970f912e8f98ed70c7f2d1d4389ad3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c34b56782638efb91937691e39bd25451763b8236cfdc7fc7bdbc8fa175212c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ce9a608e994c117f0a207e394414890a8480c2c182ac4da6051cecd8bacd1fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b5ecc2b0baaee0524e16426afd7e7a6f222db6466bbec20aa769ebd157d0754
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            memory/2012-1-0x0000000002210000-0x000000000224D000-memory.dmp

            memory/2012-6-0x00000000022A0000-0x00000000022B0000-memory.dmp

            memory/2012-142-0x0000000002210000-0x000000000224D000-memory.dmp

            memory/2012-73-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2012-16-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2012-0-0x00000000005F0000-0x00000000005F1000-memory.dmp

            memory/2012-2-0x0000000000400000-0x0000000000590000-memory.dmp

            memory/2012-15-0x0000000076EC0000-0x0000000076FB0000-memory.dmp

            memory/2012-13-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2012-9-0x0000000076EC0000-0x0000000076FB0000-memory.dmp

            memory/2012-3-0x0000000002300000-0x0000000002310000-memory.dmp

            memory/2012-4-0x0000000077352000-0x0000000077353000-memory.dmp

            memory/2012-5-0x0000000002380000-0x0000000002390000-memory.dmp

            memory/2012-143-0x0000000076EC0000-0x0000000076FB0000-memory.dmp

            memory/2012-7-0x0000000076EE0000-0x0000000076EE1000-memory.dmp

            memory/2012-8-0x0000000076EC0000-0x0000000076FB0000-memory.dmp

            memory/4668-17-0x0000000000F50000-0x0000000000F51000-memory.dmp

            memory/4668-18-0x0000000001210000-0x0000000001211000-memory.dmp