Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 10:47

General

  • Target
    30112f914c53d769073aa862c7737dce_JaffaCakes118.exe
  • Size 251KB
  • Sample240709-mv271ssckd
  • SHA256 dbb35eb778ded51a149e5516f4e9dad32562420785df90b24d9b5e2765ae86a8
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • 127.0.0.1:90

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3436
      • C:\Users\Admin\AppData\Local\Temp\30112f914c53d769073aa862c7737dce_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\30112f914c53d769073aa862c7737dce_JaffaCakes118.exe"
        2⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4880
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          PID:3876
        • C:\Users\Admin\AppData\Local\Temp\30112f914c53d769073aa862c7737dce_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\30112f914c53d769073aa862c7737dce_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:4088
          • C:\Users\Admin\AppData\Local\Temp\30112f914c53d769073aa862c7737dce_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\30112f914c53d769073aa862c7737dce_JaffaCakes118.exe"
            4⤵
              PID:5040
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 528
                5⤵
                • Program crash
                PID:2596
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5040 -ip 5040
        1⤵
          PID:3860

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 cd50745ce37f7c7af00ab641586d2cda5375c11d21ea68cd62eae7a029209689
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 230KB
              • SHA256 44f261ca98db37b19394be4f42725526d1de574c91730088d666dc43d2f6e340
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9263f9c6de37050c8323c0bca2cae9bcb3a197dc2356786bfa47c14d761f69b7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e391ec2a2c07bbab0e980134a80514a112a8339c577c56f450eabea493d316a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6314b3edb4ab8a6431f2529adcc57f829ec255523f9dce4dae9d3d662d2bcf29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c0050bdf8e9be9228be12b2b8d172d651d2eb276bada7351b35fa1a28fb862dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bce71da9a2d8cfb6d0f59a32da34745304a59a2ddb7cd0276c2ead31ff815800
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f68a42953dd5ff022ad958301a0b91973a50ab986b0402acf258a82a9b554c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 21285ee31b3cebaf23c1775fdfbc33bb30d7d77954f6c04237c5a9e4a815a50b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c797f3672558553a2f02049bf8b4038e7e0de0102ce8f64fd5f87be890067ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0717add67d40a32c62c995cc0d2a01d56ba21389ac6b3f2810beab3e3487df73
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d2c892e47d3db99943ebf4d2dea9a47e6cddb4807b23387bc997bb776384c7b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0862b8084f5d52fe08a400dfa782d0045bb7489464799ebf297f84b52a1d4c9b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10e21004ad7a9ba1f576340e638565c3e16eeacaf901c982c1e812ad7469a368
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 955f35399e7f02232c63daefaad5b4a787e74a3dfde9699af1e43f6204a7dd51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d11727570e0e632e31e34eed7221e322766818da3848c2b775f86939374b4c95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d1f415108ed97f9331cadddc430aac9dba4ad165fde657bc618b579a880eebe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 19f3136f86c00dcd7431ba21025ced641aa9ccd5c33e53dfa43074dd5cd3e449
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a50714cbec4e4795b86e47ed2135dfc9904b5109dd9edfedf3e84333b9727f51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1bce99c48e6fea39ea42629f87c9a8953078c44332570622e5249d3133d9bb3b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 707380c6ec410e4504c8a7314bc7d214fb97780cc38f5503c0f5a15c081747a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f574f3f5ef25cc4edd8163af2f395ec54c488d53e192d3ddfb3783f3fb56ee5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a00743a062f22fb25f4531ec7c8fbc821b0d0b34a4e7dc5236cfd0dae011bfb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f4ad03b6152e408de6f1debb2b78f4d39ff00b0f16f647dbb709d3832c6ce35
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9551e23a838ad739c079c442706052b7173d42f71a734c036947e07d79c34a05
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe8c35aedf981d8e63d9a01ba762ca1ee8e19df5169c9d3728039a277cf600f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36508f19f9a718f601af868379e937706d539de2a6ec03b2f8f7dce4956fdb06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0afb44163a931fafdb54c89f1a61bea8a537f9383a455a8bf92c8b401dd3067
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 586f36b33de76804c6cf2386c9cc6843c2af6b28944948c13f85a00d44a28dc7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3abdd2eec1ce34b078604ab686415d720d7ca7ddd797e66bc3d211fd0f6806cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab9b38b353fe1381ab1c8b1c23a4ccd7698388afb7bfde85b3bf6d3d27d48886
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8d6c7e2683faf541d294c1e9d0bad8f3d3582fd87985ee6bfd37962814a9692
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b73ffc7c1f268c316315babbed9dc11fa9aaa2047b4072d8a98334ae883b7537
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40c4a166ecdb1d4b70ef96664d85c883ec6c2ea3421d76db0deec063fc5b32ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2aa16ad02eac25f620f3c966f708f604e58d1f8d79c254797150373b1fea7e2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94e2de576652521c1314e71dd24f457587a2539d884bc2855a840373c070374f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fcf33b3e42b0133c4ce6ffd55607289c237c19e2decc7d92f0f5184cd1655924
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77309100083ca69754e8775b2c905b5cfacc8db29ef944afede1b2b4bc1f0050
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b838bf8266cc5ac1aee7da6aed8b0e1e09fae4816211716f6df2b089203747d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57f3fabfa97f7ddf606443e9fbb0ac7de51d4cb0c8bd51007a92d2f6b5820ac7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfa5fa07072fd50da2b2f0bec6e60f2987fc46675c682b1ab1157284593b47e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4fe1b9a9064c23faeae59c6e774bd39cbf3820a40c1e5808386c1ad9f9056fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 440a55c500082e573225da6831614e249f5326eec9540746eea3ad886d16c4af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2067d40e713e99052d961d7ded8d25d496e144dd12c5599aa9aab50d1a726986
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6866fc04be69fd3c9c3ff8b01a1dfcf29e9b22b4f272f8bbc8a42e33a8b2e96b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ad04e7a629160f89b3f2408bbf7ab0277feb961cefe0d6ff14d0fac8041c3f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 235fcaaa8e71afcf27fc687c7f139095bd62a74493089e5bda0a4ba8f92372ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6fa9d5c5a686f6a4a53bf03de4f6a44ec653b9d654d10b04a2620395ca8996e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc26983914da6f55de1e5468d72b7e0e285971a53b6973a440a0b393aad15839
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b9e4f93b170160a390e51196bdf8207086501ed1cae3c665b212048fd3680e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 470744b4ece46dcf730132dcacd3bf082c81d0a79c10deb6fdb1e1aa2b46b178
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 377e6b26d591a503a011bd22e6998ddb3754d1a720861b596ac0bb4c0ef78711
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba62da80aaef3abe3b3c9e277b11d90469197c4139a2b1f02b96d7798fd5d670
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b28b5e0ae4789b4b0991fd2a979d4830dca58fae1f66cb49d9e79df85b2657fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd8b9e3e6faf0f21c41e9ba217d2fe6a01811495c40506255c9c03e90f4e523c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57fc79c8f04b7898ad15a5257cceab9a9dcd94d93670f6e3569eb1e1f0c28bc9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ccdc18cb0164910168cf696b028afd5355bfc4e0d37125b7a76629d66a0c21c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 47798c5c1bbde194d5c61b6ad186cb525c75bd0a23a656598269724d8f3bd717
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a24796bb2d8ebfbdc194a4ce75cd3c25c9260dd7fedbbe5f414634dfb7024d85
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2fa49154dbeca204e359abe2fd85e7c8bd34b43e8c48468cbd252aa92b5692b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5dd3463c29a8157cf08803799f0abb654d39bea1da9b4a6ed6ae63b5e8b8c03
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa4801a7b38c96d2edd01539c94822cc6d696250330545f578ce56770999eb6a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94d49756955d9270553d7195161599f67031a3a2524ea830a63b606e9344ee4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 328eed2f283bb8bc21532ea95080a6d8ea19ca22b3e18c6914960d4dfc75d607
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b95cab2932a243eeb0f1ce96cd3d392d7513a288e3d0718d7567b26687ee7597
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb2b3b764c4457da88bf35a95eea13df844734b056efb9c4167e94273d47481a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71e88691614d12a6e17f6b2bba29d9277fa74082e6ab920414ea89bf1d350ce2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36d6e0c5412f5787374c4220bcd3e9557d38a0dc7241d3722a75a48f6d8eb79e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 877eddc1f1d904a082c725cea42329d421efa6e9267525b9dcac532d8d6a3c24
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 18bd3c22ffcd83e0c68b970df1dab98c6d8aca2e23006777cecf6a0faeb38fb9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 865a7fb54cee1f270dca0df41071f21eeeeab4f9e374bc21a3de81aad7204fe6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ccb6eb1338994b6233dc5019bc82cbe7fd078000ce83d4fd682397dacf0d2998
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0041fc34864914ab4917e73cc39fc3410298743b5b4e75995cc836dfeebef1bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be067fd966d2b86098b7d90956cfc1eb84df67d1192043c7cdff6829b268397d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50fc7db094576ee108447b1f9e356191a98e406aa37087acd393aaaa031da361
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c797fd10ae13a06c0690a52e855d23e708fccaa604f639e1765a7429b38e874
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09df0a859c875ea02b6e7b77f81e4d5c12907dbc64e63ba7ee9b5bf013112b5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b52f098b7064f0dadc5166d5545defd0b68c1f86b86fa5a43ef539d40e5dc53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7a66cd8cabba4e3813aaad03e16f707e3634c34f0b857b8fefdfef258c7fed2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c88bf76d99ddd0e3c71381518b3bcf4203a02959edfaf929f9600707fcf7d038
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ece5fcee8946a9a99765055713e0801f0c5b06f0c944a63d62d0eb33f78d418
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94414410bc9a2749337b657a3b843278ad9ba38b3efea73778403fcf02b89e4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5a166e972bee5dee8cd91f2a9a7b885965dd7261c6eb939b6bb74a46f4fad85
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4a1eca70fff2a7c3453e7a139668f219c07fd476893f476192975fb57d09096
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5dc37e648939c1d913db569d85a4fa9650fabb7adc6f99ee7b86a7a35faa219
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 45476b8abb0ce04add9574fb4aaa5a9a54119490a513017b8b5fe785371bbc03
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc1002a3411fb4950819592422cf96f7412652fc2163b838c30a02d3102d8f77
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed2e5f7ae88e30b3732570f0875aeb59252adb866260adbb825238c56a5e20c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a8e93ecc51482f4f3841e5fba0409d73716a099d5c43edc4b5069caf2a37866
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ad340974b5f42cc0a3db4862d646bdc80fbb78f379d5c13d2dbb3d5a488d1bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 274ad0f5b4394e5a20e8e66d6b04ba3ca4bb411392e969edc4ff0a2ef36475f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41527b9d1dc9210e4f3cb11ecdc11cb492daf57c6332638d1cb08118ad89dcab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ee2c39865d322fdcfcb79febe4be0dde1d5e1e8e04e3f6e695b4677d36f4c2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ceeef1a8fac56d0ffca99eea8b98a835933d6b67e3a2da4442e51764f8419a0f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01efc65ffb0362e367e3a74ce097e6c8e8e61ff0c1c6d06bc608d3c9ab45d9a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2b10ac3939d4530a90604766aaa15c629e1afe5cebe99be504cce5c75f1658f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3dc57169d5bf18e3c2943b463a0431909161861ad6ad97b66795f53cd025e025
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ff9726d54b73870f9bf5a656f4bda6cabe81362c36d3d2ba61f7f021f6f0c9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 95fb326ab9ad7b03f190870b72cb4092fe9b6f55b6049b13fd0826759e3c19bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8679ebc571c00afc779e8e92a06b2712c9f45bfd6a87eced66bd77dd2fbd334
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bee91c16869abc0d3e07a7721fb6e7225854d78b9e0c55649ed697a4fde0c553
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2941bae5394ba936519432c41fc13de2e3e272f6c6af66ccc291252f5ad5b74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4426ac4b0eb6927d978ae69be5c91405906e2a853bfbb47f9e0901f82c6e9b50
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 47f355a2ae25ff171288765593c5c75d3e4cdde5e092f7afda37fbb624758669
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7fb3b38e8fc9047970066bbb6dfac47263aefbf8d60df4bec8775cf6dd65ba7c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57e96d2590813d1c51e5b1ea81b5c3ace79df71d66ca96ffc6616273e7483acd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f34bf6d83e5125336e14a5fa665832b59e5678459d4ce8ce4a548c27de897fc6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8011f558b6981b5eeb993701a16aaf1c615f60f6fda8482c1981059b60307c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 283f5348bf517acb32afab153a98a266c4cfc9b3d909a3f0bbfd05215175bc69
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d673b5960dc0a1e756c4d4a817bd494bb586c53fbc66578ed603abb5e8d7aa6c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 adeba6b3474172ef5be2350f7b57c7d336b43de1f90096a602f1a157b7770635
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4706655e575a8c64e2a4c0441223bf5af85eead587a81ba40096ace60c52eda6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 885d1a3b94a9040df108bad46da2c8ebe2037058d3076a70eb74d7dfe55f60fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ff0e3a39c69ccf379871ce163778953a74b679861356c350029a5963f07228c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8dc6510f7014d76478110a14627088ede920678c3565173511248d289e99f2c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f3360479680e9b4b051f79a4507ef34cd1796637629382a4c717c2c36e21df2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d730a87ffcd0572965cca8538de2f5be161c9d0d26e6a0193459e32d404bad2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3dc1ac6ea9ed7df8e6c13c9aef513fbd37e927e1d5e60e3f699409bbb23f5fce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd4489d97ca9d4520022fff723bf3166795bc82a745e940b96e651b8515a1c66
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0966269e9fe01b738fc08db3395ff8211618e5ce071cb3134f473476f83c7605
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c1c5572740a9d9e6fda3ed8925ef71d5499706585b92180bd50c61f78f7600d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7877e99efdf2d5f1b80ad7db1aa9620a0a32c2173cff70ffed673f747f9425ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a358fb296531aefcba309ca7392329e96765f3240ca4a5a01d18b2440e5671ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bbaa8339187835d150d73ea35933a7c7141a3f05a7c1b2f5f227febe20640283
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43f8918b91e8998c5379fd0b4d1fa323f6bf0bb7609ee40ffe842b1ce032422c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02161f62811ef4ab0795fde61059f1fa6eff0053448cef2a17da87a8d5062ec5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b706da424e911a9044ba30b60b7f22b951e8afadf5011cccbbeb19e136e882a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59489250ef14840c0b154d6ad27dcb5a2828003850e29521d3d26b4c0ce673b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b4612ab91fbbb9f13539862a3552b3b6ea482aed276fca90d40424edcc84811
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5037b89dd7c066d61e34ff6173df8d02f333845ba2c02c27f2da0b7275d17d36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 615dca4ebe083f807d391be34b63a994cad8da47a732dfbcbe647c97a39802b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ed260ea6a1ab10890ba8b28c5244b1f1271087396370c09a198f5b1c84461a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b24f7566662522c0feb2a538fd2afff743baed304a6c14e66b84131264839c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb54673e48961f410b15a0359d271f8ec4eea9419a84a7f1f8c7061e2b7cf181
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2b7133f1c63d5779f722019ca6b082bfa4ea8249dcf088efa26b484b29c9947
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 00b3cb893e107792afc8ec158dccb2bd2d7d2437b433179ce1ef28cc0e57969e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8eed00fe0beb38826696d7938181a027be6f2ba4e764683af527b314ef212ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fdb45ac5fecd40c96b15f348138a1f530bfc00300badf1bb38c4c025461f27c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee53c24f16c2651fd8b26488c1e95b2ab3197517559db7b7f820d20e7b21e16b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e393788fd264f4326278205cf0197ac6e2a116b86e70e33a2cd31b8500b805c
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              memory/3876-348-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3876-9-0x0000000001270000-0x0000000001271000-memory.dmp

              memory/3876-67-0x0000000003D60000-0x0000000003D61000-memory.dmp

              memory/3876-8-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

              memory/3876-69-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4088-1256-0x00000000240F0000-0x0000000024152000-memory.dmp

              memory/4088-577-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/4088-136-0x00000000240F0000-0x0000000024152000-memory.dmp

              memory/4880-135-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/4880-4-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/4880-1-0x0000000000590000-0x0000000000593000-memory.dmp

              memory/4880-0-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/4880-3-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/4880-65-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4880-85-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/5040-158-0x0000000000400000-0x0000000000450000-memory.dmp