Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 16:49

General

  • Target
    3590faa8f9ecc0481db758577eaff70e_JaffaCakes118.exe
  • Size 14.5MB
  • Sample240710-vb7mds1ejh
  • SHA256 20e7499ead2b94486190fa8ce00c5874ef0e87f8c3b9fb57d902f213e5c81eb6
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • retal.zapto.org:82

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_file

    updete.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 22 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3456
      • C:\Users\Admin\AppData\Local\Temp\3590faa8f9ecc0481db758577eaff70e_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\3590faa8f9ecc0481db758577eaff70e_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2976
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          PID:2760
        • C:\Users\Admin\AppData\Local\Temp\3590faa8f9ecc0481db758577eaff70e_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\3590faa8f9ecc0481db758577eaff70e_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:756
          • C:\Program Files\VideoLAN\VLC\vlc.exe
            "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\pervert sexy masseuse bangs hottie + Amateur Videos poran - Extremetube.com.mp4"
            4⤵
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:4864
          • C:\Users\Admin\AppData\Local\Temp\3590faa8f9ecc0481db758577eaff70e_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\3590faa8f9ecc0481db758577eaff70e_JaffaCakes118.exe"
            4⤵
              PID:2280
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 576
                5⤵
                • Program crash
                PID:1696
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2280 -ip 2280
        1⤵
          PID:2052
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x2ec 0x4e0
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1124

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              3590faa8f9ecc0481db758577eaff70e_JaffaCakes118.exe-up.txt

              • Path C:\Users\Admin\AppData\Local\Temp\3590faa8f9ecc0481db758577eaff70e_JaffaCakes118.exe-up.txt
              • Size 484B
              • SHA256 42d6c732c48f290d35d48170ab642a477e02ac83234cdea1c62a8211aae4e99f
              • MD5 SHA1 SHA512

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 fa2a7a20678acc573df599a3a5f608543b66fddac8f66f6e508564959f5b1c9c
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 14.9MB
              • SHA256 24b9a8b4cc773eb0997a743ee88630b03563631afe6f409ec042530fd544fce4
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b6886c6a3c9f3d7aaf3ca04a1049490c5d8408832dcea686d4d0e600bd4a49f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c3fdbbe53d5ed5ee1c698e8398f9a2745b9bf9cb3b663504ec54f42eda82883
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67dab9125c44dad2e7f0b5acb8d0c1b91895c3a688f044247aec564007797c53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a1eef4c5d37a2c8d482a19675d71ace3f5df16d4102d2502174e64ead74fc61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ccee97a88f113112bf9274ce2359560a4ea268eb6be903cb72563d2d9af1a782
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f15e6a5dfc7cdb51d4e832967c8e71b60214962b3efb66705f27e93cf3e9811
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c854f133ec418d08e765f823286ecd0a18922f494f705d709626940c3b96c30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e675a091d466cb262a1666c28a6b11b94a81503fc08c3b460144fcc50ff1807
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 49246106681b07d36801eb81af49b3ae26d8f6823edd99f18f5f0b89706da041
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f90a6462ab7ec3d399f5b6d4a7bc151e59cf172b66e1a5a61b77e6b2e5fc743d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9c9aa8e71745aac675beaa38c2f0e050ab88e408cdcd6f1577f5ac0f2a56a32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ff8b8aa781369445b023a49f1ecf1d3998deed6b3b718783be150ecfbcdf6f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c9395c78eecdc4ba3fdeb6547e1d4baf6aca6093b1a408cb7c91d7d1b31cf9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c15f9a00ff699e7c7e976555c219c0d7956f468cf6b4579a98af9c08ca295284
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2c4627c7e915817dbd9edc84d47d8658bf62804e8478cc45b3dc88f71379a32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78842aeea10ad6979ab976751ac7b081f97bb74ea9dee4909ac6b905f46f4ac2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c3a680f4b84a6cfd6e794f2b2e178ba81d271562cf376bf5ed5b844eca5f052
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b3c0861407100241b2b6acd34780d600c73c1f1a7872fcc6981d5080afba9eee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d7850e2d9d807d93cb0d9e8523ce7b83491e2d264d86734a4a5acdd95de29fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8c3282cbc3212c591ba80f486553b18500bd21d9c15f274c07891f6ec9ed960
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 330a72dab58ebfbab63adc4eb891aac81ea40b393da67e9110017a1bdac845aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce1f2d807297322b7039a7cb36c50004b400c30908a03ed7b83cba82704aa52b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b828bb16d7dc94099b0acb4f27561bc4f357c941c1673ca5714497edce0ef34
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f3ec18e9d9b0b0bbf91d25d67a6e517f0a41487f90dfd2db8ec4e8ac605b74d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46ad28fc85b9c6f5fb75302522deefaea360f90b05c5edfba9c83ac2f12ed4d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2983a385c21550d68eb65d66f879871602dd000b83ca086beb33a4364e885f2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 abbc25c8905e212347d9af9199ff39eb3a942227723f13061200004884feb819
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d69306670cae2ebc440e38e935c95cc89afcb2ca07283678b2fb88d82e34e181
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6be52d8f420033e7f847ca53d0f73f9bb5ff5b85712e5a66cb1ca84b5eff4db4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d5f050212c4cb8f64da58c4ce76bb1f75ad2bcbd95d732e820ba1fc463dc0da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42219abe4f45f750bf12ec8ea570c9206cb9fcfecc2c8e49a6a10153b0cc4e9d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 341822cc7f3c9f60c8726f06ec2a120e021c877a8eaf6aa65e511f8b526dac5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97b3f54968803c463e92327262c2f9a1ef023864cfd5eb104d9ce8fb86d674e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85a43062db96e5c2aac0d6a017d35030e99895042076d879973497ffb3c29c0e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6bd3235b138860984358dc0dc9f0ec1f9cbfd3867fb2298eaf31e9be2127234d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4d80aeb603baee836abd88a4782be6f0c1d10dcaa50a94b01a2538b677c25b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c8023edb8589e6002d6048ff952a096b85829c6e7532bf31e9bd180608b1f23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b82da6fb01f6146fb9a496a7ee671e1dacd6703fe9448570cfdde40f8a90b499
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 475ed7488c62b16b0f59ea183eea122ac5bafa42ba82803d7ab279ce3ef5410a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a037b8cbf80708e4e4a7f49443de45451597a1bdac6bf17c28bc8d88ee18cbcf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c3498dc5a8d03a011e1cbd3b98e926e677f618ae10aad7d57a54dffb3f88e21f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8639ffa38db20422898a03a639256174ed906f44e4d5040f88983ec0d0c7797
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7bdfda42a717fc73e1bb086ee2fa3d52062e7c139ee61078276bfe4635a16078
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 986df286cec4cb960fded491b408ebc862f738f9d0ccda27300e10e5ca14806d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8048b726c75ade6f69d905cdad5264fe1500b3eba1eee885ed2e7fb288e82af1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5160ed6166830ddfde9e72c47672ccbd9fc061ce23bf174dc4b6f44f9630d16c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5194fbd537cbea82c4752de309f854d0c875281cc0a53f9c0fcd0372229cf96d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8437d6af19f8cd566e72e8733d69d2279f157180e8e9560b8ff7379fc48a07a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92df3929aee3dc254318b91f94779ed3fc57f8e240fd461e58bc2d9bfee83847
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ca1a7407a5ae05f8d7a9a77de87969551677f7f21bc8e7991dc443e949ca6be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a6dbbcfc16753ce01daa323ffa12622083a3cce8b8ab29a7ebca478de462a54
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c136220a5e45decf25b983654eaa91885e8e1f62820fd201d1a9f19e03fb2a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3409627a529b4e7e6099179c6e17da71452847d969daef7d45503a9a4efe2987
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 182519af9cb8bbf260cde50734f3b9bb43d1904f83338f3effe92b006b9d39db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cefad20dd6fe51db6613fbeb155ab011f07b0615e23e8877d9d3e019d6a09b52
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cbd7cab169b63f6c5911a3b9949d2ffaff8280cadee906ea04e55d1575510240
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92cefbf0a69fdf0e6eb704e0c3c5f95d15549e0e90c793efbc35b0d7639c2002
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31cb9da9573112efc42881bdb799f0ceea5cccc3fa1354f3a36ee3483d5c7623
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28f9be926b88a0c1c53e57899e5d43c7218047cbeb37b175c992a93658073a90
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b8180ae5ff64c5a8e41d835d79af434449905b72df254fab2d90a54d24e6cbf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8428abb916a3d65da716de1b9249f6d3d5fb007ada5fc12df1ef31585282e55f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b9a9cbc047f97cf1a76f3cc08d84b0a4c0970542136b40353bf31e6359a665a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2e862b7b72cf5f732b13185704c468738419ed235ef7731dea1d11a9af707998
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d0810896d25efe97d6acc012e869bb1dab6d317342cd135ffae4865f794e6fb6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f10d5c9e7ef7770b672265c38c196ec1a20071f6e6adc9d36e2934809e98302
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cbe9eb0a8df22ca7e6e16f390e9a14f15b389b2a4921e12db2bf7188088d35fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56bde16adfcc54f579673b10991edf871558a39ceb9fa2c76e94ae7c0e8dd92e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a35dcbd55c2185bb0b55e83f7b7fdfeea479555743e5490a58f6e056a48053ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ae6e916d7521d266aa7183c82ae75963d9ed16ea3a8d9ae700cc121fbf403c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f09cdfcb4e9133d36e06f95b7c0266b3d3c6dc7e92170ba5d31f678c3ae3cc2d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 95c55b29e12e2361002988120fc0766d71ed4814049218e1af7667c4ef05f0a6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c924a858f9c60e964fad73497a292705ccf5957c94d472afdf2497a8c0f62035
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a1bafa91aa4fcc8a63b9088c8ad2c386ebd96795599d735f067be6f75530949
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 617fc6fbc793c779fc2e7f69f926c71ef9885c10c1fdc8c55f617b0a67ca7c62
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc0f0eb73d02c91aa5ab2ce0a561a8ff81d7ca208428e1d23d5236a488482586
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a204a9e34d3d1d50aaa57b25455054e633e3c099b8b9712b623a1a19e6492093
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ff12fa50c2218d9aa1006d8e73cf75543488b8137d99cfca50a2afac4a44090
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb3c4dc9cbc4d237c65d8f1aa79a495262ef4ae20f7777401f929bc88c2acf57
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 833d359ffd424d94af02d60de18579129cf476bbec9586369fad116acdaabd6b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df8317305e65840e1f461d929015ddd5e9861b7aeeab99d152c244d1a7c97f7d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f24638181e5640453919457228ec856d6a113db2701a412959e052caae050dc3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f93456bd04a184fb5734bf3a4333ec1ef16fc5d42a9cb642d109820dab46acb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb39ca35576513d1b4ec84a253cbf930bca7090c62c9ed92fddc4d6ba8b11281
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4314c5406ad026fc842d947fe3f05340081426e593d79437c2e1170eec9257ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54eeb8a7b03a9dc0914739049fd0a02133da9a3e460955b207079b99d50c0626
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4e6f08ad00fbbf1362a7ea38127069cd4bdf23daf98e8900c77dfd166a3c2a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6460552744614b0333d929e772b1758b99c1052b4039fdb4dc2095c8462fb43
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2df66ad5c2cfa7c8f5bb3e038a53810565a69132e33db02b2bc6dceafe5294cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d22cf4ba7f702e44db169d4c2d88b52a32c539f575bff5baed77e35494c1e16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a49f7ac9f842615e3d79ea67d1e2e0d6ffe4474a0dc513c21c0ecdc7f660bc48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7fdcf16940e56fde71e1d5cee426c24e8ea32049c137ee113ff6935593998aff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c3b4584ef920044278315d730cde6d4fd939dbcb25ea3f4daceb77a3604a6d3d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a99354fafd66bc3280445c8612c7b2fa3c1e41a1c6b6a70e23f101596d5b6e47
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f8ef6cd826e0f87c947e98e914278412d95b97edd2387969228dcc60473a856
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e7cbb0749ddd7703859f06d0771b78762b2fa1c6d4aadfd52aaed892b5c1be1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3958258b8e860687e500bd98a4422097f29e089a58f64de495a9bd21008ef9f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4130f226e8be351ad758760f53de6110e848de988efc23cd248d4698881f0dd9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10e5c8ad8a677570b690c9651d4fbc8a33e32dad35bca94d42ddf1faa19db946
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c8d4bc86b5b1429470fcb91c33ff843e63b450c0bfb147a443cda3a238ad220
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 324e50ac954ba2b855e54aea33c28f69be9145a8becd42816f5f203dd62717b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 334c2e57603ad536e0abe76b72b8a897074c144b898356c4ad7d3a21f4a8ed38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09585f6c86e8ef252e1f1f6ec2667d1c2d13a038fc302f96fb1719753585217e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a6ebac36e8ea913bc20b038eff867617cc1b49a218ffb2a2387be56e5ffbf6a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 647fc0ccc100cc5e06048222b85ba286df9e9b77f72cc006846bd9738f150f0b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c726a6a3cc6d70224cabdebfb152dd64a06f09d24dff84a94a1175308d448c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7dc51b087b4610334cd57df87510d942c09865dbd019d7778707ca664de7e135
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d40fe63e4222294f0b0d66f00dee97c7f1120a4d5428cf0428292739e136657e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20ef9543d90f1e3cb32da560365728ab9c02dbe2f9a0c191384721a61565edf3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 820799226d2a9b73472ff740f04750bdf6f5b25900801eea2b3bc6395809456f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 835714a5531f9ebe5d9872165c1e7cdbf3959d2902955419f6ee4b74f8be7021
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46e30881225cb095d3d4c8df5299ce5a9223cd1284fb0b37d466c3f0c1460534
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 215d9cc99f67afe2e13a693c8401cd336891def82d626484a267031046ecdd30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6d848af05e314c54e954ef85595113193f6c446ffc39557e0b6bdb1a7cc95dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67245b0a3907d44c164de02cef8ca2fe50e274ee8041fa4399047fa99fe99a91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0bff8460ab239e075c72864e58be4cc3af7a423c31cb2af11afd3d416f3d8520
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd6aa7b2f3982c783cc8cebf714ef1e702fb82bbdca98cb54f65fcccd4920e13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f773b46a0e52abd0873d199321931d0ea07e4551c1a893c6d92c3b75dbdeccb3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a27202f72f1fa91e28de5fee6e806581468999166ddeab53ed0d65bd151a235
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02bcb137525f7c8bbf987203db99256c114a623716ca498062bdd32b691efddb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7056ef553e69e30cf095993e4a910363a0920bba1323a7772893ca51188cb4d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25e9d0188517703e204c23af90493f33ee7a20caaaea47d7665795110c7138de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 883f802b42fe7c5231fc2102aaea36736715a25c772316b89cc39ca0692b7d31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ea3367aabcac7b99b6a2ec7191ee2d221ec9d1d22c37e06edd3f154f3159b82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e365233d5d0dc5c8794ec3b4531c520d1509858c1c69a807c200fdafaf4c2b40
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f28eb96e2b793bc9ea99c73e54d4739e1ae83f5a579cb39123b76fe350d19b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a11e3c188ddb02b22de9b3533af57c9229ad28dafe295956a6cca00d36a78bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9fdeb467a7050f0204dbe020ec205b0bdd56602fd430d5c6fef535c4f61c4cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 adba73df0d12ef1f51a8680f2877a9cff759d29be8bc6784f4b9ce684674050b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8357d985702460a678f01d6cbfee8ed7033cfc1fbdb4f039b2cfdb5c70f2ffa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b22ec38b42e80411765e1b0de91935398738327dd37ae7511cd29ddc19c8b0da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9c069be7d4e0945613a3a342677d462cac51b13513c4cafefca27195ae1d936
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 056bd4dc63cbdf1c36827495ccafc309add57f9be3dd0cf64e301e221ec961ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e237bf09d017cbdf386e836cbfb4913654deba5c38b3d6d6a3508ce574a1eb84
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ebbb1e9b67f56689b26850d8ca8986261d39a92bfe597426bbab4f4ea6cab2b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14ad77851fdd05a542d5b6c0aee597d4ead9fb079119fd2f9d18455ceccf1ba6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5eea11dd43e402d241a15f1f3aa045b43c31213ade41ae188c85db2857c60c5b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cba6791be5ba198aef5c385dfa9c71f00c372ac8c76c9b4b57a9bba9ac227ab2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e495b71a4382411900ac8198dd46df4e189ea4d63674653052cc2f771613984
              • MD5 SHA1 SHA512

              pervert sexy masseuse bangs hottie + Amateur Videos poran - Extremetube.com.mp4

              • Path C:\Users\Admin\AppData\Local\Temp\pervert sexy masseuse bangs hottie + Amateur Videos poran - Extremetube.com.mp4
              • Size 14.7MB
              • SHA256 65d65371f812b9e8a284372b86adf243e4c00c34f88f4ac45188a462d1328d26
              • MD5 SHA1 SHA512 SSDEEP

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              memory/2280-186-0x0000000000400000-0x00000000012FD000-memory.dmp

              memory/2280-177-0x0000000000400000-0x00000000012FD000-memory.dmp

              memory/2760-32-0x0000000076CD0000-0x0000000076DC0000-memory.dmp

              memory/2760-33-0x0000000076CD0000-0x0000000076DC0000-memory.dmp

              memory/2760-79-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

              memory/2760-34-0x0000000076CD0000-0x0000000076DC0000-memory.dmp

              memory/2760-1018-0x0000000076CD0000-0x0000000076DC0000-memory.dmp

              memory/2760-82-0x0000000076CD0000-0x0000000076DC0000-memory.dmp

              memory/2760-31-0x0000000076CD0000-0x0000000076DC0000-memory.dmp

              memory/2760-1017-0x0000000076CD0000-0x0000000076DC0000-memory.dmp

              memory/2760-1014-0x0000000076CD0000-0x0000000076DC0000-memory.dmp

              memory/2760-1267-0x0000000076CD0000-0x0000000076DC0000-memory.dmp

              memory/2760-1016-0x0000000076CD0000-0x0000000076DC0000-memory.dmp

              memory/2760-35-0x0000000076CD0000-0x0000000076DC0000-memory.dmp

              memory/2760-15-0x0000000001010000-0x0000000001011000-memory.dmp

              memory/2760-1015-0x0000000076CD0000-0x0000000076DC0000-memory.dmp

              memory/2760-16-0x00000000010D0000-0x00000000010D1000-memory.dmp

              memory/2976-146-0x0000000003080000-0x00000000030B9000-memory.dmp

              memory/2976-2-0x00000000035C0000-0x00000000035D0000-memory.dmp

              memory/2976-0-0x0000000000400000-0x00000000012FD000-memory.dmp

              memory/2976-3-0x00000000033C0000-0x00000000033D0000-memory.dmp

              memory/2976-1-0x0000000003080000-0x00000000030B9000-memory.dmp

              memory/2976-4-0x00000000779E2000-0x00000000779E3000-memory.dmp

              memory/2976-6-0x00000000779E3000-0x00000000779E4000-memory.dmp

              memory/2976-7-0x0000000076CF1000-0x0000000076CF2000-memory.dmp

              memory/2976-8-0x0000000076CD0000-0x0000000076DC0000-memory.dmp

              memory/2976-148-0x0000000076CD0000-0x0000000076DC0000-memory.dmp

              memory/2976-147-0x0000000000400000-0x00000000012FD000-memory.dmp

              memory/2976-76-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2976-11-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2976-14-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2976-5-0x00000000015A0000-0x00000000015A4000-memory.dmp