Analysis

  • max time kernel
    150s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2024, 22:23

General

  • Target
    43936a0b11da298f4a56957db56e5b06_JaffaCakes118.exe
  • Size 445KB
  • Sample240713-2a2hbasapg
  • SHA256 06f929c0bc69e63f900f74558eac8839334fbad2d373247e71512ff2ca68bd46
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • 127.0.0.1:90

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3444
      • C:\Users\Admin\AppData\Local\Temp\43936a0b11da298f4a56957db56e5b06_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\43936a0b11da298f4a56957db56e5b06_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1332
        • C:\Users\Admin\AppData\Local\Temp\43936a0b11da298f4a56957db56e5b06_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\43936a0b11da298f4a56957db56e5b06_JaffaCakes118.exe
          3⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4156
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            PID:832
          • C:\Users\Admin\AppData\Local\Temp\43936a0b11da298f4a56957db56e5b06_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\43936a0b11da298f4a56957db56e5b06_JaffaCakes118.exe"
            4⤵
            • Checks computer location settings
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3028
            • C:\Users\Admin\AppData\Local\Temp\43936a0b11da298f4a56957db56e5b06_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\43936a0b11da298f4a56957db56e5b06_JaffaCakes118.exe"
              5⤵
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:1856
              • C:\Users\Admin\AppData\Local\Temp\43936a0b11da298f4a56957db56e5b06_JaffaCakes118.exe
                C:\Users\Admin\AppData\Local\Temp\43936a0b11da298f4a56957db56e5b06_JaffaCakes118.exe
                6⤵
                  PID:2112
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 532
                    7⤵
                    • Program crash
                    PID:4548
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2112 -ip 2112
        1⤵
          PID:3824

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 803cb972d2b0783fddc820d8656b0c7c3d3b326aebd909c1e06f4a2a1a932269
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 230KB
              • SHA256 b3f8372a713bef98d75ed2e97201f801e20a26e0c015cc7a20e40ba7f3af3f17
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 248a40e214bb21436a79de91368a14e999290f37e96719a81e5be3cd470d94c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 802672a42757aef7dba8af4da30f58dc7e5973de5f5895de46fe25a134eb44a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8bc8d31197ef13b8e1d73fcbf993036ebaace14be644cd7b4011ab09055bd460
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 edc3fa9d136635dd992859a3f93dfa6ba02d6cbcb79caf8ba1e6a4791bdffffe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f58b725e74bf5d7c02a1265cd6d0a33b1d6fd1041845e14a50da98d93c209757
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 37f68e2a12f2c20f7c8d5bdaea04ff757f368a8fde48a3f96487d7d609e6dd51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bfc891aa71475237a09c493cae343deede8a7eba87ed2596133f6e722aa821e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42b94abda95889b7e4d2286c9a32c134c628f822eec6359073eef05c8e0586be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b8f387756b8351053f574837592f2882b10e46ecf33ef58ad35523f4daec8bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1863439e17a53cbff4f052d2515ad80469fe1a2e04bf9d1663efb48e0ba1d3fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4da86aea72ba1c50d7cab41fb4ec0ea8fc20492bb713d38f7a8ea467191c6c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70898813b464aa3c51e21114e4e712147fad6a280933286ecb5b38ef4b92aaae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 213fadf0fd3cc4a3327637296a0def4f2eb77da1c4e94111d54c4ce489297af5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bfda10b84e9bf0158ba13e1ece53ad6ea654737445b219bac466e9615a4488bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 05f7374833a5bf5552009c10391f9805732cd9076434ea47320b79cfe3790643
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce84d8151bbeb66510cb53b5fc8bbe56385af31bfa5c7c9e0b70689bf8507461
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fca4c9c31a4f355518e34dc7d0579db9906edd1d28b95ebadb5c2cd2cb76faa9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd1e5fa8867a08262948112240132c67bc452fb064d877801b15effa911245fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57e8bd7ca0732e5755a6ddbe28d803583f2b27ffc15409c2723bfbfa8803f604
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ee97efff97aac07d5e3572abeccdf8cacc8039254b59e8bf9a27ddfce1fc4f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f402702cd8ec9f16092bfabcebc07232d81b22512c5896cd74e943e7634f4d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67a49305e035a98a0660b53f0ebd4029dcfc7862d53bea8fbb2c552c214edf19
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffab51241ce1832c177dd355ed0884c8a36076bf4233ffe2c7db0efb59326023
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aaaeaa7f82aa36dfbab6a092798bb4be826f213b4b31c120dc6d8ca2442e4aa0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c06aa65c541b3124b2973c511a8cab0cc223b8ae50335c9a3669d30f9229d52
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78c12f1268b89ce461a3888eaf18ab2a7e8db03700ad5599d941ef622fc9ec3f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e6d9d9a88e6bdee36f3524e6f32485c8d73c9951b6c67f3fe120db77b196cef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6826b3143dcc01de6300dc12d6c9e197293215ec5aea563b68ff78465b1bcf7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee1120c298f95b671d6b281d80de9adcd5fc114e0f1bceb5adbfee7652100f17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89dff130fd2588715e00594aeb45a1aa4613939056d5313346aa29f3fc9215bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df5047dcbb4e341e3fccc2f3c54ef6128549b0710441eba7c0b398514862b797
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30a57511069084bc82e4a1e0720b35e0b01b50f8a320bc01daf8d42c29c33dce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93de1877b9bce6ca9ba3f2604ee552eab0094b1f5e01f7d9049bfe6dd82fb083
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d9978353aa15f925df2914a92015e3f9d48c0b415d3bb8bb26063b9950104fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3557a8474fc1ebdd5e21c6baef5eeb3619ff7ffad69429657f7d50b6f9ca37f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c502e42d3eb84af615e7c7f30095fadfe573c90dcc9b41de1dbd5f097cfba9d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d821bf6043750fb70a1a755c10da2767b1935036271d3c4882086dc5858953ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f3d6437ad77a7bddea67506573f0733678244d9f9129cb71515e2e6e684dd12
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1184f50b62cf7fc2ce04d808c34d68d627700184405ed86c8a31a99635695ff8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b121530de4e9c53b6c95375d12d7f915ab85e5c45d331b01fbc0754e6313df4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1bd0fa98774f01a89cc002bbb54501df0b44cbcb2c204f70f0906621619201ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63be4cd358a36e3ffa1fcda7d31a8131469cfc46f515b169ffd913e75ecfb0ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f2e6ac1e952db3a015ff41c21102a05d2d0192b63b6f74dbe38e42ac61a6a1f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc99feb8aea0ed96de418e502b7a2ab94e7d55bb91b6f9bec8e31186f895755c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de9b282230cff845e576143d85847025957693ae7e11a348a73be7cbff0d1879
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9fc8b3234a3ce711d3ff84e73e239c1f5e6471441ea6b969de11c7de7f0aaf79
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2008aa2fe4ae5b4d9356567bf237211db232833298dded23033e0915a8722654
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4c620dca47952ff367c34efffa57570b307f3db4a4dd7ee764b6b73b3468d1a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2731f80af0808c6ef45cc0e64477b84345d0b2165f7f9f7995b079b9568ca5b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f2e9b2dddd5185ea7d14d7868d651e4d5e166224fcb148a70e6a4d2e822bce1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7d98681c5ad8cabe47c835291cf147ced3c2b792ebdfc92d026b8edb1369e67
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 836c0235deec510e3a03f2ac797c1e75065ee68534d8daac1990ed3be608967e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c99c6ce3e04371df756af79069c6e8ca99632a9f6ab94f3f9250181f67277972
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55ddabf7504838f0cb46a964853c6a7c31fb4354ccc01deeee3d14705b0295fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 61a0c27d6a2ddf604f2643e358dc4305deafa4ee4a17bfde3a1ec20b838e9b3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f02b6e5e21e36fed667952f2b782326d756946220aceec75a9af94eaa166bc1f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7df8d19160eb0a345f2f058c6300db36e963f87cf4ab7a0e8e8f5657b0da8afe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb73806b1381f5e358f2690516315829bd277a51046a1a0244dd92808bb76ac4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ac90e7a490d7017a5cdf1621a5f8e82de1b246e29bf58911349cd5761ff6f00
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e95c7c6224a82e4fecf75576737cd4990da50bd77ce6f09ab5045634b6434403
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5be62f96069d35b34c978afae675ab8db42c80eca32b00bd2028a5dac62cd980
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca6359a24e1e8e5be1775319626403e70dcc0872e2cd932733c9fe8a20485ac3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d792dba6cd70104e36c44627400345d1c1cfda710964eb323b832f01ef2f1805
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b121b043b3f7cc8449162147f9c9db896bc1225559cf9f36908be3905a29d568
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c50f3312ae85a2e8020b2fb62e710d12932d2778570bf5f3b392a820d196d208
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30910ce01b3b799a1f223ad780c65f1d044b7ba27af061ea123be7599e71d0d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 292cc95b5dfed3dad6a61dacf35d3b016393783c4cfca50e29342142260643f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f135f8f6699473f8041c7d858f4722ad27fcf1e251d06fdc3b92395222d575e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55834968b6e82f7354e0a6a3ba12740dbb34a667fd2587264c9380ef1e4fe2ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 649836a0f67de000fac43347033b33e42745e40a293b7f440120c60ad64548f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3d622eeca2460c3d95d990a6d901ef580d81e5e8e79483aef7d3b464e2dea26e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ac2dbd4f1ef27135cb0b88e64da7d09bfbaaa440799a2477845e1ec253498d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1066e39aebc2155d67b735ff7e77acba9ddc93deb76dee2ccb3b95d73f9038ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a08b93a8154cb9a2a19c8284aed4fa541d8f0377e546936ac66b647f1013c6f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01b91e79e12d0faccf0d5dc86dc7c4f2be8c4c3ecd2536f062565410b3e5d7b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e21fd1db690ff34ffdfa8cf1f44f6b4077b7698ed5e433dfcf55c54d624a769f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9bd1f3eb1f48f858aeba139d3d5cf0598a1c7873ed1cd21e728f7e28955c313
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e5d2937adf5e8037ff24e89545799b66434a256f41587b8a719dcdfc9d4fed4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73233d54cea40a3f31580b5248a97ed1e04bbf7b31bfcf76f321d9063eb0aa4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d3390f242dbc9bb0378fd422ab89b8cb11a72d6d5d3991d101514b4ce5b5a32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad1d483e200ab8ac88a6171e2dba14a9fd0b17dfecd2266eca422d73355e2f1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b35ebf6e365e596dda37ed0e35770cb7eae108de8addc77702264e6274e11724
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e45d64fe88a43a1c4a78f69734c4f169926fbd561d144a031d609b50a0d36db9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2eea738970be828dd2e1d841a39aad80404649723f2ddf2be99ff213fc7f83d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4092665d79c5fdbdc8e6787421e614054cd5634aa0b79de5cbb2d7f8c48ff8a6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe171356ba4a367de169389f129c0dbcd60afbcae24c2ddc150ca47f4031bcb3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ae47335eede4b04046146e8c45625831604431316464922daf83f47a3cda645
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7178d14110273fc8daf3d02be4fdd5cc8fd2d758fa8c39fc69ef4737e73f8ef0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc86ed361bda4317d325cc9b2ad04a1000bb72693ce371a0f1d014242c342754
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2bcbc9b87fb6947fb9da7c4a864bc6cbacbf8eb71378287a85dad9288d7c220
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3cb928d7c8317223c2853a814da5c48c6da239602a73a81425974099cb3307e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f56e57fe84c0d6942285bd2ea96b254f06ae62b10e1b491acf897f0a23b85fc1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6317b57eb847342ed233ce7586227d8b2258a95fab7479537479ccb67167ad94
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5167e6ad5c4d90057f1f0f93f70243dc1a2556efc3b506935fe5d23188bca820
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb6975f71e5442e423f62311faec6ad4cba0970bdcafdc8c21d7d67d1a5074a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 058d1a6953fb9b07405832de4f273297845a9f57fdaf8d533733961cda07ffe2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cfb15007db3f0265accb87750f1176d1d9f4317923c6816fa8092d6d72eede0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a51947df9ff0e5daa8cec133ae6b166fe465b39abf150ee78b27cb4967aa54f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c0b01b42ff830139941659b9582bb717815ce61325258ebb34422af7b6f72caf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01e08c327eb9355ece2a679e239e146218e09895d19bdef24b7ab315b55f356f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8441a0febc53391dbe864d987878ecde1d5d5dddf695b180a47d7d8e17b609aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02d4d90e56b4887dda6cff80928d5ea19c74fd21feb0f78fcd5c11a508376bd2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3cdff781999251b334840e4a687469326a8d5bf6c60ae3b31fdaeeabba6fa619
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 76822030f0e0226d7b036612a6cc1e9de907fd40c0f257caf78e730d205ccc91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c40e4ecdf188d24788894f0912b4d4cac992a84b863ce7d364294cca93253fde
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60e02c00d71e524bf0af14964812c176e9aa09d033a2902e9647080e1639766e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b45c6e99aabb8c81763e2c525d1b08f81a01113807a9dd28a85c17484cdbeae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 caae15689e85d8a760be504f823c6d273851cf774c5ad0bf192ccd93a3e60a5b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 550b66024bdaa88ddfa8d907529b883c9d0071a599e5f0c564e5043dd6f1dd39
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc326e49e4013749bf438ab7417694c1e7b090808b2022744280110a7d98f775
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1a7c2bdeeca277de1d8f3d4e0b650a09c4b0ed863868615f1d4491bbf7511417
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ecfc2f939f101aa8c8e6b8c5d76097246fde15a8d9742a4b0a5ed27dcb8fc61a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10aff63be2042f00629922422bddacd5ff7fd277c8f8252207d61a49125aa25a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b443dcc406963949723f3ddb71227b97272576dbcb8ce9c028b95785c3b699aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13a6cfd2a6dafa53b82d402c448dade96059e6b4863d02b699b4df3db2b97784
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2a8bcbd4a8ff7dd82f0b050f6b757ccff6946f24cb3c943b903539e9d561350
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b2a0a643039fac9f9afdb763aa3c63ea52a6f320555a628530a20dcaae989a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ef0a97de7b57be7d9b817d668fc4e877c50ba8ba2bc4f160a4e7b4a6742757d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17f1378e9f68529ed7f727661b78d90e08710e69ffc2a4aa09c8e4abd69fcfba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02e031a40afde03c365772de7fb36cbb6139ce322d1de68438f29abc50d0a1c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ac85670566fea9319ebef7474d1825c9835d9920b410b2c33e862b56468337c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1fbf6c8e725472615bfdd404a9a7a9fbbed6892141d7367ebdce41d2bf824db4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 934ba0f9b1e59f5a8a3fbd969ede19e9c41162f06a7ec80c723f541f60860848
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 844de808c9e674dd89f6a3f365a9a9f574fb82a2ef93b0133004977414c33ea1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1df38eee154d13e9bd3d93515986a29a1c8c7db3fe68f8cf8ed348357fcda53d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 741b8ea6e5b1e9cd2063a1d968234c327437d54d75ae19325ed78c0e5a529f5c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87e08112e1c34c22056cd14b2a6c3ebe3e4efeae57ab5b34ac75c55236ec04c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 07baed8449070d35224b7c7a1a48aafd2d8fcdd0c3b610792e11ac2368e7e559
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ef5ff2b481b539969a9b368b0d62dde1ee3c054407efc98e2a6a469548bcec5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 845c41563cfbcd8b20edaab8dab45f0f329a92374aba865cfb7e37c654903846
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1f590d1eb1ecf120fd7b925c2829888f909866d2e0b913a854fc050271638e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 21890d8fe11b478b415294bde2c48f8052ad03e3f94c458fc014415207e62dee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f7057e5844c413cd55d9adaecffd1d38f2c6b82bcab8535b644602a9184f2ae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af2f61ebc2ee7e5462c6319b7334de85a635a8ced3e978b78634a7ec4abfde7d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e9c3c61bf903fad5cdb7cd6e31b87de7194a29ae44222dcd7a9a3e4480b900a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a69de631438c2be10c7df189c1efbd32fa133519650237b6264553edfe24d156
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c582ceb7dd734e61901c90f68d2be33dd1f9416e594ef41b526f651fe1e4086
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7873074d536c1cc34a7a0ddb1045185d392542effc95b92d1406bbd8e0abcf44
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              memory/832-14-0x0000000001150000-0x0000000001151000-memory.dmp

              memory/832-13-0x0000000001090000-0x0000000001091000-memory.dmp

              memory/832-778-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/832-74-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1332-5-0x0000000000400000-0x000000000053E000-memory.dmp

              memory/3028-1458-0x00000000240F0000-0x0000000024152000-memory.dmp

              memory/3028-140-0x00000000240F0000-0x0000000024152000-memory.dmp

              memory/4156-139-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/4156-2-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/4156-10-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/4156-12-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4156-6-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/4156-4-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/4156-3-0x0000000000400000-0x000000000044E000-memory.dmp