Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2024, 14:36

General

  • Target
    463c853a8d273082998e219fbfdfd6b9_JaffaCakes118.exe
  • Size 1.4MB
  • Sample240714-ryk55avaml
  • SHA256 3c83296b084e4c34daf64a26548bc15131dd9ecdeb160571c8e4893b639c6065
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • ilyasdx.no-ip.org:99

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    5

  • ftp_password

    sengonul

  • ftp_port

    21

  • ftp_server

    bot-online.zxq.net

  • ftp_username

    bot-online_zxq

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    winlogon.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    RESTART

  • message_box_title

    RESTART

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3452
      • C:\Users\Admin\AppData\Local\Temp\463c853a8d273082998e219fbfdfd6b9_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\463c853a8d273082998e219fbfdfd6b9_JaffaCakes118.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5048
        • C:\Users\Admin\AppData\Local\Temp\WindowsUpdateApplication.exe
          C:\Users\Admin\AppData\Local\Temp\\WindowsUpdateApplication.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4020
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:4300
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:5464
            • C:\Users\Admin\AppData\Local\Temp\WindowsUpdateApplication.exe
              "C:\Users\Admin\AppData\Local\Temp\WindowsUpdateApplication.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:5500
              • C:\Windows\SysWOW64\install\winlogon.exe
                "C:\Windows\system32\install\winlogon.exe"
                5⤵
                • Executes dropped EXE
                PID:7028
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 7028 -s 576
                  6⤵
                  • Program crash
                  PID:7144
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 7028 -ip 7028
        1⤵
          PID:7104

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 eb47c770b55e85da7491ec62af6baaaaad58417938012f66d7ab93038221cbfe
              • MD5 SHA1 SHA512

              WindowsUpdateApplication.exe

              • Path C:\Users\Admin\AppData\Local\Temp\WindowsUpdateApplication.exe
              • Size 642KB
              • SHA256 461c3c628e14cc842f0896ddd6879f30c35a301945f0fd0ccc27292f40c4719c
              • MD5 SHA1 SHA512 SSDEEP

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 588KB
              • SHA256 acef19d8106f5f4bbc65a7506d941444982b39a18965b000b729806a86b03ac7
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de5630fa04136b4c3284e83465e5507c95fbf44e3b5f1935f640c4cfb5141567
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d962c8e93559069955567e9d560eb5b8eff7a4aa2282c2dc78b4e0d12ba4c41
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a08ef2c1cd433ab5a5bcfeda7c49fae4c27a8011e746920e817749c728ce6236
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea958e60ba8c2338bdfddf370491f3969151eb4d28d4fc1500793db13aae10d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 429d9c60f496e5a2f988e101ed2189f87442a00eff920a7cff16967ae4912a6a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0be1c2f93ea491a7d657d7327aec2376131482449a9aaf4d15152e58b1f0c4d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 887352145b1276ad72fdf8f66a6a4c76f97692173d78a06e4c446fb7df573695
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25e0943603d31316abadf03af9bd8bc061b8d88af93019e949efd5cf61969d83
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 164424345b743891e2db7374b4378f11bc873e4d27d116348bcc46a3ba65a1d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e8c52dd2094c78f77192b6741dd09054cc8a07d5e97f2d4e6b6046e75b88ea2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0dc489c5c51db2487a8d03f2e192ad28e91f409f945fc22b06876c9c43e3e57
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 581a7dd37771d9b4673b301798189d5af0fa7589a472021d7b316dfb1bcfdb19
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb8428e7f0c45eb783d25430df090c2f8b6dba6efab186a2046a746b8ab7d7bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 95f63c7f37b795befe6ab5c902b964d33a81b8f056634abedb58abf7e12cf3ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f89ba8cf7eb26b445e7ec997f831010ba443d9e2f66d3b79a359ac46a750ce8d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24447818c33fad53e16fdee7a5262cc5bf12b70123b79c9cefda9317920340d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf4f033d1657c87d8af697d239301306d610ae2a199910429f0d653be1991ff2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1af3992a94ecc12b4406f1a0329e09aa58283ac848161fd057b085b3327718c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 74af6491514b50e3d670096101b6d8622ea02a2598a05684e4b089d9552b5a3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ab6a166cba8d0cb790aaa0608add575680857b1646c3e5db99a43022c337d1e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3268013a78013dd607f7616e6aaa9a16a8063c3986148133a90bc1c95aeffd9c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34ce66b5257e81257ca7362328ce23e6055eb4a01bab8e0b06fdf92e595f5a28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c24cac544a35f204e229b1406acc98776e34beeb6855d555120c0aa9a1df00ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 396168aa2fb82828df17f4994caf3773109f46b474d28ae8e63dff12461fb26e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9aeb955fcf3e97d1b230e050365dc27c43bd25a520e8383bbbe3249dccebc32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72fc412dac0c40804dfbfaef4aed08f54113bc163c856bc214667d181de83b20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e609d131870172306817d5625d40ba794e3e7d25b80830ee99f29d0109b8bad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24014c49226f0e81d33f79715481bd33cc00e777faca6fad579c35fa106de404
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af4f0d8abf4362086383b6ebc6084484bf87d1300bc15def9d2e48ae952f28ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a773a0aee46cef956c6615b0b44b9cf26f61acb032a6928402a96ac2119be07b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b2c100306a9cf00b3792ef6fc58ed163f4deb72603964e463e5f47c171313ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c8a3094c7dde75b41de9e98efd405e63431f10af7a975b84b40032bf0a23bcd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d0013a5917435b96e61c7798d24e5cda35a5d58e59bd26f4bce6a6402e0d5253
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6797625040fd8bc6e89d83277d017eae4ad6adb631dbd4b634a377224841658a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd606426e530faf44ce89bf88c1e04fb15fc25ef003f6fdca75797907dde2f5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 68cba7792eec5c3fce462f027e23c65178b9f4e1120e172f6312f66a0379b494
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 23028028ed893bf16a0d2de6b0f16c44630738a68bb7e9e9f2c48515f2f66271
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 52a2c04ef4cedd6f8be98caf5fac9e7d6c4b35c85c8f7d3272f8e51c75436126
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 06700ee5fbebf94fe9e963b2cef647f5abbacfec9106c25dad7251cfd1df0960
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 950f5f0964e57fcc98e23ea1dbc0f52d950923025069b3fe3e36abd6f5faa8c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c10e815e2f64171f17979ef3f28709be13d7b6ddce6a9474bde00c522289ab85
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c2a0127cb311b63b8c222ff5a3253d78747beb63ea7218d511bb8ce7b7df630
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd3152210c8ad5bb6a07d173cb277e6b66aae7db93c4e75cef3aa62c74317513
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7368fe17d27af715903e5b91858522f33e94075025730564acb906519be1b74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12db14f1c9ee0a6d0cd4bd8cdaa7e1ebf504a2f293028fcd8ce5dd192455156c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7f943a3fa16dd3da1abaedf0b612036fb7180ff9438c4552b0ceb1580439cfe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 025c24b38e0884d075b239ff57fbe4f0a5a801be073db300c20f8520869e8705
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6bebd20c47b903f25104eeaaec2b162cbae29fd883c5ba193296a789f374161e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3eed6a6eec2a10fdeff032650a44af2260ca8aea39cb3f487c94dbdc9670c6fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e26331b7298fa87d80c1ee5363e5b15d51cbd60ff04566aea5a15a871d201ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f50cbe3ace733e7077d247ffc76097b36593bca16439e73806adc870f41d6174
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4bd8f1a302474f475fb4cd40d0fa92b73a4d2e7531c8441b3517ed3afa57d10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b589df48a5b43899d72c7523c4ecf549b8e330c1c16159a523f3716576bafd2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a700282b27febc91d8aeb03925a3f77c3392c2bc7598cedc5337e0941ebaca1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e4cd4ec7450167c8ecdd253febfc2e985ce45e33422bf46557ea35f47a82638
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63f4392f88ebbd276a1de6ee46add4395b306eee23fd862dec48cc2630df451a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af66884c1bd8cdcc70141bca9ce7c57d1c2208ecc544f153253e63f204d4c613
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 475521c67256e6aae4161e65261f32b11e12562b01402795a954b3feb5e723f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ad7c9a7d3a27fe51162c00420f3dc9da1a49d831dd9712e7581d38be46dccf2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f684f664441ab846af66df13938234bc387be66f8dd663d8c6c4f40d2b0d2e9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72ac38bd111a365385b3631607220806dc0e64e21fca5429e113e93602acf3b7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72bc8c630b3a79c1068cb265b32910f385b45a80891d65ab4c0e1a94cfa917f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09ed9accb929aa1c1563624c41fa101fac78c8f78c370e72542b2eb0b3b309f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 74862eee259c5aed3d6b3308b6d81e762bc6aefc2761f31ac0008848127c793e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8454726913f3ee6085be3936f161f25972e85f2ab4c05e31d6293f0543e47687
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad9a29843e09438f2c1af75c82f0567623c9840f45af670c976204a5ca2421bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d050df51e353227fecdf22feffa475e66c30629d7eb01eb89dba78cced70dbf0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4816f90e4f36313197f2485d89b3c90291e54d239f5b50fd1b55b0ea860ad621
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dcdb1665138961a849c992d2a83ae77e406391a7117e03e8c1f8b58032b18e2a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d3dd1cfc274696ea64d398612ef263d516c05d700a1c77575243162167d2bb8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f25973b222a865e7ded3b4840be05dbd5566ac91e463dfc9aa2d2952651bf411
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd55eba2791f335208dec00557cfa6f543c2aab8115d1bdf594e86cf7f208734
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 775f37526dcbacdfaf56317bf13685ab76910c98c44ede87911a6fdb64eec61c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3fb197c3a08be2a0b0dcc1234dcffba50cd870f66bc5667f14ca6fc834f8bd29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5638d41ac9530fd5b8e4dd25c29c117b803c61a30b39f297e99026a85a3fb084
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f239522bf1bac7b0b36eec52b65e281e468884384960cfa3e9d83379069bbb3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1913ee42f350913a434e5afa94a3fba046ced3efde28d856574347f37325d68d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd675ba071fbbad8d2cfc4f84a98eceb2b62879e842c0ce87a0496bfb291be9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 79ca10dc6f2a68f9d30df5d3bf9dab0c5aee728f60917bf2a895d3eccbfd8937
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ed02f9c06edfe1d3d5ca9efa26f2ed6bde2309cc38f9f61e2dc61790e5f7ea0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 005ca114d2a66ad6c34e778788982185376fcb6204df3da47d2bea2000cc7aea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 710fb6f117a30637eca0653fdee22b4f11e93e1d31d9a165bea6daa007578877
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e0777216c5daaef397083db85f273856608390d4c13f207f08f4f187d88709a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc55e4f72e8856ab3b9c3b6d6564bce404097f6645cea48f96e48e8cc634f4d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bfe46b3cd9c8ba25c92b160ed97636a88ab2fc94b4c0b8bbf7fa8df49a3b7199
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff139f21548d5df743d5e2b742f7fdf9bfe52527ede6232ee24576db23fc5c5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 baa409714331d31b95885e684128ad3f79067b94234188d04d18e0c10eb1d2b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 542880c313d6d357f303afd4037adda8fecd9bec69a777423feae97bed18d1a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0f008cd2b1cfddca9a4ff6d8f9ec3f9859070e41fe313173dd73642e8f0d09e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e43f1d25bf2224da2f16eea09582acba94efa6fe77a5dfa85b764d6420d5764
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32a44f0cfb2cb4c24cfd147579e54e4781eb658edf301295a0f4f948b70cc0dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 268d826b95765d02969b9d040edc96135fa3ea590b357d71a0ffc1ceb1c48649
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed7ffc7cb3aaa4065546259055c2331dc3bbb3300c29eea2eee09f0878bdfc4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c782de75b24c6ebb982df49a9c2048f4f7e4691095607a2de3ec09427f7f601
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28bd3e2a4b03f99329b93f973b1d2fe337140709be4cdc62818ecb8868a1463a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 309fe8fb9c4e8b36afe59472105838511dcc77f0c17a464cbb042ae9558b9c53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32b45121c6a2ef2835793ad6bcaece0f2a08033632aa7ec6319fec9d60d96405
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a3c6de582df6677279e04d222707ec273d14e63b9b0427ca2afb0218bdabff1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87cfda31c47f75175e03cb88b8983874b0879006ec11aae0f4038f9d0e71b478
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e3698407ce9b5bc511ae42b0339d0a70a29b18deddc0e358aaf402a399424bdb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d0239df0bce43df3903feb44dcd60411c960f6fdfe2c8ad04039344e4dad85c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 589d8f8838473396bb9a8f356480b967d810319cd10a3412a58738fa241e0e8e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36b2d7ab6bf505bcde5abc550c08a76e629a283bf232935847017b7bb56cb723
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43f79c85f2f6506297c4188f59fde706e44fc4d498561749d1a8b713e4dd2218
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85d3c666936667d2dceaf0aa1ffd01105b0494ba94b81e364ac537e6f8952692
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c2d5393bf2d214126a63c876206586899359e682dd90f0c3bb991df2c5309612
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1476018b93d57025fbb84523dfd36e16f6da8aea2f2604ad52132074e017127
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63c53da16252b590030f4b64c18984fe28e7e478c0a8fc2335967344af15625c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e19c4889b803bdbbfd5de6b8c7cbdde96fae659d974f57b52fa57b3263010795
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5af260949c6690375071561fee07ffed3023231817523d36ba738ccdb1fea696
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a4bb70e505f826452a8d98b6daf66091c301632f1e81bdabdc4b68dae368a33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34d4379295725d3eefb39f8c942eb2d9431d12f94572df4d3818f1864c3cbb97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 558c67b3a47f720e575ae00fd33e336dec97277a1fd82f39bff18448e6b08cb7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b1d7a35ac731b5d98b3ec0c92d6d3f9d5211c0808627d88b3d51885eaaf1931
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28692bb67635f4ab0b6185520f68291a356dae47d9805e8fc0fe6689634e26d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db6e1f9d1fed7759d9cf8ad41705e13de0aa24bb2b3bd57a480ab867fabe01d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1d6716b508c48cee63825982e742c814956399faa15f1104aabe1d87346b7ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41db2373ed1c5c67bd8bc18537e1ee9b64125a5bbb9ab2876dd3873a7c29211b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c4644f151dbdc822d4de8a3587b64ac0488c24279a134466cd4fd02c8d5b682
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d054eaddce41909160d3d8f486992acdb9dd24bcc029228661586e2db9892827
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 358e10851acfab4e3af8e7680d95f47ef7504a2beccd0a46a890ef97f8451169
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 227477901087c37471b55caa4d7eee43a2f5fef9c838b2d149cbd37fc504df07
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c2a48af1c4d277ed8746ccc2b8e6b97cdfb9fbc94cd65c9faf5d01809411953a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab9f569d8c4e70e0a144468fa06b62ba6d4b6933aa14c723c8845493322d9753
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 49794208973ee9f60fc48b24fcfefaa438ecf92586828cd57a58029e71f4ec68
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7eca9aeb5af8ca1c191be380e3cd03aaef635b5ac59ad7532ad97f3bff6e6752
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa1ab5d3fe599ba7cec6b954dbe36b3036e31ef66ac4f4b52450ae0b50237c65
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9cd2981ff1f2a24a57c01a107ba6f29cc32581269142eb9af9d95f436ecdf29c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9da7c477bc29f274f0a6c5a263b4ab5aad79c9fbe18b7e75c10651c07b25c8af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a518ed760d23175da4ee23bcf1316232ba523ee893a5229a1b7ac8ca78084e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df09e1600c284b3067b1eeae6a97c721006f6f6814bd1bba9fd083fccb448811
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eaf2af8671ae5f73ede96468de7b4781aecdc1f1e1d58acd8732fc825d1130a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 656462f16625bdaa2832a048625a9022aa17c9d22ce18e382e900d2f41026612
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82c28ac8cac38833fb6806b532cb8ffbbc64552e3177ac0b8100108f73fb292c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 297ecacffed58ff04a3a30b27bfdc0322c27eec43b770a5d7e57f91f20da97af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ff2efaa30e62147e2af482be0b2dacd2deb3a4de090fd38ed1abbf9e6ea712e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 900e17456e4f6101b6dff06ceca2a9d4c2847b743123128f6e3f8d83fb20e963
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              memory/4020-16-0x0000000010410000-0x000000001046C000-memory.dmp

              memory/4020-22-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/4020-15-0x0000000010410000-0x000000001046C000-memory.dmp

              memory/4300-691-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/4300-2238-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/4300-24-0x0000000000C70000-0x0000000000C71000-memory.dmp

              memory/4300-23-0x00000000009B0000-0x00000000009B1000-memory.dmp

              memory/5048-1376-0x0000000074B50000-0x0000000075300000-memory.dmp

              memory/5048-0-0x0000000074B5E000-0x0000000074B5F000-memory.dmp

              memory/5048-8-0x00000000053F0000-0x0000000005446000-memory.dmp

              memory/5048-7-0x00000000051E0000-0x00000000051EA000-memory.dmp

              memory/5048-6-0x0000000005250000-0x00000000052E2000-memory.dmp

              memory/5048-5-0x00000000058B0000-0x0000000005E54000-memory.dmp

              memory/5048-4-0x0000000074B50000-0x0000000075300000-memory.dmp

              memory/5048-3-0x0000000005110000-0x00000000051AC000-memory.dmp

              memory/5048-2-0x0000000005010000-0x000000000501A000-memory.dmp

              memory/5048-1-0x0000000000830000-0x000000000084E000-memory.dmp

              memory/5500-2693-0x0000000010530000-0x000000001058C000-memory.dmp

              memory/5500-1372-0x0000000010530000-0x000000001058C000-memory.dmp