Analysis

  • max time kernel
    150s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 03:06

General

  • Target
    47f270c3a1849c519eccbcf63c8e45d1_JaffaCakes118.exe
  • Size 343KB
  • Sample240715-dlrv9avfmk
  • SHA256 29c302e692ca0e832b5c0fb44896dbdf91a37ffbf416c3c00f2b411b052f50de
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:90

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3448
      • C:\Users\Admin\AppData\Local\Temp\47f270c3a1849c519eccbcf63c8e45d1_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\47f270c3a1849c519eccbcf63c8e45d1_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1400
        • C:\Users\Admin\AppData\Local\Temp\47f270c3a1849c519eccbcf63c8e45d1_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\47f270c3a1849c519eccbcf63c8e45d1_JaffaCakes118.exe
          3⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1064
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            • Adds Run key to start application
            PID:816
          • C:\Users\Admin\AppData\Local\Temp\47f270c3a1849c519eccbcf63c8e45d1_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\47f270c3a1849c519eccbcf63c8e45d1_JaffaCakes118.exe"
            4⤵
            • Checks computer location settings
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:4128
            • C:\Users\Admin\AppData\Local\Temp\47f270c3a1849c519eccbcf63c8e45d1_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\47f270c3a1849c519eccbcf63c8e45d1_JaffaCakes118.exe"
              5⤵
              • Suspicious use of SetThreadContext
              PID:3416
              • C:\Users\Admin\AppData\Local\Temp\47f270c3a1849c519eccbcf63c8e45d1_JaffaCakes118.exe
                C:\Users\Admin\AppData\Local\Temp\47f270c3a1849c519eccbcf63c8e45d1_JaffaCakes118.exe
                6⤵
                  PID:3492
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 532
                    7⤵
                    • Program crash
                    PID:3668
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3492 -ip 3492
        1⤵
          PID:2092

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 35b981b47e65250aa3f67b7efd8e6ff12d8dcac679b78b59c06c028dcc362811
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 dbcc3e876cb1af5aa90c713a54bbfe8742ed233a9689ed7dc60b3b6bc2c1b25b
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43cdb0171ee602b8635f50a8b118b0797f75cab04662887585822ae95bf09902
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa33ce0d431d226fe756907404f570881b518f3736f3d4b70d12c4d3ab1979dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2fb586484b2fe6dbfe7c8b1bd206e09961405df62c591761cbc2e0bbd1418747
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e47551297d35be3c1374d6b5a632b60cf1c1d21b6a7f40b5b4d0bb8773988bfb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38722a7e6ab9ce838e1464108fad96c443a8fc796b784b4c976352bd574b4ac6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01dfe6f55ba295e86f3840e98e3bb1ae94f0aa6a01aac5f8f898b9d789a9f20d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6fd5105e6c4732828dc7c913b600a7bd674e17e9ac8afb3a74afdc1afaa12f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0dc3c47a0b620aba0fded0381eab34114c4bb6ec7040b6fa9243bd36b0be0e65
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2e48adfbd3bead40686436145443847127a15fed95cc3cf5a243be13959065c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 984ab1a00f2363bdf3c3c35f3d77dfd12e37fac7d2ec80d17437a9fe946fbaa1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25f6cbf091ead3e43dfa6a54a5059daf0a97361005cbe8f5000b5cd87d58059b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fadf9c6c36349d627e0ec4e7b9b1f7489dbfe1f1a1415e3d682ba7ca144fa275
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e222589eab4123a927ea5f699590fcb6e36fa3a14ec01a8b299a193b8d9353eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3004e34b2bef4c090527bf35a1ab921a8490b7735d708b1353ecf29ebd20fba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c912a0a59e7df8c9bcf2314e2a96d214509aa78a60c100778b4d89b4fd1c142
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c3f6ca32dfb2a1e94e85182c560e1834c129eb14d5d409778b0ec9e9334f6704
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f73ad75d23b419d42875eea104c3170e90d474199a0ae1609d3792fd82415c38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17152147dff4725454b0c8bbab62725a25411cad2f9e83f56dda21b2ea81449c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8aebe84018ead987531689216129a40aff31bf918565ffafc0c56199c2552e39
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24526cc0395af1ae0a23bbd6bd6d66a64520122db3288bf9c539281bc77bfd5f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5787e852e663c0090d74e567aba8d49ea968bdcfd7632d2e0a94e87e6a8796b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a4395063344fe6308e40965b58668e42c64ef4931172b4d31915c07273f3d17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d9be0f56d3f53428b6e58faf81042e2553b9e3610a5ee569da141fe739d7d04
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f26308ca0cf360c68ed8d57ce105b86e5d952e1b1c02a1b98cc58fc531154f5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0c7b0a101e2ee139d983780b1830a400a4b4f3fe8ebc8cbc29a591b30ad7a93
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1932b8645b3b1c38e127bd3310303e59b906c65dc1769b9e1d10992a1d5e99b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c40a82251327e7257f2f730199503c8e2571d70dfb281eea0c09910da1cf0278
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7508dc761118da6754cac0a66b5d328c25dd9bd8a8d3649bddf1918f147bf1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f5db0a97a01c433d43b86c2560d943dc3f1a142a771b72ee02be2c542126a7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 499530dc92f0761d9fd7430278624cd169f64b14f835d4d12fac58c92f776dff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ab2f7416664ff5f4a067a22383dce1ab2f3015fae12017d5940756d86ba76fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6462fabf74d5e7c3610ad256c0d7d6a5640af1d357ea69e15b2c94953f0b8a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 658260fe4f27f10bbf4100c2f23319233d32bdebba3d92936a38b72d7b2f0584
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92435a48ebdaac04de3ed4219c4896e6dbed9a3a91ad6ecdb03210e69b0ac0e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14bb67109ed2f78e940e643c064a2552a6a7f2c7d586fddfc52e1e8b3124b0cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d355c20fdaa097ce61454783c976d91d890224ed65fb2bab6f718b134d310e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7e2ae54b9733266fd6233d2126dcb5e4f85b049e40987255311419d069b58fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8dd9e13f6fcc637fcc50e5cf31a49f6bf29cac93ed7b826db1a9273c113f2df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca29878d7d2106e9de6c5a5d192bbbb5ef36ae8a3fdf1c4d363683140e7c5b3e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53bff19b2ea8d76280378a55fe63a8a0493d1316dc6903e1cf0248fd8f076c81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab2f1b1163ddca5706e5a09e326fba3603f5cd6a3630f1001fdaa15a12436433
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43544c29e734c658a33896b0d16c51eceaacd3fba56827c916940483e2e0b869
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6fe5323ccfd639c3f6ca20d197b87bfb7334fd6011b36bafb95f650d29078ca6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf587f1bab7458e195d7e2b42f1eb74bf0e1bfff2b2f106b36ab0b74bc637fe8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a805b77c63a710d62b58647c9093995361d3ccfa59d31ebf87634789a5f2b083
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ecb907546ee6ca899443ebda6135b7830d627de1ef6f266836aeb6dda8b21c50
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6486a9b538c1a498fe1a10a09d68f7af8faf4099e2683a63ceaf9520f2769225
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5a76d78fce1fb070fe95208bfe361b54f073e87d9e6510caea7c9e8c43f5cbc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40ded83948f4a577c04876676d487580acc5a60fe014eaaa5a581957d96077c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9a587833b032f9fcc1843d606356b049e461a5a27740eb23ecf3ba2be32ec33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b1d67bf524069ad68b2594001ac9c6d9b36ccf8953710ecfc62ff9a04064586
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17f63365fcba392a64a50ce5b38b8bc2e4f24b711ea126672527bdd20d3ccd5b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8fdf053ab64fc9e6b70211afa6aba10a1a8a2f474c9413f95df7f9ece9cea82a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14a232103e4c0fea43c46f14e2abd36b787654dea445bb766ad9e3b6e1376a4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffc7c7b43e65efeb3389c0376ff23f8b781c2695f647581aa657db35a2c0714d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f28d490c067a3671dad7b8619f481287df1d26454fd0520ca3791a542769b141
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 038be34a74bd8922e65a6a24836de37eb6600f79ccb16cafe080669181e76b2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3628b36fe0e10ac82189cf8a26d29a91c3098c83ce07c7d35d60562796c5a5c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a645effa4f509e75ebadb7764b9df5898201040a85666f62aa9300c50cb6fe1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7b9e4aaa67536ed0e1e71cf87128e9684d6be6b9a0428f8cff8afdbcf1cac91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8250794e637dbe89274ce974485d4515aef95a886d16b9a0a2ae84f35e851f95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e457072a3b8857eaca3a2279253b6c40ef3a1e2e1b57f3f407fc0ec29f20ad3c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1403ed1e6b47513ccc72d188efe3e0c622f1cedf0f1067172afae43178a09432
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c3eeff851e63719b8d6949079f758b7bf76b98991c9986376ddae3dd6127f36a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5eb8e580528880d3049740ca4681289ffea67ee8897a98d4e176582a17534867
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8697ff5f7e66e26cb3bea461da355236fa6dd84bbcd0299abcd803ca7b9d136d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8347135f897fa6fa650ddeb11c2fd135c4e20cfbe0739e63f732b9e5f2957c3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 972eda13a97c494534b0d320ceab82498a61f7164f731341e59dffd13fb8fc06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8a602dfb4218eb19731234fc3fef5704bb73ee8c603229e1290fb86f99cc5ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e61d946d13f9c775ed53d737aeee86903b4193c804dd324fc8e572af84c2439b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 186040da7bf6b8e0b914a5507e08a1ec60e97eaab7f20f67aac4cfce96d76805
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9e14de34c16cbc310ec63e6e9a4d0d1e8a2758dcb5ae0737a1264c4692814fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a6f813adbadf0d31123eb257efafdd86e7b9e0eaec0126e9dda4b8121201a52c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 256cfa3196c6a0f975d83c21d1d82a1136c3605410c13315e4398762784188a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0fee3ab6c7eaab8e87bfa425b801a80cedfbe0bbec1a896d1d98c9dd16dfec94
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7aefe15cd1c9ca30839c2afe9cc6d96e5a50c6228871d032c14b8cfa03f50eaa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 982bb336c40c2d2ab117d276efc96b75bf743a086e0320d7bb6e2afeaa93faeb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b68a8da8851658cfcc20a4e6997cd4e802261301b55c6ef7924424183559ff5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f62fb9836d8b78cb290e5c22062ad7004b795347293d16fead44616a00c4d477
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b8c897856f24beb016262c7168d0592ec4dcadef96a888ef2a4455a44aa99a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fba5adc58196f4063f126da338b8a7ac52979f04a11e3ab28395905d9d7df4b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8ab5ba87eb7f6a9421b372da2fbc59ad6f648d7aa642d5e53df1e2bc7349487
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4e4e65faf388e0aaf31800b3b6569d484378bc9512dbe8939c220ca967f2864
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72fff903a09520271f5c5c045ddc5c9779e6c7fe3a819f5ab62aa824843c934f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 028dc598a0b4a6246a3a01c4daa12dc2552b7cfc4981e13100d80a5ce70604ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e001ff3c0debf341090dda3504bf6ea9977f0a2a29e76786ea0601596ca2b703
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3eb040a39608b3298ba921670e949f088444efbc3f3efb30f73d21c3f1e173ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f02b52e01b262a34fe553d0ba2e0c8251fa28858c5849e7f0b4db5075e9f6b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 769a0f8c83f10e546a3f4624176357d73975bda0a71f5109a84ebd5db3ce4ec2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f39016e12b49349af904e6c0d98067d6f40b93c1f6522532e91c7a88b71f474
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab42d170a6599da2b668c8dd7428cb8db709b6b775df225f4f3e6f85c3529da8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a62449ce176a26be30437cd594645dc978eac7ea93063bbe1fb55172a120e3d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be5e3086a8f53a001c3858c147e7184233539c30ec8522a801d374e749930dfc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e14dd25cc1e373205a0b20ed4745fbee975c3ff74071f0bbc8a21f9621960f3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b524fa19445ca04c5be3fecdf18bd10f4a897d388707581e01d3c216886c036
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffcbe329388add3c44ea2618628e484a89ba1d41cf2cd286738f44ce31a5448c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 880b4a4f45f9a6964a2533f5ed4dfaabe1b53466207946abfce3aea710401c1a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 416be5485c2a3c9eebab2fe91911f8487006103d2dc66d091bfb1f440c21021f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7be480cc415f15e22776c9922d003af58437fdc87f0cc6d16b0f7d848b7316d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8acd074feb261aacfa0579bd2602be9a037d05db38858c55cb04042bd337c916
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6bdee66d1542bca5d13ea70dc44a3ec3432c2e9072b53fc9438b786a0b333097
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a420354af9d2f58f7e8afc288a5861c904ed8cb2406f1e21059239f39770882d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eef34e481667b2522add93b0057cdd896a1d1090672d39339f4c1bd24963fe13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 823dbf2a3ad7a28c306b4032fd3cec42641cf41ed8d7cf3db7f36af2d726792b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3168a5c08fcbdea6d91e13e20f4e2eb551091e6ef068129a42e0013163814b2d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f55dc46e2b5619fbf9498eed44d45362b1158e8ec65a43ff49f23856a1528fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8145dad1ba5527156686b749148606bb2616250d37d5029a7978645af45b5bf4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48477a5555d07ac9986ce7849e9d627420d419121d88401c732871542dcd3bf2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a737ac4e361e3408cdcada2bb78198c78fd3d7f1120d8f352fe72dd07f073745
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4994ad33b5d74c93503de6c5daaf216072f280e208de838c1f3a73223c550db7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02f6be3fb99156c7e82970e23f70caa7d86205fd6ebf3f166ea51a81f15c48d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a57d6e969199808a91d982e78db0701aa725a89b02f4793f5a64e4a1c264e558
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1e638257b70e20dfd7a605c46c7118b7b88a7703dc9c64092d1582a1bb358a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2b7ddf2a81b67fe6ba727127f1de8e9ea1fed39a61db6fb44e05774917f2e39
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31ef350c0ac2a619b7e40dffe9d4680574f1282f99815983d1845746419a95db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dffde19bd069a551744fc6718cfaeb7de3b5436ed355a8e3051e90cfaff5bbb5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0d518a9f25345e4dd2c3ce842ad80f2501c18166ea542e9b97d663467fa330b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 017583ff4fe47c5619abb992e931f393dc67c73541c15c02048f404afe17b770
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe1100a7f77ee15092986b8914a1ad32ac4c455dba4061024e81ec4e0aa74b86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d2fddaa31e451a12472ef1d9a69c1caf91bac892a2450ca4850fde6729e22ee5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb9686b2ab0129a0b965b420de4c76543f88f1e19584bcfd3cb84e830a3d1eac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5fc6c09ca8322fc5b9fdf00e00e2d7f92e1d7a12762a6219cb4eee3fac7b4ca1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89a79a377b72e865ae8a54b78141a9ef02f65e7c1afe32c32379358db970088b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0de19a0933b494d1f6d4b61772293bbadc7ed8d19b3925e57c43efa9ebffcb64
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3065256b12d809755f640bf7075c2a13e818dd17828f67210fe9a4e168991b37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3a762d6018e716c14ccf921c020e987cc8b4e95e0aed603a997992951d6fed4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da965888c73b00bef8e19030e22ceac95d4b6f3a122813f9e900d0e7941889c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d7e7971aaf1ff3bdaf2c11bd16aef9803b3ab4d770b68c2f726b411dbd7b366
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfee496727b5ec71dabecc21df32d28eed4275eabb2d9f26956a5a7c110b1698
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b81d30155e0ed42f1a40e42ee6154e982d5430212268b4be0c2b6e5eb3ff3cf3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50aad7b383e8d59231124537cd979ea97249775834b13daf8d3aa0c83ea6ce14
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 162e7738d2941b0844c324f675863738b139d5674e7aef80759ef577309c6ba6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1bb8703940033f5d433aa804278e23297ee8325c7247dc69fc09656dc4fb7312
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b794ecb2eabeb35b2527f96291c6623bfdc4ec507f24a07f0c1aebf89b294d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a612124c2ee13bdec07ac38881b927522e98dca89a6aef957c074cf9bfb472a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 90141a762533591302abb61a51d9a306fe1cb6173ec2b772ca3dd45bd04aa0cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f30996e8fb3c33a7f445d3ea112ca300f4cae10124f44988deeddbfc81877cb
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              memory/816-81-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/816-595-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/816-21-0x0000000000F40000-0x0000000000F41000-memory.dmp

              memory/816-20-0x0000000000E80000-0x0000000000E81000-memory.dmp

              memory/1064-7-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/1064-11-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/1064-2-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/1064-4-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/1064-6-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/1064-13-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/1064-1-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/1064-8-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/1064-15-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1064-19-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1064-16-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1400-12-0x0000000000400000-0x000000000046E000-memory.dmp

              memory/1400-0-0x0000000000400000-0x000000000046E000-memory.dmp

              memory/3416-177-0x0000000000400000-0x000000000046E000-memory.dmp

              memory/4128-1275-0x00000000240F0000-0x0000000024152000-memory.dmp

              memory/4128-148-0x00000000240F0000-0x0000000024152000-memory.dmp

              memory/4128-86-0x0000000000400000-0x000000000046E000-memory.dmp