Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/07/2024, 01:16

General

  • Target
    4c35f5d0e74d5d4156a50e1559018cd2_JaffaCakes118.exe
  • Size 331KB
  • Sample240716-bmw59a1cpg
  • SHA256 c753e9ac17c5d63e7781b2d83f7d2b189e7ce934b9b16bdd1df27f4e21ed2323
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • bouwahi.zapto.org:21

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    winzip

  • install_file

    windll.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    15-09-1996z

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3456
      • C:\Users\Admin\AppData\Local\Temp\4c35f5d0e74d5d4156a50e1559018cd2_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\4c35f5d0e74d5d4156a50e1559018cd2_JaffaCakes118.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4380
        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AUTOCL~1.EXE
          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AUTOCL~1.EXE
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:920
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:2148
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:1824
            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AUTOCL~1.EXE
              "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AUTOCL~1.EXE"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Windows directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:5060
              • C:\Windows\winzip\windll.exe
                "C:\Windows\winzip\windll.exe"
                5⤵
                • Executes dropped EXE
                PID:5012
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 700
                  6⤵
                  • Program crash
                  PID:4584
          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AUTOCL~1.EXE
            C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AUTOCL~1.EXE
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:2324
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5012 -ip 5012
        1⤵
          PID:3272

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              AUTOCL~1.EXE

              • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AUTOCL~1.EXE
              • Size 276KB
              • SHA256 acf53ea7c9ad357519059e5bd4185eddef285b1193cd3ea755f002453b42c518
              • MD5 SHA1 SHA512 SSDEEP

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 d7447761c2e386f5df211ae5792637e5874ca3b7ac044fff7100a9455ed70d1f
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 9d2c3c5fce136422932fe8534f28e41d591e3ff7a18f1464e16d2886038cdc4b
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 81d8df35eb11bbc4087f1be8b2c797bad9a6d2c525af068885b3ac35bafee196
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 973e44abbcd6a97caa6b265762a8c022c70e130b4699e7ae16ad214b8e9a21ec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aba0b0dbbd467357560b3fcc1a90147b511c865009d351b7524589ec22672e79
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cba1d03f204897f284eece154716d8b0d38892c1db6528dc223c7ee7b0abfbf2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f74d55a81e63fd7fd7378023459b7a8fcf2764f92a2bd62b65bd4f61acd95873
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d09f0703d1c7adaaebe96ca577e20edad91f5849039d8b9ed394d30e0e7293b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 855b9e69e21ea654aaa8c9b582b564afdb6073da4c2187c6b90bd8dd5ebfb1fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef4964b6e1076f0d4b40e2b9c10d0bed4416fd716966db9e492fe598ed2c5717
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e51aa05fb93a619ab7509ca4ad26dd408cf9591a3c72f1da381111aa032dd57
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 06c601a6ac1cdaadb8253c457e7148eb82042cf967b6b11c2387f8e2e06046ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec29ce3ace25bab7d98d5b48b7abe546e22d15fe84796c517b02729265d076d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4c93d9ce736ca9de66c13fd4ed5fc36005601c85cb6fbd22f20a0fb153f8858
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ccc01f6a14ee73ce2b7f8173772250da5a5d36c5a0cd3b0bc64ed739461d39a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97ba8ba81dddeae234090cf8b7f416379bdc2e49df14f167711150e394644622
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7841bcb8b569744c9481a63240de0eb288e950135f2951bf121efd3e01d0bc8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9b86f711bb86791184dc378f62eb102698e18a5f8c84af7ae9b024d0af996b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7192f306e6c1481a23f84325339ea764ea925f51ae21e59b8608ce890925eb6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f09680f76adcf688739edfd2c1fe51e5ef8b71dee7ab8addceca0c909dc33bbb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b61ee2c7f33a973a0aac8db91c877e1401c2ce36083d9cda874fd42c4bdd98a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2b6cdb07c6d9b00b4e169b6d9b153fccf0727dd9cc04e01df00612eccdf7e39
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df3767d08d312d41a7ca94599e6349eddc3516c18c27a1e48f6fd181f43a731d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b37f4e31b5ef05bee525d6458b9c9ba378858da1ac433338c7da94423196a9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d25a7101c448922dec69260c446891194d9c29127bb0690551d52d34b7d77b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c079edcdca6ef0c1f8b99f7c40c980fcd98fee0dea7d7ae40a52dee1f44cc01
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3962c3d29d66e70ecfe76ab7687383d79910a820e79f6e65306cf8f309770da4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b104ce5fdcde34e7eb7f5601dfa3bc42c8a6279ccf0864a8ce5be55972c7e83
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40c778ba1b4104fac890b69f0ee5bf30f0563d90f84a7cd4fa58ea91f43d478d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56551ee0568cd40d12a76b802d9b5b661c6cfb780674514ac323446c9ece017e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 096166b32606980e8a0f4115eaa5515a05f998a61ef648c8498e3c20296951ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ea5c213a2884d0218313ade9313388098d6c66fe4951a3d232f8fd1bb20a2b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0babee08340fa9ec105a39221b3817c17d406d4eaf6f0d27abcee6a26f66326d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1696e1d68703e14b85d0812ede12113d0b7eb23d048a48ae26397844f54f703
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e2a74899b830fd00cc5402972a2d3a03293dc5fc5571ed86868e5a8f205c445
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f7ba76534cb99f55c2b5d0e385a41052d9d02af380bf1a450bfdaef6ec46369
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ec482bf799e76fe2cce4d516fa1bc4cdd0e507cf2e48dde9810a91361792b28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d15d811d2a1c8d3a3a8a48d89cb2291098f30c93ac7e7fc9c735c9d57bba0cb6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de0718a2b999c9f92a4b3e6b4541b59fc6f8fa731425e45ab9067fe2d051123c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c0a1e19751845b78a80426975eeb6d782fc26cc1efc163ca073788ef42efb30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70a6506a1893318b5fb7038e0771da843867ee2772b128cc4ae1a52acdf20927
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4335084c7b7c57510516dabf5f6bf048783af0b2394e847ec27174d98f8573d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d2c6cdbfbd6cce2f37cd2fc19a644a55da19f7da2c37d7a8cd2089acd71f98d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ff52f1e96a62d5287dbf10f0a043ee6fe3e9310447ccbdeeffbf62802b6c614
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb5090b3d943f307ba41134a5be202d0f841abf3d49a91ef857d476f264e4b98
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc9f4a5bbfb23e9233580fc7fd355c32050955b078c5524d69f4882bf031aa03
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8dea6f5c0e07e0720d140d7b8a22bd725036a7b9abe49a74beafaedfb4bce755
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3dd50079093d218e5feec635643d1eb79bf7d003bca59225dd560638bb176e82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d96b0c22b21c47dfb0a71907a7c01245c2a82c4a644040c9e4050857ae866e4e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c508e9b01f838a0c69a5d034110d05ba6d4ff24d311fdced1e79fa3c4da9eff6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f60112424359ffdf20103862934814da696f6b18a801643d87b1bf1b97a0adc0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 686313a1e7687bdb17fb68c929b78ae2117dc7451f05dd482b67c92465c28262
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0d0225e4244dd9cd52c75ce57bbaabea5f12de9d4dbd223971ddbaf32706eb5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b302f6d7ea863020cb72f0550e4a175d188af54a6ca2a85818b1ea573a4007ec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92c233dd0a54db20f6a4017ae158666af29ab3086c76862d746b5693f1c015c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a66767bc99260337d9c22069d4921933da11a9f67597f9b4087f466247696319
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea7d8a65455efd7dc0b630c997026932c2f4e887ab92634937189abe29214112
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca2627736c0db5343248dc2ec967869ee738aec0545405ab74228dab4a24c7f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c46373809608672da4c6acb3657f421ff6d3205cc8f56a9081114465ea0f370c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a78b4e46f40db439b8b70ce468e30955a364195b6581a7cdec6ab6c1d1f144b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ac034f56056fe90a9bd8012839084ca3f2d507a4865f2080abf613d1a46a6dd9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2a19d0fafe8784a58c855cd569f82686661a6457e72d1715a19963ddbbb8957
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d58035078d25ca5db843c67537ad555813c95308dd13af001be45fcf005d6ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c22ab23cdfd4690ab63b090ba3f6fef371cb0c17d564f348a6c907ae901ea31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa52a1a942e362273908b9dbd3799b44619550ffdb8ef72be68ed270fb4ee087
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 597428e264a668385cc1b141b5463bfbabc6fe5037cfa4a7e5466629fa582c64
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e76c33a7efd76974fc5b0321217bf2f81edf6c8ff3bbde486148381f830d707
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be278d9840cb69a06369d0fb2705244108c751dde5219ac036db1724ff21d7a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8006c346b80190fb85f51dbc4895dc5c4b3ea361b7a18a9010c8384c3797d718
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 066567673dbafc3d3bcad9d52e84b5f5bf64536d4d3313cbaa7ffc5804b5b1ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba118d028c3f9eabebf061630a22cd1f9f2fd65749075b948b6900746910ae7d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4fa721f659ac24de813cd589edcffc7c522687345be518ad006ac36d3b2cb456
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffcfa5f0f2efbbb999cd7eac9b358696bcefb2ac6b934dc62d566d2022f727d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 def7d1bce6ace6573a0108acec43c4eef4fb5808cfff33c37a4ab23d8c13b95e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be11d235fea76edf40de7f86851a7e67183209766b4ba4241601846dfa3d7523
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 865950cb13fe16cebae268d14c5cdda38d08d9a5fc6f00f1ba161d9f1da34e4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a390769efbde959d65fd29450253538cf85c45dcfb3f11d0bdf0d0c1f04490f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bccc9bc2feb872c800dd16c2d0eacb0956b1bb8cf58d2ab1bb43b165834a603b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b25acea3df2ab8b53eb3f970b7db6abc0aff16ee2fcff8034fdde81f69fa802
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca98b9eafa664cb750188ff5c8da9ba848b7bf79e89fbf55cd91907e88352d74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86258fffea5d61392bcdf2723c55f9be068269d6aa8448f58e11ef9810b1ccf4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ebe2f54a1c70f2afd43a8201a10d44b013184a0616d5fc73ca082efe8d9ea677
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c6bc4de51a8aa9bd127d099e372d0cc4dcf47460e5abf03fded2ca956134190
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f7bac50ef6cf06855db530289b64364905ad8f24638479b863e2b6965b7895c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 223b14f16fb949a04dc009c1cdbd45bcc5da55efeb58551837372509290e7957
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 400a7f81e33c3aab5a2c8e8205b04e5ca76467b00eb7866a4ebd8331caff4dc1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 475b172c0aeaecc16cec98ce7ce5f973d2f5945fbb30d1e48505df5069807087
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ffb7918128150a7d36d260891d6924efc363e1313125fa90ddd6e1900894f8a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 457065d5bc067532b2325ac31f47721c51f464368924c68a2147ccc579ee123b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 03591b3372c8e287f438b7bf54ec8b7ecf0c999ee773874d25cd38058ce8811c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc8210c6958309ed1ebd331850a3e640dfbcf2960b26be70844809683e53e79f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56867a225a6052ecabcb70b1ab600d3c31f845c6598c7b11279d9b55e2917c45
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1430b27f66c9d269d49802204e80d1c399c8b3bf3455c9a958f6931d91ec7e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb0a1f5fb26371a50b626bed250936f244d82d702e4213a6a50d8bcbc595c314
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1119a64c21f8bec08270f0a6880c8d5599b4f9ef1b760670b42e19efea66a6c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1d4a53b8bfb26858081320b1f141058e7a135b01d084d4ba58e4444478067ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a2d3c38a54933d7b8ea3cb8cf10f1627172e03e963ac3be774d206815950abd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c395fda8b801170458b497cf7a7df7f921ba511c30184702a83db1b941222db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8cc24d8c8b0caea2761ceebd4c8add0c4432d37908ba03f06eea1401c97084b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5a5c6fee41133453297ab1e20f6c4d979a985e8130c0c503dcbe369c7cac7f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69d0ebc27645f062fab04ad9353539c3dfae1f2c0ea47c26bef5f379e1bb58cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36ed8ffcef5a5fe7dbbaca567f3687ffc726ac0c9141a2d84f358cc34f9f1193
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7cf2c07e67f8f957ea928af75383522753131d2bea2ddfa8828a4e191917dc21
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4035274ee16b5ccd846067fba44ff7e9b436b56cfc2dff368e019ac3c073fa0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35c8daef1dd7836d3ccb30d30152829dc2276fdd97362d1ddcf3162e70a279bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f16fc5ddf0cf974b49939a38548f17c99202892fc2c4543f306c8efb77e61026
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f9db9124335a3cb658270e9bcc2e4d9d48bbdf32d704aa9b90dd11032b88804
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f020fd3d4a35c7352d500dd7ed1502fe93d4fd42f89a9fb2ab7d926572ecd87e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09928b7669d026681478512e9275222cb15932dc24d80adf41c4fc255b1ee796
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e856e5233b7430ab1ce57657a83cf09c6cc400a16d1e8d1042d719309d1c3d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 265239e117fafdddedd013c77fd46414dc705970f7c5731b19bf86664c73b518
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43775cc7eb45f92793e9a56ecfddc14a37636b884f1938f50f67afa0c978e5f4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d12ad3fb9760dd7ebcbdc2d5f5a215512d4710fcc51d5892b5b53e5bf306ecf2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85a51798231d01f4c27b8f4124cbc773f18822eeb58a8ac2b66058ca77ab2357
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c4a568b376e62ce3ec44b694fc3eda5042d44d2018cf858cb33745a176eace3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 921ecbc44bf65f974c65340ee5a83d90c7276d2e7b8f743d01e8c4ce57620281
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb8a429be78985cb053bc07b75b6f97ef962a66cec216f0ec463331d973768f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad08515134a7c8ac635a7f7382203ae1e1f91a7cd3fa83debf22edc5d0fa8724
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6fb86adca78d77bbbab6cb92e178a4efd9383ad9bb9f9c79f09051e746ea907a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e760d210744643a1e492cd2dac23a412ae68d6323851c8817d300fff2427de49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50a1763846c9c28247f6052289562862b6d6a0a8597793bf136bf197028cac08
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41a9e72d0816979e5655ec2af53547908a731ef86c628b8f379c99aab03c33c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36b5f92b2c2e76543f60de75ced32d5b3f297d2d6dee15cc71a388754aef0eb9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 976a099dd7ec3261eae14af59569f1940b893abccbd1b232f9df003c9e3a80ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dec361693b1c3b4f51aec7ae1355e66e8121c37272a1b05d7fbf7d3fa16c72cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77f8f706ee63e4ef6f3d1fd9e839cae3f8f7d9372662011b16717c51ba0cf2d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e45d4027be04590df34ea7f53b7dc05e45e0bc011f1822fc002d0c349a08ce8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d90d1ade91b71550448e2c356bf0c6ce382b56e43cd077400d32d3321777315c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48241dfc8db6970dfb1e63e93ef618c57d376a76ce73e8249f5df389f05d5b49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c663c9b7af95f334da1dda0922cc3669213e2e9f0e7d01444927a8270ee1dc14
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16664e464fd53892f494a08f23c4a2fa52da18661e6007b03782cc17ae906804
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af73c98d343cc2f3efe40a9b4ccddc5912a0bb297638185cd16fab089f343aee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 292f32d9630becf08caed44093055010b33bb6baee1eca4eddc2aa9cea18ee87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 deb3277613b3d94fc5eba5d1c068cfa8d37db1c34ee93ed8d967b90ace0059e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f70df6c69a027973684b6fe1a054ad6bd16314b748e438ce3e2bcbc99829cf3f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e4e34133e62c351a0e6e0c036286f69904052cb37e54a7f93fba18192175a42
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f9c41018ce784afb446d067f2be348e56e74cba54190146629ec678209df9b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb67a4631d97904c35e9e8925bbf50e439261388726e612826ce517d3dcffb62
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8cbed29ee975b8ce7a4dd155395fab40108b55bfc075be728688e83a2243b8b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 278a01ccaec1d26d9caa32d974b19b955d6a570a98dd0e682fe1cfb0cfed4698
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              memory/920-145-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/920-5-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/920-8-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/920-70-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2148-836-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2148-13-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

              memory/2148-14-0x0000000000F90000-0x0000000000F91000-memory.dmp

              memory/2148-72-0x0000000003A80000-0x0000000003A81000-memory.dmp

              memory/2148-74-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2324-171-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/5012-169-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/5060-1065-0x0000000000400000-0x0000000000457000-memory.dmp