Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 03:14

General

  • Target
    5a3fb13a55b2c25ac60a5b9731dec4e9_JaffaCakes118.exe
  • Size 304KB
  • Sample240719-drspqstcld
  • SHA256 e665688f62949c935f75ec6c30383dcc6c43fc28cb47d5c3512493cdaaebcbb7
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • RaT

Botnet
  • vítima

C2
  • 127.0.0.1:83

  • ch4wk.no-ip.info:83

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    google.exe

  • install_dir

    google

  • install_file

    vschost.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3352
      • C:\Users\Admin\AppData\Local\Temp\5a3fb13a55b2c25ac60a5b9731dec4e9_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\5a3fb13a55b2c25ac60a5b9731dec4e9_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3428
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2908
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:852
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:2008
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
              4⤵
              • Drops file in Program Files directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2988
              • C:\Program Files (x86)\google\vschost.exe
                "C:\Program Files (x86)\google\vschost.exe"
                5⤵
                • Executes dropped EXE
                PID:2992

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            vschost.exe

            • Path C:\Program Files (x86)\google\vschost.exe
            • Size 1.1MB
            • SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
            • MD5 SHA1 SHA512 SSDEEP

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 f961720a68bc1eaabe99c12fdeb91ed3dd47122ec0b207e4580d117c89bc44d8
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 2019dc53c865a6d1ab3fcfafc9be3fffabaa582e5204a02dfd7d1b5b3782d488
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9d8f8fe3409a0eac361cf3b826ca0db78a42fb72aa118b8166d5ebe38f4b964
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77f0ac43cc1d42c097efde785ea496fea651197ab9e974e54cf8cfb332f09142
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17ea09207b702916a103fcbc7eca6cd80e45bbb49f820d0ca685a0ab37b7222f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8bb7a03206454ee8f2fe8fcbe3d692bee023409cbc8033c26786745462c9d19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89d1a520d26af5ca420bae4f349b276fe7b3e5334db2ae937745812f267c2e74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d551b036504cf684f2f74a5ae2165825c610d508c0ba2f55694a3e65c89d8f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f95fc97a17ee6b965540cbd8e2dd88bc2dc7409171f84ad94d48cc8b16a51c62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce37ead1537fe8a093f1ec9168f46fa3bc5a3b1b2c0eb8171d5ddebd82facd1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b070ee6ff71f86699ae307ed41c8e541a7868c6d0171dc34278ea158c3d94bd3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a964373fd538826e9c481106d3aa070206b755e6459f934384173ddaabe099f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fed3ee34d07dab2cbcb8026c4685dbb1e33715d546f427521a76015b307a28a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acf9c655877ae13bd25cd640523dca399bb4a5e650276fc48c0a5993a5680837
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f17aa5e1e8cdc239bddcaff61e499e5453997bea869b51560fc7a99776df82cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5e4c58f92328aed3e41cd6e4faf4b88d63b5a2f8aa91491cfd82fd9dc8d13a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b685ac9ac289f5bbdc52fe0f74de589e9f631c2c79913d63083c0185d942f5dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e16b25f500efa7599df00b325df9a40e36b703e39d0ef0c42aa9e8523456567b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7400beffbb00a08afa4ad0ff06fec3161095f1b9963403e2e08ab5afb76591f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 003314e15d7b5a29c1e2ea6ef71ddcd42eec4691a209af12e5768462cd93a2a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c138d4f7a26e86e1fbcea6109e1de7828e1b5481d608a2579fe750f02b810cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56d3038e3805bac3003107ec8f8f851763c1bcc61a8ec1716e35de71454cbaf8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4bce7b37b2018e1bf7485bf3c8eda013433db496e85548abef14716c8dd0fb2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8b8778206a287827109e4867e88cc28077914c75f329d68962c2018788fcda3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 891bb87064f7adfe18c0632afc45c4d35b12d1da3eaa7800c7fe2e4347b16e9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5f3e2fb44aa49f24e06d570603d7a22c8d62c9990e792d908b53c483e095eab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 285b0a75a1bf1953608857542747fcd4cd6a0351555cd122b08ef5ed3b7a8948
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4287e8c3f7065c3571177c8e055cd8a4bf367766f030e5e90fac34787bb502fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18c12c76f790920ca3a2b91f2c071f64191ee3ac87abf50638acb1d7761ab9be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f262d89bc469f3244f8194d1b2e1bcc86a5aa1828a128434018eb9b6ff53e88d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1ae63d9f24d4ced87639c8b146b4ac07592b70b5bc9d167de8fecb8ba68f353
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d29c0d46c28cef5babe7f06ecb87f1b165b611bc59ca6963c477973380271e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 790f86e97b6aaec10a141e8e348da918fb3dd305bec15c5ea4c9e7d8bd6eee31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 263e6cffb0f04198fc8f0afa309133e0861245791556781af98c0723290a4227
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f3ab4fe28488b455fe9b69123102bfa21494152d115d26d3e02d635564d5db3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8722ab7c9bc999fd785a99d67aaa9b92c30500ec2c1d38e04c963d6c9be7b589
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a706117ffa696b40c8d60292972d636cf78be2b2a2777307edda86e1887a6a0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5c1539fb272b951365be0be725259c70120b919b76b4091b93ad7af3eb10146
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea0517b7ca0e0f7b601f9acf9e633da4f681c69b86f71a015f809182dee72a04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 317b5ac1486367a8363fc2a782d39c3277f6ffaf2d15a74ef8ccef6e5b952dc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c96d80a1900b39d00f605ab43f283bc30912052f8ebd53b609e60fed92e313c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9762de75e428c609933420f7aa9bb4b84b623a4fe4497ace7816e11b6784cba7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47bc6fe2f9342f605eef18952a19b3e388e39cce850738e0bc3bfe4ee056c404
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 415bf57c558d55010112bdcf362bec92c5ad6d00d8edc09fe6e5ead0725adc5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da539bdb7852f31d329ea37760e91dff4c90faa0f64d676dc4d48bf02718f11f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7a4b726c75147a542a56733871f66f7cf2d876f29e0223a82d685c539c61fea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2892d1587abb9269ba54058dc123e970f6e7206f566bf6f15d7ce98219527c2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b1b4e6674c39f008d4eb798a9564c92641b2da67756d9871ab9c0c6e6a63142
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f547086efc52261a66f0cdbdbf51a7d7fc470c343c04dd23dc8ba2ae38444f65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a2ce16ffc0711a75aa5adf5c00c68852701f2a43df3f58fb933e25fc27b7f53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54e7cec4650635afa2d9ec3b1e082923e0cd6c734f4c19027078a4aef40ddb35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2e7ca65d935f1f8455f13524354f202c46b3514138c640e1b38ae1a9f66fd17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7aa78a07da25797d878df1264ee706f4572d7021f4616f2e4543ecf926a04b50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9cfd3b87f67cca27cdf189ee22dba962256ccaecc5d7d4450858a01f4626f41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4f3c36fc03d5dfd336f0c851568a8a01b5f275c0d89434afdfa035b075aef30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e523f2e4d138a9f76a3d3365479219cffb6efca1c189849caba6c1f951ae2e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 473a2bd305bbdc58cfd03f543de60754f29ad3e35afe26fd139b37b677103002
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3095a418f42c728788c070bbfc5e2589653c94995fe326f84af65857282ee42c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d9c68668f09a3118886545e479afc133560c89900ad885c5c9b055bd66a8aae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d1afb3d7389465ab49d22e31ac146a8e2bf1c437810b0ec6d2fe65160b64ffc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f1515a3b691f7633df5e0db70dd8bab3ee1f1423b403e597caff63a1bbcdd3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce1791e45780c25b27886fb71f7baa2e2f3389cc44ebde52d74d819fc68b04b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 091762ee2305f5e6e9f4ea40ca5de13a09934f1af43ba9a8d59a463ac6664dd6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74623447c9e7a6e87bc5853f613e4eb4ac95143530c70df14b8f4329f19935a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e583f9c057aee7b4b6c2889e8dae9bd8acda83d05b128a3796354321c1a253e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c69e3b114f8378fec743ad3350bc0d4e8c81e0276ce2082f753744692610c99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74007eff804c5e8c40f023f8ca894c87aaa1cf8d1f69d65c62211d1d21642fee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 115eac1443b17da3dd5724a6bdf4fbb91f735a020ed2e4810f5c8513f5e64439
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a775ec48527bf54e7f135bad03f82141bd0609ca157a3a6f8fd5476fe999f6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cbea1d6b2aeaa97489c45f4a54b9d5114ff5091f1db8f106074d648fa1af59d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d7fac9206c39a969956d8ebf58ef58faf6dc2f6ffc90a9d89f762a8c8fcb75e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2aa15e953d5556da88f4e73068deab1a9cbfc335a541cd9902eeb647e1a9423
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1db91f5cf21760bdb991dd972ee31bab8dfdde2744ee8d201d628a6830aa0c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad072e1de8cfd0456b68202c4d36b752094cbed3f9ed763e930458e976566f9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61cbcdccfc85730256b618ce042a0518f318e5fc1765e9850e52137262d66c78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fa09e41ebc3425a84751369de2d1fd9732b0cfcb6507c295e436d44d40a227c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de735995f256ba0936e3ffa946a30c10ba35a4133bdd3b01128cb2ec9ec496b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2322faacf20edb712ea05952fe03193497b09c42e8a351a12397ecb44dfb9c78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73eff304bcf89fe3318136dca041b5ce38454fd277a9ca8b816ec19446d94b16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2abfb23bfbec50613821eaa4dc714cb30cde6b998e35ea57ca2c7353136d2ea2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31652f6a85282debc6f8679236ee92c59dd0ca4f6a92c152c925602d8549e427
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b174452d97b1a2a45b55c16dcc579217b3aa7dcbd64e72a74717d9f61cb4754
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d99171ebd85ccf5fc3a766186e90153a37f733f6d7d2ae371912048f24dc209b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e20bfaa335eeda8d877eac385034b2d36d08d51037893430df50f39395c39b44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1fdbe72db3dbe0c79a4ba22ea4e689df948db596dd93a7cc1231bbf86bbabcc2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6ac6d97b6ef9cf3eaedcc98436396143dc5af9c78cac7c8c84a331d4d3bc857
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da9d38d9e15f130b323904ceea854df79a8550805d1bb85651b4026b28bf8bc2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6357000b9332e1d1395ef6745010919cdc65d90dc8df2f49802f23dc806c9039
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 485539c716c868771ad1620fdb1205216c19ebcfd589747def69818665bb4939
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4812d7b9755fb1ec9f6e3ccf1494d691d81ad3ee5fa35c488c96c4680803fb44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 643c27179f1c5e2d67119b32c1bc6947591330e4f8649331c78b3e5bed29dc6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dfd38a752f05e019b12cb8e20b3e7e1167ea231048984f112d171f29858e239
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0162df5c820cc98f67619ea0b5bfee338589f3193937d3ee5977adf7bc0a41e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a57a3824fa5becc1a2de32dd858b582be0fdf993aa3ed178848e4bcc5f418f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 addab494f5c51ddc8510cc764a77f17dfa30b1745845af217edd438217ed25ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b194ee4b27e7b7e4fda94ca6ea25096f86d78fc50819cda110d037a6dbe32c4e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab5cd9cd2e1f01115d016fe2ce48966d2b092e6010fee3ad3c2cbb206bd33cc1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de18506b65fc71783852817f79e3f686ec5dc5564bedd004c70b80c41e23e2dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26e07815380e0185e73a15bfe3ddb9aaf1b49b284c73d325ca4eb224e37e881a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1692023a4169e42b747fcce384cc98c078d96a035513749662fa277d35ed5bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b40648a073a26dd5b0db3daa931da7158268a66ea6e68bed8c2a197cee845e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6bc87f7539b6552ce9afe2e1e26af3a56924a291356a403a722454b28c96579
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 206927395bba3291af4ea3f0ea90df598c2d81c76c36787e9e5c1b254730bf07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ddb63a120bf467e7ffe10bbbfffb57a86253bce4ae8b0ded040d1e0c24ee036
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a25b742967934413c829cda13e9137b0e9ba8159a6c05303d6c5ba5fedc7256d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f63283ce84d142e961f721c727bbaab8b00ecff5af5a27240efffa7b9669a60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c87613f21a83290b654066b0cc3baa4721fd87ea66f71d198a0317b963bd2c07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f797edf04905277c7191291e3eaf4147c34ea1f7aeddfe069a0c472b5fd97f9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ebb3cd92278d35ba0cc79b9ffe38fa7ec4094c77805a48e5954aab935c54454
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a74950305aa0690149abf2df9e02a3eff8443a06fd0fbc97b3ff02946d02739e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5743590756947f67ee7eafe14e6fc3b34f3e678d032911c8f7a10e9e6ee568e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bc0df3e3beeb733bcbe1106a6f3d14056986b9a1d2c84c6268511c2f85e1bda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbe574107df109362cd922e1909f6af99034d1fd72db0e5070923938087d6e6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2794136753948797bef73e605777d54a6e56be3ddf69384de8dbf414a58d356
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13ee501f5579d772bfa8f2b66124be4354ab9fd6b7e8c0ea66e2bad37faed1ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 717757dd4b34f5609d33d89ac32afbd093049beafadf116fc9c49cb536c05699
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a25952f3c7ee0bbbb704e607b5c3f6ecd0fa43cc6802ef9bbf1e6a55e1e064da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0731bce40fbe2bad427e662ccb38ec7a08f71fde7bbf0bfd6221480f47b0a0be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44d85fee6f679b4c83f68df43fd1146fe4a1804d404dd71ad95d7442b321e1eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ef3441d676d7971fde8fd77f964a7659b053d321d120cc43253c11de48dd38b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57dd7a5ba93b7154cf1c244eb18ad6a51edaaebb484597137e8406752ddedf1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05c8279bd98ae03e6faedd9d41aab694fe5e3e6b9251ddc75f6cf41a50115c62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d8cb2966ae8e3a77e764914682b10e3ad5b5d7d7cad8eb439f324ff4486f7a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2493e6117780809c054a13ffa318a8bca081aeddac8a66e619bc1cebf88a161
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbd44bb90e75ba8119dc2d5476164e5a7ed245b8ffa2775c98ac8dcac4076c50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c93ff049d364483c8927f20f887f0cf7bf611bc3a14dac85c0fa9aea48b38edd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4566298a95f7547327b34e946bd95ab885ce0bf7543b0726a00bdf9a77ed5c95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a25228be60bd574e40e3bad86263d64e10c133ba424e1bc2c0dc16f737fddc3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 124998e46e1c0e3c25a64a8c1f3ca7bbfb877fe702dd1ea5368b9a9ef91414e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19971a48e3d0313d19e7614dcf00c8f4bef13bb625ff6484f82da93081c1279c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99b79f4cdfc993d5217fbaac2ecac57211b8f9209200d802da570a4c2e15be75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54a581f1f2b95cba55d86bba18872561696ffc18d15f59bf2d95da040643a4bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c728bd7b30b8490e660c152a89a9ea8bc56f81621de0dff04ebde76030dcf62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38174eb9dc4eab9a224f4af4c643067d81810154f443ca24c7acad32598ae5d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d81154d1f686c31440773a951b1acc777d8872b2f66d9bddd7965c3427816068
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43fd3b0156e953ce4349eda2a87f0bd9931a02679f7c2b79d8f3d237b9bd4b22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a6ca3a245519ea59cb24d42052d54d33d7d4ead8208a641b84934da086de933
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bfeda368f763f2e187b34019bd27945e46e5c261af3b2207d2b008b0c98c276
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b43ee043280d6c84022bc26bd3580e39a6ad42ef21519efd79ff7e65660ddaeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0de91b3db2548b663ae7dac0391b4d1f8e05fa1a6e84ea7dd5b73b7162c309ab
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            memory/852-18-0x0000000001170000-0x0000000001171000-memory.dmp

            memory/852-17-0x00000000010B0000-0x00000000010B1000-memory.dmp

            memory/852-1015-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/852-78-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2908-13-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2908-2-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2908-8-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2908-7-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2908-73-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2908-148-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2908-6-0x0000000000400000-0x0000000000455000-memory.dmp

            memory/2988-1466-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/2988-150-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/3428-9-0x0000000074CA0000-0x0000000075251000-memory.dmp

            memory/3428-0-0x0000000074CA2000-0x0000000074CA3000-memory.dmp

            memory/3428-1-0x0000000074CA0000-0x0000000075251000-memory.dmp