Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 13:36

General

  • Target
    67ca115819756a098b50577e6ba33a19_JaffaCakes118.exe
  • Size 283KB
  • Sample240723-qwqgdssfml
  • SHA256 f26bf97e6201269c830f9c7d0b9267f4c49313e44bccfced577eb504da77ec0a
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • mosa7ee.no-ip.biz:81

  • mosa7ee.no-ip.biz:82

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    jax.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3416
      • C:\Users\Admin\AppData\Local\Temp\67ca115819756a098b50577e6ba33a19_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\67ca115819756a098b50577e6ba33a19_JaffaCakes118.exe"
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3324
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          PID:312
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:1720
          • C:\Users\Admin\AppData\Local\Temp\67ca115819756a098b50577e6ba33a19_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\67ca115819756a098b50577e6ba33a19_JaffaCakes118.exe"
            3⤵
            • Checks computer location settings
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:4228
            • C:\Windows\SysWOW64\install\jax.exe
              "C:\Windows\system32\install\jax.exe"
              4⤵
              • Executes dropped EXE
              PID:2856
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 564
                5⤵
                • Program crash
                PID:2416
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2856 -ip 2856
        1⤵
          PID:3540

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 d228d1b6d9c6723209f274c567ff36632c4f9336a6783accb1d2d70f1512c8f7
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 e3d5f6e39f87be23062fed13079c24cab6cc9cdcb0db37231252650581fc9d2f
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab215ac2a7dd68bba48329d033ec56170e79751fd12c0fd064663fe9866047f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a43010edd54a8a95a135295d72af102c999bf02a494412b1231ed0153e5f2d91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3ea57c24451cfa046808303703bd7207238dd9d878624e984052f0a5a1030d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1aaf0f7aa1d78050350b3a794691c236c67cd2b4d058cabc07725c43dcf38fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22a20e4ab2012942f377158cbfb76c3b6d86a4d71f606af49340e0c5d23297b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 214404dbebf2a5384de01592e97222fd15072c7b0f3a96f372a9b6cb045ae3e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5da76fbe69c40c242d0f66ef17fd04ef447d51f2121b05941fdb556d77f49b8b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 971f8fbb928e211fba7d12421119c566681f9f4fbeec89ed803c218c3b808ea7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1578e938d077db5daff3d5e69d519af569af50e4920d75d2ea43adc238707ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6711aead3b90fbeb5a360648374b395b4c66e5785d5f9b5998792cb24c27febb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e85334b9756956e4f1c0080438f26c8e905d154a86297f76bf5391d25dfe6321
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afea26759f12a86d40e521fabd20b919566183b9ba6f31713bf0c210f9562405
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c913c595caa6154d902c8905c14ce0d71278d536fcf51ceb8b6c02120b1cd06d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 493f42a61768dd064e14207ea4c832c40e1839406e1d1a1e13b5323d4a727fbe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4a751b22deef16ff288ee9bc56cde65d20c80453e9988d578e45a1b806188cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f4482ea68cbb1a39e1a60d7ec779a3fcbc4c8a9b19158c031c5c814fd056efb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2eda940989ce7a08a4eb768389a73a9182fdc60e18b0a9ba8acec29cd82be0cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 561a979c5f46be3c0471fd1acd86e6b4a80300504031dce76c2fa88398ba5e11
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a3ef66de6dbec3c2d73efd6d06ba78abfe0bb319e203b1dac228f79e6e070a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7583356b2e668ce77e44b097aed9737a9af37a583da07e08e76abfbb4fff494
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6fb4aaa2c3de3d1704fdf6e4a31b7bc83991fb65f9842d3f94c127f68eb5e2ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13e8233397132465663ffe607ec330161d4d9572f45083a460b9640f85fa2c4d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3eeea8731eaa326153623f690f0bbcd3ec4e6ae69b1cfa1769efa3e2ed9a3b7e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35c62fe97df737f4c35fb61076cb887f7e80b58af71d8c855f5a24a9b07cd384
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 05e2876097a118fedf93409c3d2c6680f0b0c21a0667b43c5f83c9b48311da4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65d8caa43e3538c396d36956a31c03b0cab5bf0da02eb1fa3dd718918856b46b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 04161ed7107cf66fcf825234c95fcc9a13e3c4dee632071e8ccf1ddf93a3bdc0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4eb27bb917dcc7f9b1208f7ca0568cce5827ce094e70b98b05d8c9a5c80186ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b6eb318b53a1953a273c029dcca671a2f98082d08fb1fbcb85fd9da196825817
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9b53aebe4d147893dd3bdb6af66943cb8db2f40c1849603dce813083e9bd655
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd33ad21e6840361b2be71c4734053a14c0c84a3101f394b677dfb5f3a3b0163
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9961d4c2e6d70c7e8d12995d786996d0bd371043e3fb1a3059e8ab5779be13a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc80afa825e5e8b8077820b14991231ebba42e09642c8c2096a471cf70378cbf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8f434e3933d3f0eb9dac89615d3e1c9f15ba597f0beaf262ba5388b658fcbbb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7aa9509cb5c2ec9aef6e65e60b19e1c75ebd36c985b496ba8c7959ae3dd616bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b230e45d3d5f862d74f15d30ab04955b5ce9e22f39ef0bc636ec0e0854eac85a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 830636a1496d3ab897b6797d97f824ca73a22278d8a585b2170b6ffbcbbcedcc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ed82753b27bf6d1224ad6b8783199c8ee5500d5c86ad2cd5fc6285cce37ecd0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8494127e05ecfdcd92825a61b349bbdd69635890951b02c42f3476f676f067a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec128ebf827d767af01a00e950640ff96193194df4239df512403769e7ffa590
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db36e3b4618545be1cd4f2c6c16bbbce899ec6e5b9e2a38feee858021fddbfc0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a3a771d1669240cb9dae1e78eef8ce4738a10cfc51091067c6c7e03e7fdee2a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6cbe2d1b6f827bc59196e19f2b6bf0dff484b8fd47e4cebdb973861e8615c47e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2a6ca87871f9c33a1dc72e79d6f6e26fb2098b559556212424d86e4acb89aa44
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f1d2f8ace7ed51648ceb648096ad9c8be63494c1551d0146c7f66ff679729ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93d7ed399230fa902ab08ba1014f1c155bc9891496ae918f78c6b37bf2250947
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6ccef48fa643c4effde5d177ca5cc00be374e558e30aa90ebf9397d85ba3754
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5ea63bb6327d80827fce7655b6b6535631d3940aae7cf35558ca8002b325ee6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5e0b1fe9a0c268b81833aaab3d08a363a6e8a1d7729a31bb9a42568467cecd7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11a7e61ea61d20c9e53a616352fc96e0f0fbb1e8ecd46b6238aae487bef95ae7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f78f8630de40bf0cd9bc014b3dbad93ff2f7119bcb13c06f4cf09f93ae2b19a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ed83620d7e9bea8733ee6a68010cb16a4eb08168ab22a268102bededa56428c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bbb3a7faef162d338ed90a14aeaa66d41a0e9898ca9c42f06dc5088a5bc0ec9b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ac38df7ff200725702f301f54f18db054e4265e62a6cb679c5ccc80685201085
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a82079bc636f6543709007ad41af0e1988e6378ff4cc9532e7d400ab820e1639
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87a98e0d34591cf542fa75d29463c14e43fa7ceb10d10a2ea01409c2d5c8fe23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 657640bdf06422737a2efa8ee3b0feb7706d7944b278099ec994c5ba290c4100
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e49a1f195c110b849c176939bc45ba25865fa2d5875b728ae6aa6a72e290fc19
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aade3e43bcc83186ec385d2cda8732d61f7adaab348b4d85788da7ad9463f324
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 513979b91e173de64064705ec3d4825fd8f0df1ac77c276d4db6ed7e897d1243
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 51ad97aad2c1e583de5adde53fc1b0b11c61a34a65c77c603d70b84a098b2e93
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d3c38a6c369553fcc9987e09781ec5115bbc19dce22b9d0723dbb2266d482cd3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ccd6eab3c6fa592fcc4266ebbed4db92feb50091ffa9f9b668328687d53699d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f273ef994f0be69a7e3832c7c2bc81e45fe372e5d4204c4b7761307427da7408
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ed2876600b96594b3e4d9910f1cfba37065b18b8631ef73c152da57990e3db8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d51d58db579c5330634c9a99f7edc9c97ed66e0c4e81699acdfb30cc535656a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f87acaf98e05ef786717ad4f24e71e02d668cdc716bab94b166b2a61a9a553ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 543e7566abecaf8887d9612886334eb9c8c0a1eb822184dd8a715881abb03179
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 496611be2910f606ebf6d9791bb6a14278d454fccff40815cf17d6ba8bc73cb0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f3f7a37e47f2a05d5fe523854b29316d5faade95b226c9843452f4fa77986bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a89234c6c96d39c38e5b9b20f29b1e95a42b92c1d60f0edab34b912df7ee8b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fcd8f3399a57e8513f3f99805e602abecbfec71fdc08891d82663d2e87735eee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f37209ab6924b24b4a8f98675089243e9d77c90807c7ee41d77173a3989eb31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97c18dc3c13fcd7c30d694d4bfd3b178f55e3946913b2f765c0819cc9e83e43c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a06aeef8e4b355a840aa57ec7ec1c46bcea5cb524f0d2d8a34076cbb12e7dcc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 576a6cf6f636cf284c87b34a6d58b0d093702350ffa3be6d36ad89679a75f56b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a8640d2f741b6d72941da360eb4fab87f203d623f6a01e24126ca2e1193e973
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c72f10935020b9174ab02454e19b7ed19de0b5bab03a0d4947bcb545fcf9964
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd9baca448deb4c992c87cbfb592e348d0c86fdb5e0a6fa272c43fe08fe60017
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2e341e671546dfe57d153581597722757fe59e48cebd6c6a769a104082f3385
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f5b27f90db6613d8793afb509651279699f01ba426db7e376595df0197cb028
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38a2a48be2a8a5440a6762545ce4bb594ae2302bf6ec876dbe921cf8e16752a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e510498783533bce5dc276312f28835a4e056f2dd9c9f49091e79fccbf7090a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6555cf8808fb762ee5548eb9f691b425a9fda3fa4aedc627811663403d6d9c9d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84fb343c4e400a63948e5ac7e584af19a5517b8423ab804e52e54f0e0021919c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86faae06f096c8fa7ddddd73cf0a41dad7ca62c43b6134597967c6a1c5fa734f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e37f39ddbc822f713e2f7e7e9427270aba803a331c046d54614d513a59f602c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf0faf5773f2e44c1a920f27386a205a68b854a225ac1c3c084c30932f29dfb0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 64b9cc53e2878243286f72665d50687a4e3ce6b2325591e83f550aa3dff5a4f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9fe2299e44afc0dcc26806ef31c537c32015e8f18e2446b69ea1af32d2f085a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66882cd232b3f24bdaf7b23a3a33e3670904eecb36dfdaa843b98468585676dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e50d690a0fe2eb6e5096b0b4dda830a2b58d99776c90aad3ca6996065e8e2dd9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ae550d78aeb830157c327aaf07f12f30e4dfbad8f56e197743f4b6c69434290f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 651ba9b1fd0d97605569b30411dc26d7c92ee0cd8e14a6c44bcc52f0b3a0e01c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c8ec48bc549888428ccb9c74995b30458bfcbefb86fadcba5636aef0d5263567
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afd91b4bdae0ca9f2b813866ff08d289b4aaaef3a89b4814f14dea065e3f7f09
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c24797807df1e07079d1ec869c83daf879b82479432013efdf918dd3530461e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ee1eb497bded48d549ed24ffb4b4d27214993c3ab6708f5caaccae0719ebb9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5cb6d746ac856c1ee9281ade9f4725968fe613a4d8b90875c875225087748886
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b01cca37ebc4b5b4a51df8581b00040f1eaa75466c51f97d14fae08240c1764b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c9baeecd8d034ae681d78e0d42b001ba004f4bf079cabcc05bc36fa6664038d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 80ddc9bc0dd7a4ae7d3210f03013106a2b93aec3e79a2c81da992732b439cac9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de3d5e01aebc89c8048b10c0d7028ecfc71cac9ec95111f2ccf0113ae2fcf04f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ddc1b421e5061a056612be0e7a9b94ff29cd437a0efcc3600b3c837de7c92aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 242089dbe85d41367821249208455dbc0ecf8fef396e330f555c16c8ffb0209d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee224c1f15653b4200e9b799f9b9010dde93b5405918147a0729593f426bc21f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5027cb253c73922619d33271bd1cafcfa38fe06417e1252c29a5584f6581c93e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 843d47bc62d6bbcbe7ae6e3de7ee678a255f079a035da7bfb51bb690e0c77ec0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a19727cde9b6584a3a7988b4ed57fa6a470579745bec843a1ced17eaf4c811e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ff807aed54b567c7737fad9628ff196f235dca736ed0689c150fe648b4d2a3c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ecf37ca79b78d434a04ce13c67f11dd802ed6b8dffef2a0d0fc878a7063bcf48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34e29d6bee56dbb5853dcda96eff1638cbb618f15d7d0f3e5acb68062fa18666
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8efb218b10ed04085a84252b2ec308fcabf2b931828fcd5bca08d3736ebf6642
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 561e3b9831fa98a23e620937478d67a1ca386483500fdbdff0fca07ba70f2902
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b814f33095ec4783c390b7090b1d845c2da8079b5539d4f2617cf507154e084c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d04ad76363cc383310786b062fb882fa7ade6670f1ac9b51b79b04b49312c49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d19db19dae2bc649923d7906c15055d1e238e5eb42c8dc18e54f5911e3a9a96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af20c48a6a8ae69ad0ea8022372f73509aa86eb424208d195c070fe80aaceb48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9356c5b37ec88aab6a1ca86137625c670e21876d41688983433b969a8cf0cef9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4fcc3062f63c51c874a5bbd179d20c44f8f582a0b5ddc28fe24a17ab95b5419
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60cd9aaf2cb848dd2c18586e58d833089d286d03c80ec743a59beb8543bb6880
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 581afb1cfc07f720ae5aaff6d35db5eb3aecb7034bfd0ebcb70bbf6854eaa5be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1eb671c2b9138a50505164d5d7a8cb49f7e72b8d727f6ca304cc38603ffd685e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5da62959878620e95025fd8d11fb0803b6d9664a2dfb7b346c92d2e7cb62ee8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa7a5200cf6e2df557cce50016f75546f2dd18c33c2f9059b726a5e036797e9e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7afde1b625bd5902eb26b93fc7390e0845dc0ae3a1d7346ccd025483652a0a68
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 05941bdf2cbdd3e90071e181bb1c129c16d494ad07df4c4b3ecb6a3557caf53b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59df1e8abfbb9331c4cde48b16dce026664a1465450164fe986a3b2b76fadbc6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b138ddec8744cce4b3f469f1f4ef90fde938275b59eaa3a6ef91786ac6040e7d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed0f20862a55d4e0151ea311a2e0a1de01aa64ee147eb235390fdce984227f0d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e3921580d9cac498d3004ee4c57fea40d3a931da2ed84cbc828b11c5e452a4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e53d74841a04bd21544ccd505482c60d409f4727e3baf203a616c4631d74682c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2811ddd947d9c9ae9e1e0f1a0c46834dd1eba5e96a46cc9093c05cf928d5df7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 80374347343051a23063dfddbf5cb7f6ad4cc7243aa7a3bd21c135d505bd0826
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d4e0f2544f6b6c64471ad118be724c90a5c65d0f71925624103e4a086c988a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a19ea86996fa54564386d3ea3bcd835c009da0b69342ab7f8a89e0c949734ddb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42417e78f0d15b8cd3d055bc7479ecc15f2f3f37ca01ad0970f41f775c8db24b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84dcca00a74ea3325d809232eb43e39834381cb7725764ee5579d20535247736
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              jax.exe

              • Path C:\Windows\SysWOW64\install\jax.exe
              • Size 283KB
              • SHA256 f26bf97e6201269c830f9c7d0b9267f4c49313e44bccfced577eb504da77ec0a
              • MD5 SHA1 SHA512 SSDEEP

              memory/312-777-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/312-68-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/312-7-0x00000000001B0000-0x00000000001B1000-memory.dmp

              memory/312-8-0x0000000000470000-0x0000000000471000-memory.dmp

              memory/3324-63-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3324-6-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3324-2-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/4228-1460-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4228-138-0x0000000024160000-0x00000000241C2000-memory.dmp