Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/07/2024, 00:43

General

  • Target
    6d78d687ca45b4d50fee714ecab738c2_JaffaCakes118.exe
  • Size 388KB
  • Sample240725-a2wmlaxckj
  • SHA256 3bd8052c3c45b5e844de0e2b9be0bb3a737d33454902d20104a6f745e838ef81
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • angel00.zapto.org:81

  • angel00.zapto.org:82

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_file

    rundll.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3392
      • C:\Users\Admin\AppData\Local\Temp\6d78d687ca45b4d50fee714ecab738c2_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\6d78d687ca45b4d50fee714ecab738c2_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3256
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:4152
        • C:\Users\Admin\AppData\Local\Temp\6d78d687ca45b4d50fee714ecab738c2_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\6d78d687ca45b4d50fee714ecab738c2_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:728
          • C:\Users\Admin\AppData\Local\Temp\6d78d687ca45b4d50fee714ecab738c2_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\6d78d687ca45b4d50fee714ecab738c2_JaffaCakes118.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1984
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 584
              5⤵
              • Program crash
              PID:3696
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1984 -ip 1984
      1⤵
        PID:4868

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 3bdbfbe9db7b9e7b685f186156701d0e27e2844ed80869bac3ed22fc71093573
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 a28f2cd0a0ada622861f68734ba916ce46be30b513581a69e12a184797484e0e
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 813fffe4624b0e33ca378a53533b2c1de4a4c8215f87732b2a70dd2d51be0c04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a44edceb223a69f89510c98dda163af2781db3ff4513d4c6a002ddd18973bdd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f6d8d79ff99c1b80de9a2c6566653252db5a1cb53d0685ef5348d1f240ef74c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 428d1b64b6d0f4182a56ce3fc59b2a6c89662becce620bcadd6c576988a437df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7350404ba293ec1c1508c94ebbaa97d5126abdd1d362c7da9291956b55903410
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e708767e936687cf90d16fac3a394978450308f1cbb2431192d18e3561886b2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9bfb63f767350a97738b7bb969195bfa9a2d23d0c31cfb216ef0d1189ae8f67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f16cbcc3d3157e227d74f1b3c735dac9bf5d432f263aaebd3911426a73c10577
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2213bd1e3ead1f0054afde519f9d807f93c5642e00f72dba4ca083e3b6973113
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb9818e47699c56d820bbb330d58b8b6849ba02251d790a5b965029c83e558bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 929017d703690fef2aa26edfcdecbdc0142bc867baac70c74e0340bea9f81dbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbf44e8f7c3b0bbdbc932679f3a1d89ced054cadedc956cdf7e5aa28b739d8c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5724819cb85940f87ba8210b1db0524fba32637a3f7ee63f903f668c3c7f96e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3458c83fa59cd6666c8bd5f97a5c628b1edba8a46ad3ba6ea6cdd937e2f743e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c535595ee5798df675a06f78937e4fd23e89f54f1506a23c64cf737c93513d63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2ff994de35c1329800a95fc53146c060574975a7fbbdf7242e448f6df10f211
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5859315b65e08a29e170c0ae2a24494a358b6b9c1e8fb299ba2d168c6616e1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e6c85eca61c6518d5f1cd52ba31f0c684b691830028048e997f4972a5500c80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f64723b3aebf23d8daa4da24bf4ff6584c5a37d010949862119de17ea2ad28d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd6e79de720acd0237f4d64cf2d97880a11e2499014585d6f44c06f4ff39673b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 068f3506daee8aa6706b27f29637c049e33085b7ee4f20756e32f32fe39d0476
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b82db2035cdf9a345d57044505ab6a4bc4166d8c69de77e88057f313fb3502db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31d8de225e1a90f2213344c2084181fd2dc3d2c65da4487c305a2b1d675ef91f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 466ddbbc2abd4ea8b5cf9389c08ecee4bc3a6c210acb7c5a97d006a9f193b244
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 782c2acc879ab284c4001d5556ae324199a97db0659645474e5d20fb457fb37f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a51ba67cd1dbd40fb542fe6e57b8b534b2b27ed550603207ae33053d0488c92c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12c8cf255adbfba7df0b692b30b45a5fdebc3afed51476e1bda3da48bac78706
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41a0366d792b0ccc52681c051091a888e895d4fa491dd8b17e7e9820f77d32c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d096501e40f91ec98097e339748c7f34c851e0f3dfe16ea63054f665f1e865ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 756e9c7f90bf0d991d92ff953ddec23f10a8fbd1b87e7d414bda448627ed085d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b5bfbaea3d542e0ffdfe95c2cc3c175ab57defb61beceb26ce7a14ec1f60645
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9ca1c68000525476658cb6f87f8bc966b2c30971662d82c0042bcc4a8ffa4c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4ab6dc0e2b8f68d823b2680ad75acf1d5dbbb08378082a7086be670ce7647b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbb895332fb253f8a4030e8767f29d30835b3b341e7b39e66278b6f44a11e875
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de02f045380dc390e6d542f293bde2f5863ba786988458cd5cb1f61775d16de9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea67b8bd21aa952473a2cf0f839b56e6a521924dfde740239cea1008b9e460ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d29c1185c15abc6eb7543400cb251bba2b5bf66fdcc2bc6bd8199407e1cf563
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 420e61f126b0574da43031c35c572e4ed29a3c752983885a065dcc1b38438fa3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6a45b77089535e14992ee07288044718429d631e75a4ea4c25dd65ff5ef9943
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8205355bb69ded9b9265c1082e8c28852d611f4e1d95e8fbe8ca3792367d3bfc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9f126f220e995a8fe5f9995fc3e3ece2ba6bdc6fffdd2d2d5761baaeab245c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d134b0e3d0584a03c72112db5662586dfb55f3c9ed1ea98e7e9776077394110
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1452ce3304c8de8b973c1e4352e8b6489de88160cdcdfd8f6813de7fdf3fe81d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93c19748f69fe7ce3a6ad4467ddd69a4636670b83b166b3af20e988958abd6ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92c6677d20d64a15e7aa6a7d6185fd25fd05722402cc6e994bca103a31e5360e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2be5173da79a53b001c6e7bf31adb0c531f512a47c7424c07fdc1e7b44d905db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e0a748a07493f940376121c008f13ea8af3b820e178fc35cf4c46fb35343b85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89cedf14463617bb031786ba81f981f9d416460a907bdd5c197e49d69298a7ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d923dc8fb4338f34bb33879efa8811378bee4b5ec558cd29032a0b6523dbef3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f25260735ac73ada82d42160f0f8b311cee385f2d45e899a78516d85edde1c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a02590a4a4ca9b3d3e9d2701484810240d404c032dce2cc7cb579cf021797446
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d5dacdac63481e3cc7e377a9fb6362fed3b185100571415fcd402640d272313
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 508fee770faacc1e779587e047a3995653844493baea8c16ea1931b09c11677e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e55ddca37a211c7355cb157db94036b189516d3c7b1404c2be0c3d28d96a4e39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 475de8624984291d13ef130f8fa03d4d23a1683a5fa11020cbeb23820b1115fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5681cac75103b42cf1e599100938052b53f8e82d06f365d5d6b1e2acc50ca2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff12b805b99778aeeaa7088d36c56c21a50da61ebc49f45fac88b846ea13502c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bd15a5759ee3dcbd7e3f4953b6fff88536f3dd650cc85ad8e14d446f4ada0bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 154c2b90eb1734ccb3dcbb64ddcf1b3b5ca9057c260d2d9750c890d08dad82e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8503ec17be18646254bc628b4aec7da7bc34534b5187a00ccb29988237f719ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46300b1b1704fb06e4448abaf9ccc130dfa49b4e6005c88f12f57f1422fb3760
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78cfa87d4e20b516df622113f83ce4b17e48e472560f47c56ecddfd3e9b177d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11ed6337ec436159760b7b46a7bbba8bd63c8f3cf5ce5dccea26036128c0cc60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3f8c6ceaa619be0b3859cb51139f8bb864f08ca7362525ecb9eaae8fa71bc54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0942d9102237600f651769cb4be2a22a1922ff8bd3d153e89ea52bb4bd81f9a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fe480914f1adad4b498065e02a4db3412271588ca3a2f2107344733a9218154
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e845cd88761aa2441b6271ef311beced1be3256bbaaccc14bc33c34b2284fe0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12cf865632e08b30793a61c8ef14bcd75f229e6a559f83112ea26c4a5795578b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfe1e5fceb5ac08b8e7c1a0e769981a99a0a28fa9eb9040f57fa34b58270e483
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4fbfa747f5c28315e4b2ec451c34ea6628d14200dfa1e4d41c7958f5296d523
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4bb491a0cfea205c2cf3831792c5d425f835e41e205f5865819af5c07fd342a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed2bfd5d1ca0702b8cb7d165c720091e227835e5ed4f3045b43718127c49cac0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c431f090991936576e070d1528d3edc9110b368fa99d1ea282e0c5909eb7eef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98d5a247e750691811b32a94201cdbb75819e218775b02dad8b39dc19c7ac55f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06c189a83b80c13340edd8fed69a45f1ec83076989557d0171b93f544a41d25c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ab25b3ad8b6cdca24c646fb4aefeb48ad32f404a6b534dd4c9654bda0931263
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c6ee04efcfdece16ac36b23dd9f7d0c5f8ce87b52cb64c23beecf17636021c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 914921e28d92f4f33e90994edba1f7504c72f46c360816845909f5463e1f499c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad348eb94c3d6c6ffa2c7496efa980bdd63b84d9c132ff6e189704155d3c0081
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38ac3ce7b1d53771e7e5389faab8900ac97b3e4443371f374bdd57bd3eeb4f73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6cd077e1226f89cd6a45e53b7ab3d8f75f14bdd0a5590c53d4708609d54be52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 878f925643c9b8c76919395357b281ca2f97c6e2f82dab56fa9fc9e36821528e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23da0e47611835c18e356bc253454518a6aa9dadd4159b7acb71a8b1033756ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 933359063094a8a1111f7ccf3cd72286d1aa354a8b9d8173dea299adf6cd9fd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f4701fe652367be21f914af3f32100c7bf9193f4225bc3e052539e72b17ae39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d82d5c1eda5f321e4df2891495fc4a992d70df858f8469c7b5c901172a61704e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6aae281b002148315caa413f9db1ba4c743862272c32c66bd696e609b0f34fb4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab18c92097312fbbf6e4ae985d9900a067e7cafe85c035e84418bffb57966673
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f093e53a8f4382f5fb4d3d009d884dd76e48baa9e39cac9ba8d26b65e528cd74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 025e3244dcd2616bf6762ce5cae7161fd2564dd200dbf833a99fa3271567b63b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1559a1a497a6c23b48165f8f05a74cb0630272c80259cbdfdddc34a05cb17ea3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63becd902e3eb99d4cb57dbc68331117f4b69e4db0253a83ee68ce8d30f46cb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84578aea91830995ce0fdd42d7a5249782afd073a0a5fb98d0724782bedf589f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1962aea5db43ab55c17aceabd19f2a82e2ceaf38dba4c0ae8cdfe252e0380032
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51892641ae197a691f960a120310262b863baa3b9e5271cb37a742fc9c2b65c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0828ef18ab3ca3a0acbecad31726fbe0e53eef44acb1232f72cee85f63e8d2b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03f9401864c4c0a7ea27d7ef4df6641d30feaaad209fd66ff51950c1be4a6e1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 382c21e77810bbaf03f00fe59c6f8903113f69b793f7f6a0bd869c6cf16b5253
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b80ae649a90a563d3b99ce8745b9176a68a89157487f6099156c87b3a4e26ec1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 013ac57b1aecccf983b6779520be125549649045201766c5417166ad9c13e17c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2af9020259968ebd241a95029fb7c443bbf4a3b4488affc348731a291fb6443c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ef62f11c68fdeb84db99db7d9cb29797fc44451a600d0a4cd5f7bd77a38807e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b616229430d727d6ff19c917a3c33d782a665adcf669078fcfa1f744709f09ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 067868ceb4e68740a6382ef12e7874799df2d7d713add395727a4425f1901e29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 021618d27ba11a1fdda7bb3b18425ce7f35dec94b1c3efe7061004c402f10fa0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f704366f476c7a35acc2d2a7c461185aed1e73b1eff9dd6f6314aad189b29f03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 940b630b093f40aed795a3d7629ac70915a26350ae67fe5b4c0cab31d7afbcfd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a736a66b71f834982f54c8c38d6ed7490befb792782ada8f573a33e55b9c5739
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5188b5be5b92f5a0355b76552208faa6dd3f405968d7d07c1b3af86881b8c58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a51bf543315c384fbeff1bd6d7f76c1aa6a3b52e16e99ae5256992083317eea7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 464e9fa28227e4a092b2d49222d3c47f3b2531d62cf46947c81b2c18a7c2142c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 167d647b6ff4d6d4c884a76cc77090bf12c716f6f580d857d6ed39f0ca18e6bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5a30146d5a1a8220a35d79d760e2160e14abc6e2e420f5a709dda95f64dbcc2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56bdb271f27683441c2f99f7d0a852cc2923823acf04574d9ad9538823159421
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0a13509ec846bb2d30a429823fc392838f419e3c5c0c031beb381571898306d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bd8d6f8ba1a5d57f6f7d109347ca63a456578f5440a4f3d42b06d0f03fbe154
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9afa2f5d6f9cd8cc40b7dbaa4861166081a1f793cff81fd20f0fb639fbc27c51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 114e39b1175c1440be19a5b13c61c5517720dd95dd54a061601c2fe9115a9a30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f1932230a391606cda7f9d4722482392261864ec11c0be1a7fa9cd19064f2bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4caf2c1388ce82e19cad852d7ac927b782e453e07f20aa6dc1a3b38a22b7106b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 028a26dff1b9c19ce62a9a7588668c9786c0f6cf808ded5cf4f604dce28aa608
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7933db9217b5b161932ed076142fa32fb8ef47db2cd8d2734803895c787f8871
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11cab960aa2dde1aaac57700f6dac4b416d88b5b47d9c25ec03f4f467e2b8752
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7a79081f6d609a81be5cdf5378fc107b45040421fc5f63b24aee43d2c53fe0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1e0debca5f6327c13f403e33b3716f9a53efe78cc7ae9ab561da47fd29411c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d1672de10a02ca0fbe1555b3d4c2d1f288b713074266dffa86321084bfe3d51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2f4e6ada68686f4ad8c6ae52550e27f0c20755aa777033248162e83aec1c98b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ef1af761c6a11984448c558edb90511fe2ce16fa2f61abe20934ea7ebcad795
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c996182370e80f5649149e9935dbc788ebab02e92d4f46ca12427b72a804975e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6ef475b87485ef56204aaa2a871aa9caa4563c676a6dbb14becee7560dc2d6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 576a7651e00c43cb45603a2136994aacde1e9a6d30827596e05b9b4fc9c46d7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd061b0efa298cdd0e9b1a75661976d06f52447cc6923cbd9e71c609610a2343
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 feb156cab8b5af19d2220538c8d32b07e51ad44164284fe8ac1b14d1dbb3b9bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e963de5b2e34c3f8191e40d0a80bc34e1202cce197288c33e675892abce63443
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cddf4f32599be590af97dfdcd3236be08a0de570e9445dad30535b513d451eba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4cbe089780250bb290267010a34662e3040bde418bd022621dd69bec7c23decf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b214444ad960663ebef873adf3fe9150b82de17738885ff9820027e9d9737db7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3042f652530a29220bf0fa01c335b702a196868a33c207be20a7936df0e9bf19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79dcfd8e527d3d53649eff362d882adacd9e453f460a886394b99a6adfc91d98
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            memory/3256-5-0x0000000000400000-0x0000000000461000-memory.dmp

            memory/3256-1-0x0000000000400000-0x0000000000461000-memory.dmp

            memory/3256-9-0x0000000000400000-0x0000000000461000-memory.dmp

            memory/3256-7-0x0000000000400000-0x0000000000461000-memory.dmp

            memory/3256-6-0x0000000000400000-0x0000000000461000-memory.dmp

            memory/3256-8-0x0000000000400000-0x0000000000461000-memory.dmp

            memory/3256-0-0x0000000000401000-0x0000000000403000-memory.dmp

            memory/3256-3-0x0000000000400000-0x0000000000461000-memory.dmp

            memory/3256-72-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3256-4-0x0000000000400000-0x0000000000461000-memory.dmp

            memory/3256-142-0x0000000000400000-0x0000000000461000-memory.dmp

            memory/3256-13-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3256-2-0x0000000000400000-0x0000000000461000-memory.dmp

            memory/4152-77-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4152-17-0x0000000001260000-0x0000000001261000-memory.dmp

            memory/4152-16-0x0000000000B60000-0x0000000000B61000-memory.dmp

            memory/4152-1356-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4152-75-0x0000000003D50000-0x0000000003D51000-memory.dmp