Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/07/2024, 07:48

General

  • Target
    6eb55a4ba28c8b3b125808d5d31fb9e8_JaffaCakes118.exe
  • Size 276KB
  • Sample240725-jnayeazblh
  • SHA256 b1d014a6d12ee8f7695fd0eacc71bd1b91d367f5dea64400e892f2cb4c810e7b
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • xsa.sytes.net:1202

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Debug

  • install_file

    debug.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    157

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3440
      • C:\Users\Admin\AppData\Local\Temp\6eb55a4ba28c8b3b125808d5d31fb9e8_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\6eb55a4ba28c8b3b125808d5d31fb9e8_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2924
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:4988
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:4088
          • C:\Users\Admin\AppData\Local\Temp\6eb55a4ba28c8b3b125808d5d31fb9e8_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\6eb55a4ba28c8b3b125808d5d31fb9e8_JaffaCakes118.exe"
            3⤵
            • Checks computer location settings
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3464
            • C:\Windows\Debug\debug.exe
              "C:\Windows\Debug\debug.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1840
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 564
                5⤵
                • Program crash
                PID:2760
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1840 -ip 1840
        1⤵
          PID:1484

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 c81bda424af34c1811bcccd490e69e630476c88ed28ee1334ca4fad42161980f
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 8ced161db6d246708b1a8e884f467a9c71f34c902ea5cbab1429b9fa73272e3b
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa4763920c63ee1b9f2e9ddbe746e47a3316035a02be44e469e5b7f263a82b20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aba4cf46ba3abce3e18912c53626fdbd36f7d9e21f752c8f013a8e707e181fc7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d81abcb2d2b1d0c771896e63aeb0a023319152538ba601d43e1d3b26d04095d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff49ac60baf11916258c3e5615c452334b9e456a4ae41424184b7c04be6acb16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 698b9d2e7a2d180fdcd3744ab61d495b2e7274fed041d1864e551b949c37cdbb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1fbbe3ccec3dca6a58c7a33da408e24f022ee0ea6704ba2d1f869f8eb049463
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cfc36e864b3713403211d7ba3f64048af2d07726e0ebc4b6a03bb077a2e03086
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 055630889a73b4f4449f541847775ac56f15570e49300a936469f4264d44ae3c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 52c21e92332290e6960aa0b2b42972fca332583c1946a59f04b8107c15ea1c04
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 029da883b793fc90bc813d4c0d4cacc27aa97346fee697f403254408b6fd5e86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 347fdee7835850c1c1fad76923fe703acd95ef80a59c9c7382a1f9472f08178f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7be16bbe6715bbc9c44b2c4c73b6977ea33370ada05692d6ad7fa39bab6bbde7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f40780104f4a8eefb5514c887ea14ab402675e86746e5f1445b1af63c18dc7ae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7180e5519806619867618866fad1d04563c229c79d42b03278fd6ba4b3254a32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b78bd202d71194391f607d92639726c5a1fb95046d4eafed955d8425252ac1e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff936b1e3e939795843cc7648152be5b93120b8d24531f57b31001e3f3b1080d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6910461af1be96a6d45d6ec788f27f8f16e11fd9c4e42038e8ea8df9af377e23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 012ec1e61f5d76b48c403e89e8805dbba3d4e845d0eb46ed89f97932a7c1f67b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6bf1c4eb95bf7b13cad9f48c5bbbc162146ebc1446b47713ec197e0b08ae1f6c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e1fb8cb8bdba75f2195d0e96db5dfa4faecfda814a6fe5b9e084a7b983a9dc7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e45a0ca1ea6da026c58ae1f885f92c56d758a91dc059d26df2aefc8f6bf1e48d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c70db616d03b362543bc1df0018b69dc6c867be1cf1da7a5934688f76159b4f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 545af74205fab9d595e730077dd01ded5f00d02fa71d06eee693da388bf364c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7af8cf8f4f2f8eaf3f46c16000b2b31daf2f1370eeb16502bd19d525b1abeaf6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7482c87b1e7f50e13364f9ee8c23000602d661f7b4021c7dc2445f9c2c5ffe44
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd74eec2ccfb9f7e78c3470f761aa365fa0433ade605b1a7c2bc0e8d281a108f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 242259687270a76aec16b109af700bfa256bc98eefacc6ed80f900dcaecb3706
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b41ca3fbf73dfccbe86cd6c5245113075b62dec43e1dcd659330d3c6dc23ca2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 915ec8f1661cf0009cbb0b13bd6409c7dd04093b22616ec4c162c259c85451c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb75b301b50450aa92935db83ff8d24556699314bb12dc287d3b6f00b89045ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f2a70eaa8325380b04ff240c42423746471c8133bb01d54ad8fafe983a2abae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b140b48daa88a9f19d2c32b11666bc9a2467724d6a6bc3f45ba39d602ca8916e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5da761146bc5bc33a4913c0b5769901a2a5b6a197f3b70fe5f6e876cf1ad979
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a0e5d65720fe91b363894949f2d0e1aa66fc9f926f3fc6f845ea5ecc98c4b6d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4001e32c090e338aa865b2aa1302462d9926bb533e4e1bff5ef638baedb303e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be8694c2c267f2fc95c2d7121abfc7e5589916c7a7915ffad832b54f75eead0e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c71e7f154453f4f2a309a187456fd2e9011cf427a706d883f24fc85898a7fbf3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d7f098e2c6f717c904b6cce5d3572f971e621737f22b7e86a47a6bd5e7d1af8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20a2a8b5f4d79240e4ad17341232e68f3e113c5c1a0dafdc750c37ffbfc18ae2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a427aeb7c1e9bb7173001bf283b8c2340e5a4a559781c6cec9f94195d086a444
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 874444e256788b4265ef04904b39d59daf181d34e170d148ac201b953e97642e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85deb852ea77d706631fe5cb4472ea59610411606ada3ec8c4d10160cd4e9e9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22c28d5c094a5f075a3e90191a15d1c338bc22c4003b663b2059dabd4e15148d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 51d7a3c4c2f964c779af7d210f97718e0344a5065896a2799201cfe2a7cbaf0f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 568e99b626e3d79114168956197d232c6061d8de09037088967e19efe173d7dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 468d7142688792baa0d01a235bfe46989242fffc9bd5628988fda80276ed863e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f0e3f9e2a2ef11a829d8be5fe899c0ae4e7517dd3cc84827c84aed44cf7afdb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4eb61fa58011a87a4f4c5d29e851527d8d60a969bac7c450bfc44d6a518f0ea4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a005e674b6303a82e8a2d4d3bef0d1cdff5730a9b11c66b73b5cf0300030aa81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c46e7506d689f2fa28f8a14fc10b59b7f56c54f13ace310737bd40c1bc095e3f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1397a0f0927510da079b4d7102036c8044eb00cb98776894ddafc34e5a3b2a56
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d1801e035a66d6187d2d570a1b75e8b2383639531021d31edbcd6c65418cab7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35f6bafd2b04c2ef703e1e9f1418752573a49da26263bb29eef7fe11fa296dde
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ca553bef9ca1d7a4ca520b366a72dbaf9344bc1934be01c232672494a7a2042
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a3c9665024ae3008e63ac6e6a278c63222e31d6e0a081d874c74d30c0d4436f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9ab0ecb6ebb599ebf96af93e4eb3ecc182490413a20e6bee9619bf5fe16d2e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 47b7854d59ea6da9efe61560f76bb5725476bed7acc9e9e51c79f4f3d7dce86b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1f6664510ee7e3080a078cb4486fc19d420aa403ce8567395cda35ff8835135
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75f4ee039c80654dcb0320c4996839488443d01bca2aedc332e5812a8819d2d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a27ed41690f8b833e8120a65e730448c66c21aa798cae17d0d61ab5f77bd6e8d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ef6ed55380602a13c6ae31f57c6549ba77c993cfc3ec186abe330e714708b1a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a20e31adb610f9faca48be74687d3814bf77d7492010de0c1e5f4bb65a0107b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f54ad66b0f69b72b91999a59ca91bc54c359d71652ffc3a2060e8fb619e6112
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93b1dde4268d7e56faa0e4223fb5033f7287f3385268ff468928e9103a107e03
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af346fc7ae2ad4273e9f3dcf2e66e491701f76054aa629a8ca6c3bc765aff9f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c9927e13547fad01a98b7c052afe2b740130ede6e819eb5489d7edb7b6cdae2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b18aeaed8b0dfc7a1bcbf409c0a63369f496126891a4b41722513a27827e08f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c2b844b8c423262d26f8d3c9e948eac4b603b34d12a4fe54d485f2933de9d1e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 790207eb7a11f6115aca59aeefe4504b00eadade3c1bd3d8a84c6821827d9518
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea089075dbb3125fd916e3e08d24d99f78ed3539ec99e2db554679eadf983813
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd5a175e0d293766cc1575cc26d3046fe59c3b5e104166451fa1c1550f2c651c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 145d1be09132f7d8955109a2fb196fc76bd3a9244e846a0e51316035f97269cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 573b926bc79b2c99a6b93cb9bb6413e88f5d13ee15d54ff10bb9bd6218aa59e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0d47867c1fae9c58cf9576132dcf93598af71826f7a28ec677bf4fd2150f0e46
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5be2ab583a1c865f7528f689313ea310bb056ed692ad3d8f14e6f2c81dc556f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e5b27aa0c935ae91c5316dddeab06f503d13d18385f776ee757a8ca90df2c2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36dc2dd53ff4fc33405259551e0be07758556c85d29c82ccb593eef1feaeda5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d3bf19c24e673d8b5fbfd1fc19201148e9593ec5267d4f0d4e1c7f6bf0589efb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4bfec58890805725e5631c4b3028e5ea820a544badcb33fa826d3790c262ef4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 447d36ad141767997a02efe871cd8a95703b6d5a1bed143c3d1f0e6a3ec828e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69a20a869663953c0d6935f1bbce03273442b8d2ba50f4d4874b967855bb5c5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f8e94748962edce52093cc3843773c1b02eec011e3a99cad16ba25ac29a7403
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34a014446fb9c7217c9af488b050a5ed568b4cf3f1283f3f179a6948a3300980
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a07fede6c5f0bc4bfad3edeee38dea7f3d62abb13014a4b27ef03203ca89ecc1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17c5fadc2f5e57ca10d641dc53ad6cfdb532ffa6d498f0de1db532cff7e1cb88
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 302712cc32db2b0ae204e3027b7c0d92650f96f8eb891142233487f13608b00a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70b7f5bc10e5b5500def6db4930a83fa4f857fc34694912826246e184d63f1c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f557ca112f7e668874a8cf2d017e461b0787099935b3949ee014de76336185d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27b949a2d7f2dd67c1028d57e64acaaeff502d23f7685019f9adea41d1a5eba7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e101540046f8eb98a9e66a8b6bc6c2cce386d18852b98daebd3da09650511c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6aa003939116b31949794d8d16d8b4d417be0c323a8b318f75379a974ff5e06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e90faeeed4ab73a04e7416619689000323a5c615a9747f1b30bbd14529997a2c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1cd217b2699c68fa09d3ded7db5871aa21f727940b9be36aa0a0050fcfe33bbd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 834110cd67b182a04bdbf6100c38fcf76892a34ceb6f365963f266b618be821b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33093013f9701d03660051efac6a50508c533131f94a14b41a4aa8bd7563744b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a7169da88ef5c00f09cd7a355363b40c9becfa4a9f6ccbd5d4ad048046b8ac0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 05311d2d94d11843c4aabb9f0e5ef0a92ec79290d687eefdd0275adcd8e0cc4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd2f2a4f5b2595f374f8597df08c419c36346839fdeaec9110a3032223f20fa8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e400bd6d92a34f1415ac81f4bddc39f6be9fb64419d1d5457f423621e0546660
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f0819c86101cdf81a1c62e5a0a85b356afcc12d7b4c087193383179432994e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2bd20a623efbc12a0b876fcaef810fb89fb8c63224a9c82853c9f2d61f9d8ffe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e42e5961a2ac4af722f3509d450fbb34e5b7392ac54c6cdc3a8cd166e22fe82c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1d474530912d96250dc402581cd09b55c19098d58defb73141a6dd947c14de1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4990a9e8d86d92fc067dec1233508776f3ba5ddedc94a7e7820e8e95f00be8b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f73a133a431928e2573ad170a0c8aac27032528bc0d35b113038e215a023a093
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab97123cc9d740f0091550838c24e4674734af62deb7cac7c069d7501a276b7b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b5b625c9ca367e2414eab47fbc4ca5116d3558007caf32236b65cd63fa78a4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bffbd134117d81eeb68c60abf42220894d1191f75fedf2674daccfcf9dbed0ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab644b4f767e4509779ba642ae8c6a5725bc23c6fa0daf4b56f67a1890e69d96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7fd537b5986cd1967a1757ba5bdc1cdc8aea84ead30c89ed8a1dc8763e91304
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7226dfac46b1175c30b6eff996576086176143ffcea7b18b60e085afb8a6588
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b79b08620070cf54ac3801db6d45c519d42b7e2c5a5be46632e4eac5206a4f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 607abc20aa55e2f1c65159eb1502b58c43b2c978f696a760e18c6df6603b290b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab670988ee0b27bbdb38ca44c1314bb6fb8f889da0f9e7f8a804028d6e521685
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cb35c508df898775bd56995b1bc149a70410cd30b9df9d77623a471df91e6e69
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c284ff0d48f63a5df62e84b971f88674c79f85c70b1a771df813c2515c53e6d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 221002208a27b6774469a3b479b23e6d5294dd796439c88662220a8a3b46a1ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d798512437c70db6047e36b1c4fbe28974ea9777ef954543baabca81df437ae9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0769da1c2af72f5a142c95012aca24f7d71431573a25a445dc2fdd4a4ec18be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f91fc19887a9c6b8350f86437d51d040049c32429e0f71022e2a4e30302f2871
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b875149bd3bc08176e65d5f507e1484bb8e81e72699cc90be04e4457dbf8fde
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92fc51fc8bc2d177e9a9fcceefa2d67fc208e62ad5e8673784dffc1681c83588
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dcfa8a444d63b572b6dd74d3a5866b6ae3df65e1dfcb2cf239a57f96339205ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c3ee6f58e0e9199275a637b49b2963d8b2c7ce2445b1a91b719e37a333207d9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1a5ab383a296f240008af1169177f0e654f00c2c37749c9b740fc5fd44bc833
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93ec48854efbe3d4e84d12797e1f5c1b0b6ae9f9126c603320bc18e4dfab606e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8118ee54201746c5cdf2108f971862c0f81a38d59e9f5fb4341dbd3240c43f97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b8c5949384010fe0a20c29c8c0881fb3dffcd37727e09dfb054b047a7192c900
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08a880339e0a4d622ddd5b1b6098c2bf41097e9e7549a9311214e1b90c9ecbd4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2ac75f5d813659618608c2e8d1a38321017a18807d9fc5dcd96cbd1625d52e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71c2e18878b6c9d67ebf8e4e89d0727855df9655c9a2928b44611506baf2c9ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb4e61089b0e0fc5f60bf80ddb15c7b88d05d55c0406ac35e26275a36895db1d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ec79c3a9a096a46b8672c1a511de36de761469d953a69e12d863975650f73fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e793987165ad433e202a5a42932d49f911770049ba3eeeae3b7a9d0be781e46
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a3deca4f0810665aa2c2baf951f90b3a0e5f68778c434edb5a56c88405067b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 04a8520828fe8b28e103c6062cf8efc0f667eb91d49b990b806b15d81e863de0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fcc1cd113ab149262b7314fa437bb20397795f241ee47259eb5bf9ce1503116f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1235f135bcbc3e9b6b3c639b1ac023b2fa5c77cfe83f01a8f0fb1ade5358ace7
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              debug.exe

              • Path C:\Windows\Debug\debug.exe
              • Size 276KB
              • SHA256 b1d014a6d12ee8f7695fd0eacc71bd1b91d367f5dea64400e892f2cb4c810e7b
              • MD5 SHA1 SHA512 SSDEEP

              memory/1840-163-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2924-0-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2924-140-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2924-64-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2924-7-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2924-3-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3464-622-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/3464-139-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3464-1305-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4988-390-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4988-69-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4988-67-0x0000000003840000-0x0000000003841000-memory.dmp

              memory/4988-8-0x0000000000850000-0x0000000000851000-memory.dmp

              memory/4988-9-0x0000000000910000-0x0000000000911000-memory.dmp