Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/07/2024, 09:32

General

  • Target
    6f07737d73a8fd32accdcbe22ebc712d_JaffaCakes118.exe
  • Size 912KB
  • Sample240725-lhmfcs1bqq
  • SHA256 774c89f382c5705e8d5cdae3342f9f6cf0c8fb412be733f866fdb30fd325cb73
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • abbas2.no-ip.biz:5555

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f07737d73a8fd32accdcbe22ebc712d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6f07737d73a8fd32accdcbe22ebc712d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Users\Admin\AppData\Local\Temp\6f07737d73a8fd32accdcbe22ebc712d_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\6f07737d73a8fd32accdcbe22ebc712d_JaffaCakes118.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4952
      • C:\Users\Admin\AppData\Local\Temp\6f07737d73a8fd32accdcbe22ebc712d_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\6f07737d73a8fd32accdcbe22ebc712d_JaffaCakes118.exe"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:4500
        • C:\Users\Admin\AppData\Local\Temp\6f07737d73a8fd32accdcbe22ebc712d_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\6f07737d73a8fd32accdcbe22ebc712d_JaffaCakes118.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:2036
          • C:\Users\Admin\AppData\Local\Temp\6f07737d73a8fd32accdcbe22ebc712d_JaffaCakes118.exe
            C:\Users\Admin\AppData\Local\Temp\6f07737d73a8fd32accdcbe22ebc712d_JaffaCakes118.exe
            5⤵
              PID:4212
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 528
                6⤵
                • Program crash
                PID:60
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4212 -ip 4212
      1⤵
        PID:4460

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 dbf8501bf29e01c182cb12e317b732cd756a9b48e1634934979fd8764b85d583
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 32e041207d814e63a6fdd9a4ceb40584bbba2159e65dc072cee1e81b7af0573a
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5faea99588ab5484f081550606e77d2e055688c8a6be791ddf274070fa900311
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e859d6728e205035616c12d0dbdf96c8d7f1689f940b7a2d8047e20b11fcc3dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fed020ac5a38040e5fc367ff0fa5b4c0c84503d3b80ac92b09871463bf513949
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a8b1bb9d4282815ba8da4dffeec7e04f0f11a7fcfaeb93cdef0fdc59f8a6792
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a553d066767f15db18e3de152c4e250ae637426ff293b6f0e5b5740e83647f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 394ff77834f79b8da5f9c1dfb319cb0b2ea448901e4023d79b7ea24c12725f19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f27f9ddacec30f9b4de1f8a8cd5c88291879c9e8737a075d345a6b8c93d1c00b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3fb70ef9805b332222d40d843d22fa20f505c30716bdd2185a669aaef9f39ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd068aa39d4d684f4b5f6048e5d10953225f6b2dfb9986c8b0c4b6345d3aa666
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84355ae13d8c8bf688f1898466fb19a2bff345d12726f04986ff525733322782
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c62a43ca5a95b8ae36d21142216387a9396b8a63b030ebd7731ef6f66590affa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4a441bd6cc564ff22788f16cce1cdeb0b57692836f8a98f5c851de4d045c086
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08a591c10e7fc6ebe083a1c69dd1f3c40d4cbe7fdc220b4df39a9819252fba7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecdac1275f9018df4950638f1600ccc0343a1e65e9326a9ea32ff8ab8e254e21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b908772c40f30976a6e3cf74db760cd3b37b116f03a48bea90b685ed2d504dee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6dc11db4ac5359c0134b65a09defe4a9572cf56ca323a55b60ca37066ec5837a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b13d3827fc95afbe2658b1edad33f9cc3e38769ce7eedd8002ffff3ab2b31f55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a04fa471a0541469eee0ac19b24af83b838f216c44fae9d4c47e7034ec3afde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 639215738dbdd3d1c49cc87a46e5b663c6116c2394fd121a26f45b75c60d66fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2051bcdac451c122c261b5037961bc617c3b7738849fb07d761b5a90e8997d1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b99e41679cfbb6552202d41c67cbcb249b6c51462b2ce90db510687418fc34ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 240a177aecfc80756c7901c04b9095d5ac95312898ef5a86a7bcf80e20d6ab20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7070b3279490c6b9f9827eef2a1a9a034a4f20c15b49b708eddb09a3595a8d96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d22ab4e3ba69982bfb5f8887937965e589f9098bcae8f175585d3880962e29c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9273a601fadd23fde3e01ce7f86f3e5e1709ff07d540ca757e925ce97f26e29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 665d857339c54a701cc3def05b63d5e70c07737b1675da57679e28fe961440d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2b3479dda55f18631cc2874c148430b3888f9346e512cf9237bb279350fac1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fa3dfab5299aa84c98d84990da3b9991d2e765a2fe626e51609c48dbc7eefa1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aea1975f9393fb73319299c013729c6ded51efa8948da82f9700ba3549516b08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 868590b83599b42f7d5831cde566afa4c3e757c68786ec6705e821ed97fe7135
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a40a878e5296c4af72dd77844b2ee04c4295ccb9ce6363888a7e9ec83e58e56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f62ed43701c76619ec37fcde7d49b1b4e5fd80a84a12f6aaa122ea7c21d0564
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcd9a92b58b64281eebc6780702c675ebf74a0323d569d35787b0cc3e9619bbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c050ff567e525b9a6faebcd5afdfc19d4e6453256cf3a4f000fa893035f17044
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9138682a1e1168e34ec9f0d4cbfbbf0ca8515c07ecfa90cc7fef14686e00ca59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c64ce0aeebb26fb573ea1fad113a27c08a3a498f1ea53151fc9923d54d6b45fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e066a087830bfe7938154f8433b050c9d005f7aa35e7645d8817e850aee6099
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f84b6432f9662365409508e2adb37f7ad57585a39d3e0d66bc3d7fda3f023dca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3df2810e683f4800f9088f98a66435ada8b9f0023a91f818202bbff3237bde62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6acac62e6675f877205c44f79552d57774aba2efc251975620b4508f856ba78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72708b44b8f60ad463c242f692fb8f500b90d45874315b33184c1915a3660fec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29b0ab10a0511b91282f00962633cc221916bdc9caf4b5412cd83af20eba21aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bbb25a3f582445bc117e8ead95d01ff13830e58c4f69a7acf4526a5bcf3e9f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b43f00154f216e00db94368982d593a084b093216ea2a2f5337cca21deb4286
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dcadb8d5877c7f3229e88ab6cce64233ba1a4cd2e801affa39df15546391b18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74eec1b6bca854dda4f4d6ce8d7bff097e78448cb3c109b83aae009c4461083b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb23e3dd85df45d99f00e31e0c954b5377609f9daf5a932d6837c705b55256be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba0248ad317fb74066b526912ec99fd098e128284936e00143f8e1d4932fea73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e2293f6ac916ebfdd37126e52c2a40a7d9ca99af71baa621bbc8b0bf945a72d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cb2d8dd9356629a0a04ea1d40cce84bc6e8b777e60eda7741dd1d4827c29a89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22827f7d1ca7bea08823cea3e8900849772be444d8a9beca929c3ad23d0b055f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ac9c122373a7c794570d71877054a2cf5a5908c5ebfcd5a665723ab60dcbfef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d29d81a6c4bc8153c069f37a77a0f3edc1e97b8775c22b642a00bb7e94053c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb5953e581c8e119d3083684e680e65f7cadc2e94b225ab08aa572ee193a5c50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25877020c576f40267bd9c7688b928a48f021e104d5e9adcfeda287ebd14ccce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35dec869b81b81c6c666dbea4dcfafe9fda9eae20635122024a7c8a77f2d1453
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1c104f0db369ec137d8082417516bfd3218be649eb9fde3498aaf8ed0aed5e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6013c101c604d529d03657ed675fd08ae9010c9443ea4abfe961d97d7b470cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9971ac6a2d49d34cdec60ae05602a048c5f4117b414f04d3e9124dbeff0bbd94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d404eb6237a5067909fe2b2e7525ffefe34b958d053f96a817d5c7ec079af2b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14081eccbe8d925b9c07ea48bc9c40f6401d92dbaeb6da696d988729bfcb1d45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33358a78d43dd4cf46774b0cdb739a89f3940052ff5594ba8091671683eb0e40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 562797b762f04aee7f0e64fa4421d44dd3498cf6f751dc1559a7bc48cabd920f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8dae404566abf476a2d9fdd7aa05a2113f97f82de01c0679cfbe9d79fbf90353
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7df5afd3e60443b90460e5b0ab5a7a6210afd8b1e2f791ec1f5ac51c10b15f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b9fd27152e01682c05c8e011635952ad2a1461f3f83bec9baac0ec24762fc9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cb9e20e65078770d493e8097bcc5c11be10c5dba1b8a61631b61f7bf87789a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2693e720aca455cd351910f76bb148e2bd35a91c40db5122e75ce96e2946c703
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e2d3836d2e95e6e663088f67933672e8b75475040b0e0e3c21f14a026bdb3c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b872941194bd2ebd9ed97887c34657016dd81c3ea2535add818ed9d8f5fe4fd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 280e6cb231e2e6c53752d1977b3c241d946334002eb941df6197111261ade871
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 981e28ee6a66a2a9dae86f7ec1d7a4ba9b5906d206a0e35b5ded2e4bb4453712
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94f12d15df9a0dede7765924f1b1f86f7678316c1c7a55586e78ff0cd75e3139
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8756046deea392b9b360001faef835d59c025c3b7715eadd1fcaab11258c10ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a637f6ed3832d1cbd42a7e07af1e3befdd1a776e2ecb4748caf2e4a7ca8ac3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5986f4b8d577aee6b9b5fa452f891a6936e7e0830774d05ec5ae7e814bf09d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e5164395648a3bf55e254ffc96f43bd30e3ea6aaf0cfa3535d9888d26e3d41e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e2a0a887c8646e541eed08465fc7960d5ea2406ec097052a62269b0bbb35e23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf6282117eb187adbf20cbc2dcc2bbf707bdf318841ab2dda82cc17476167f88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6356a453216b010902bf031a8868f277a8c3c5df3cfbabf736b52ef6893ac060
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c4b5b433b4c49d4fb8f5b64f47074a11ff0caaa7beeaeba227c2916fe633bf1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c46b05f3cc610109757ee14203bf6eaf4e1b5aa2078602ec35827831a7e3e5d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4151de33e1e71ac29ed5899a57a292e75731f6830759a72936672beef6bfb9e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f41a3e361bbb1c3b4ed0116ab66da3288327450654da10f2027be1d29a24d404
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8183244ada5dddf3fecda208f614248557989b3eae5ad0911158375f4c8a8736
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9d6020562b6d0a7318d741e5cfa78fa6eecad6e0655fce82aa455e2adb1f4c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3382678f14f2acd63447d8e67db51543c7f8831c8db5a4e836ad2df14172913e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14c89ce30f7dfd47dd8a2cade2dc0b08eff3edaa26bc5c51e3bc557459ac24fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55141e55fadd064e6c43efa41f1e8aa60ac5ce88fb672fb64410187bb140baae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50982593861dd97b45e583cfa5778c51678ad4e5ef70fb2b369e2be29c57201e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ef603637f193f243f23cb1bdd97ec6603e30779472c6eee587098abf733926c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5cea834b88d8713e28086267135b00bc954a18ef5a2287314008e35f47954a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54c5565e12134554e48bf2207060a82bd96a895f5d6de2131d57c123e3390779
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad0f38bfc8f59f665d7f1db34d233e662bd2405ab4e5bd3bd0d971ca5abd0886
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8750ff123045a7779de8fbf882536995a7f34dbd5b66773bb86056912dce593c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de1ac574169174564b38789bf818596ece41e9cf00ea3b1a62437624a09638b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8a5adb7cd606afef82dfbee15963ba40916d978b8011a2ae2d1e5a87f1f1fe1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3f49c707ad475be70c0a1ce0b610ee9910e3cba6ec4b3ef4dabcdd63394f18b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2e6452eb545c0e768d7d69f8e81cc2a51a84fa100e41294121d64fd6a556028
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 414cdb378c8fe68148fe8375772430843b793cabd12a18e2a21f3944c85c6bef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d09dcaac9ab772c7a48d271f03dd35ce9db089ce5a79063cc4fd8fa1f846a77a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0d50cbfb48187290fbc1cc7bb7cd172edc2a3ee87c22ce45ef974fbc2c7f52e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11cdfe8e452ce1fe4001e7825d4753c31e26eb60c283346426b0b1e52cc84d6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 649afec582fef52b42f741c978e338f703a8870e19d3440cff315d3075465605
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 783d3300895134bf6326df8d210c94521b032b5b4f109705e6e405b212518256
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7f3883ac51f210637737f991fae2ef3b23f3410eb050c9f08b1b7ad615012ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fbdbdaf700415d29cd27aed2454fe9b5e2c761d57fc942a19b485738fe7e85cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d33c9c835449cb4e8c9c5f5aa88cd164d17c937387c1759f7991a10228190337
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6063c4a2bc91bb5f6db5630ccbc9aeb5140e274a02bc2acf0f1480fbd0de835
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fe96f4916d63b43e5702d00d38a5928fcde9a729aefbbb4ce38b62fc6ed30c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff9b66fc31967778fbd090175bfeb969bd765cdda926b6b59b444214a4525c1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1407de196d5a2dc801fd081e3f9d7e61f5b24ba4565a2789cb3e22d86d5576d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cf05ba43c9100c7cfd233f3fb488881dc1c481c009fbb4c2b48ed06e1e40626
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8382d8cff3ac0df43790fb921c97b547f6005c94b099784cf8d63b50b3e23e3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f96e531a259fb9a2fdd5c0c550944f605ce575123e089098ea40f602d88c34ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aca30fe68e28de05c8d914e6dc342e71745f3dcffcdc2e105d577408aa5e2745
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b27dcff0d3f879627e30bf13e971d5751c0e1f0f509c73fd3f4143b3df635f2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 502cb7627a5984aafce5cfad38d9a2ff4058ed9ca1cc009b2bc402d27562c872
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 687a2ebab46a320db2d594e2761758d06e45bcc4689d18510426436e60ed9c86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dcc2ff743dffbee9fc7b047cdc2c93e1cf311aaa1534dd0401e9d87d8c1c774a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 229de540f1178ad4f75e0c83f8449b67755df47d65a98b4cb278619c16f84ab1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfdae92d8bb546ac824dd04c0f9d2b756396c33eeca8816c1876824d1cd63ae7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b32568f53e6d707740b4204beaf739401fadf5207d3303f33b0ba41218744a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f7f8a389277c9f3b4a24585a1986f22766624fc335dc3ac58c5a2f5315c2cdc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40a53963fcb896eeb6248c707acd19a03c556b19b153ac77f891d3ebcb828b2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9e193259d3431a974883470b6cdb1e487682173bca2c4824ab582b1f17d9b0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbcdf2bb516fc8c860cb08c84394ea353be611bd61243a7d4e7f1ddf801b8244
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 558cb9e1e1b4c26bef703c1576d78ec3d3f791b9bbc67f0988cb3ab0cd6b324e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cb12dced66e98a7ad8088d363498009611621b76ba3aad8ac7846220fa22dd7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7f4ea7f96e9df6634ccf34f018b58ae9a4002113cc1d1be0de7c0e4a4bd65bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1583322e8cee436703be640348e09c23c79fd84b37e4646d3a2c847ff8a38dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8f979da834947c3258fda1c0732509ac95d6493d84b1359d7526fef8a4dc8c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 147bfc15a266c99b92c5a0f10b6acdd0a990ce40b4b9f50f193c5f0159d743bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c085ec078d9238a010aca039b0fd9e8e85b2410bc76d147f8782594f0f658c6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9f18e4019f66802123a4b57618d9b8fb4742d2ed7bcc3ea9d4a3307cfcd5a98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40ab855cbd7127dbd857a873d56e8e886489984757aa82657cb124580e2b9f6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9628f8dd4bf3eedb7616cae7154e2ef84ce294553894e3a283a301d2efde60af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ffcd10c83b360f845853facd322e950f5e7c9c53b27a4c798555c7195c17482
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4fcc9101195d9e34c87b9a2fd8c80ff04557f50daa5d8852658f678c26c08d4
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            memory/4212-94-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4500-67-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4500-66-0x0000000005040000-0x0000000005041000-memory.dmp

            memory/4500-22-0x0000000000400000-0x00000000004EC000-memory.dmp

            memory/4500-6-0x00000000000E0000-0x00000000000E1000-memory.dmp

            memory/4500-7-0x0000000000160000-0x0000000000161000-memory.dmp

            memory/4864-2-0x0000000000400000-0x00000000004EC000-memory.dmp

            memory/4952-69-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4952-63-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4952-5-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4952-3-0x0000000000400000-0x000000000044E000-memory.dmp