Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2024, 01:59

General

  • Target
    7ec4b4c93bc9a883a701cb1f8ca00964_JaffaCakes118.exe
  • Size 411KB
  • Sample240801-ceszaszgrf
  • SHA256 a5b15202860c552774440d593a94eac0d0121d7208756b939ca6e7e92224dfd5
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • serveur-hack.no-ip.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3440
      • C:\Users\Admin\AppData\Local\Temp\7ec4b4c93bc9a883a701cb1f8ca00964_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\7ec4b4c93bc9a883a701cb1f8ca00964_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1916
        • C:\Users\Admin\AppData\Roaming\msconfig.exe
          "C:\Users\Admin\AppData\Roaming\msconfig.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2396
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:2272
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:3400
            • C:\Users\Admin\AppData\Roaming\msconfig.exe
              "C:\Users\Admin\AppData\Roaming\msconfig.exe"
              4⤵
              • Checks computer location settings
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2632
              • C:\Windows\SysWOW64\install\server.exe
                "C:\Windows\system32\install\server.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2180
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 568
                  6⤵
                  • Program crash
                  PID:2652
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2180 -ip 2180
        1⤵
          PID:1096

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 b0c15fef985b2b2bbd16f94f8cb5e47347d9189af117dbb821d5770cbcc09b80
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 269KB
              • SHA256 f360067e63a9e4642f8b93d2ec67ad05d02f554afbbb9d7f5c0b87822e884092
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c86458858374d6470c6072bba5a3156093bfa5d4e4e851b6cc962a4013fe95b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b174a162eefe9241b2784eb5e8a8bd4a470661253c6a54feff9df3f5bf98ab6c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f5024ad7b7b6c5ae0534f7d7f51b5259441c1fc62494d5ab4c0771119f9b115
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a05cd417f44917b204f759093a2d6d964f8c60c44c48d2444edcf0a24b79080e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9231f4296debdccdc21ee85a63bc39975e7f61423ebfaf25db9061cd8d9ea5a6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a78a435d6a51eeff99b7eb3c530efae0fc89e1560f3d72bbb7feebe5948d7a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f395fdeaf14c9dc702bcdebb221c0361d3948570fa88ed0e4eb0d2fb066999d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0677f57e3186d0a1faa3ce58fe94970843e1536b51f1949a99831a873af7c04e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 324869296631f98bad5e49679e403638a3088d6a4fb1461f8850999acd7f876b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a77977fb7804dee57772db582c373a4e2ad17d85cdf2ceee2863050d2916fbee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7e912b82eeee7b784b594da3cd6ee31c496904c541e50826b3096948d0c9277
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9b268217637bbee0a10b88e6702c4d201a3251ef084d1dc1713e340006d9340
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c3eda0610cc853c6d789164d5fca593916d355bd1947c66d9b23ed94f3b6830b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d48cc60511a87f12dd91db1ff84a2ecea80d4f07c40f1139ef8d1ad4b0c10331
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3033894d585fd95543574c2c0c00bed12f5c2290bdea90e3feeb2278b08b923e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa865bedcde1190e015ad343cddded4f951212633a4fc692034e657376a146e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4c3a015900fc0da5c9b24bdfd3ef1f765dcc8abe26f8b2af05bf5538456ba0c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b3b9ecc7920d2d3a424d507acc18aa35ce16251b786ff2d5465586eafaca6ea6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 475652c2695056294b09bb09561225dffa54fbc7173f141e2959e46e28124b2e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9fa16fb47aedec1638891cb66fd015dfe07ba0f1440de24d4d084daf4547bc0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4ef175b4a9c0971412936787c15e07573fca02e1033dda4e74c3a7aacce503a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c0f52e7f6532f302a27e094a74fb884ffd04898c37977a415b7ae970ae46f37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1cf68076b323f5841b70022165acd89fdf51762c31bcf18fefb29f362987bae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b56b81dbd78cd43a6e55d3865c5d27377009fe1708f50b233d532c39665221f4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d20f56cd3b9782afd0a818380fdcd4c9ecd53ac5b7481a698b42b454a4052c55
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 654eb0d4c225d0dfe94d8f6fc32787dfe1616009ba6ad0bf42c7e6bba8b54f03
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b3e605f8bd1d2d22aaf831c2f29fb6fadeefb389b304ef8ec8800ebb0d36fd2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f909415b574e55306eb42b27cb7c495f529956b5f5ebb8407f06c8d1c249be33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0dccd4a9bbafc527ef4aa148b0cc2a8b60a8757e06075297d5d1bada09ea9c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0f1b6dd355f15d8d23b90733e0d9612a29bf84537088122e3bf37c1ba4d613a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee688ced3a91c55c9b0b7d1b330aebf552ef57c74c0233e99a4f2ad090fedd49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d9ffabdb68555e6c01a0943d1af886f86804755420333d65a2091448ae5831d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a9324b0d8d7978077e595c0023bb0aad6c38dbdc725e83a618a1dc1114529ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c0524177d21ace476c64442bf9e1ec2ede3b09a05b509bf51d04678366feed2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc068f0e696900cf9362341dc1a1cc436934996b8d399ba7d14a9a8e9bd8a020
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 040ac0818a6a8c872e90e5f8800a733d86008cc050e303bb53eeb5953eb6a89a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0bc2e03f7158fc6c259224596497e80ccc7939f77104c145076f43c79964f62d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9e30b4ca99c5e9f45bdbe3295e26b8bc5cf127606e5f4a24955a7cf35cd5972
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e569423bc3ff6559afb7988b2cd2253c48c027aa0726adf627c0ecc2b3e2b9c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85f1030417128ef0971a09df3400881d505de6f6de14c635ad5f99b2e461a6e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acb5de6ff39fd62154d7ee3aebf4a007ab4b7d18dc0b82c0f5013d622bd5e956
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5faf435d26577136eeb38271a7008440dbe1bbfb6986f9e1e576eacd9c482938
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c8eb938f4e9ed04e91141a8b960ef2503e9573e4e18458dc7321536c848071c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9d5d33a4cb7990c8cb6c70eae2666c157c4d80059c55c3a0b7dfe2e6a9b947c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dbc2c06b9dd1bba9bafcb1a2b52b21b7add20f697774d13d54a058cce8514a7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 458290d6f48ee84bdb203cc89c1b327942aea178f09d393628c3e50ccfeb7b7a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d2b05bf20d29103271add77382673c8a41b3b757580bc1f481fae36f85c07b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 227a2b7c27d3ab861febcc0bf429ea89348ca60c8c50d4d0ccd6556a1c826bcc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 283700a917238b7d4aa43f29cd07108723983650078a0e3dffa7f877f1e5c222
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b5ccae73d43be4a4bc24fde589de340762ceb098a6f46eaa856b6840fb16dbe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 06348d7cafe2e0260223c6bc55f6786301f5c3d2cac0c6774ed446c37dcee7c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 607f45d2fe01d2d1f96d856ccdb5ae222a1fd6f50ab835e7513990eee25d00c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ac51c90c4a133a8af280a3e86659387b786968ae3f15b0d877aaca2723236bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4235156402e681808479408d301215e404d5bcfe0be0487bf29cdaa9601060c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4395e4b5f411929da3cc2e83506a30219ab10d4ac052020603c41491338aab32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ca25484ec46c4fbd7f48051020e3a191b863453e80959317794b45077afe3ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27a5d1e98961df164fc70f5203d673ac1416e430896c93209c04e5ace1a18a6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a46f2fe42039d1ea77cb4c61b0964683bb065892ae88bd83623ecb9bc3b483f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 221ffd5f4803e69813f578059e4183dfad21be804ec6ebbb406ab679144d3635
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1761253a5a904d12c4d09a1bb5254b0b66af50e6f2fa3e0788cd53f9932f1c7a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de42c90a488723fa822309ea1ea82ce928fde9bd272fb978e2e27a5f3852e7e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a827786a10f664b883dc849c32e3f631533bca1e503efa34f8ee7917e43bfe26
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6c3b51856c251c233d7bf8c05716a017fffe5e3747757443ec4c1e548f75f10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e92ba566ff55e26598fce2bd9ffa10efac70c28657289da34195f7d2f47448c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36732f5f3b2a9d56b61ddca37be1b7faefcd362072eb76e0412b896274529d95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9dea4ba6fb7da69ad394d8f2635ed44f648ce101da4f741eeb4e7951fe2cd4ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f392daf3d38c57c38d64e7d55c82068206f013deeff90f865a63deca769042c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b039034a1df2b179d044ff405869071cad87ec2196b65d74769139ef28de456a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d932a1e5a7177b7dcf0b234dacefa9f55e53ac1ab5c83f9afd9761be1589e3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bba79460ac8154d4b41cdf86fa653b41db8bab23623641db0561570de21ad795
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9b6e58daf4aedc7e82128daed31f38776ceff319918a235b4d3e665de84957a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 662afdc37ab73069b93c1951b2cbbf798b2addeaaefdca80946e18fab3dac15d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69e56073a77b2e8a95f4bf45a418ab49ec1714c622f0b55084e787f388c603fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa45b458c3a964e8faf14d02819c765fc45c5e56670f0dcff80694b54fc57afd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 04422f5dfc1d28d8f754da4a793bc67922182a2a4f8647e920c134234512a615
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7f56cfd580d1499462b8e95abd88ba2bcfb9e0374749ccf3685c90238e05c86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acca9498275558f158c4426b9979ea4bca1e83940b08de2e833b9cf934d9afa2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5ca3a811296ccc41adef098aae5b3601a9f6745dd5111dd7e900faf4d89de73
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d0e84ba3efa5c6db52cd2e934e099c807a1e7bffacd294634e6e2eb26bc0fcd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b51949ffe0e9c61c0730f2df5e2dc969c1705799680645215df3a77287dc14c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e13ce456d58237ec3be1e5dbfb8b71b296979d7c0609a4b60994153e340ca33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 543591d7f636a7585c011de93c44ffeee96262ca41363561757db07b46314671
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 88526e9c3d9f6e350fafee3c36776331eb75fc849ae8e3109598171ce9e41375
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a2947bafbba6c321420bd5bb6afebde20917065016eecc13b417efb3696b106
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 119444693baa8504fe6d6047d0baea938f66e4e2e406b0b472962042baf9f13b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6390c710368bbe380dc38f919fdd8a2062cd11c1f3f409c0fd7cb40b8471e27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54e071b3bc242edc5aef58017880eece65760e116af1e32dd5443a46802c75a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d55dce245eec3445ebe22d5751cccce6eab1cee370172b15efc8a7b7bac047f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 37498a9deab61c58303258faa9abdf29e73dc715398595794361515e31fdf574
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cb5e25ccbb3cff9235bad3e4f75af007b53469aea718be652fb749879ad6f457
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c0b6bd6d61f924c5280aebdc5774efa7357a723c993206f1b87ea6a223f3fb5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8cf8be01981186ebab6b98004f56b38d12a17116399405601a4d39d7488566e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42f682bba4a2d40e37bc284a21cab225d3b2bce57c1a5e881c061c77246a04c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aac34461105aa103d694d8bbecd13c8f0ee66efe3aad3c29ae72c4bd22b774c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9b48e8d4d727b5cada982eb0fe908170ddb430c9145cdcf8653f9aa13c07ed4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 197ae322b31779acf7547830a1988cb6991132ba6c340a1090916e5fbb4b04f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fcf8a418b54dfa1e6ebb12767af6994d75a1fcffee3975c01db6344ddd7942c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0db0944a9a60d7987e02488b3b6c6091e9a7627130b401115ad4c9dfaf126521
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc1225ab368b261dccea2159fd6364dc08eb5ad7dc4254ef0ebb601f7587dd99
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a6691bf2f470ca3e44763d50123bac0b9d38ef6ae9361ec8859d9498ca6239f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7198d991fce6ac5dd4be8b556abac1e61c8bd1b0a2f387870603861dcde27117
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40da2b1fe1d0540ebeabd4c8e4dd0c5c395e4d7b9379c6cd6d4a4060cb325e8d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 80c072b9e92daa8294bd99874de48dda652e4c48050c5701c1572e05b8f303f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d525a59ff7e2ba0bb3f53c8e9704d2e2ad95ab3d535d15b67ec7baf7b7acb917
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7984497a47cfb62115b9f0ca2594055c631429edbe80132bccbf7e1b77061201
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 21cffd63ca8996d1e341a03a660401f975cdda2fdf52f21fc6cc974c3ced377f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e3b5d5c30c01966a7fa050bcf8c919c78782379be687f7933b67abe3da0e1bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0c6c581e78f313ee7e44e6c392a8c707521b8de80530efd4b9df27cfc17ca6d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4de50fd7e951f189b0f0a1b3421ba65bd2d898e58770f5c2ea7c545333f4f8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca227a07a6b70b92329e21f86a3d81e0676c6d36c5f67b747ab8e838f3d08997
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4df069bfee32765b62b79d16be7c487ab7a8231da5f768a5fc754da62ec7eeb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1964f9112f6fb2277969b5c3f7b37f0aa4c9992801b39b9bcaf2d04799c8d838
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2688fa960e92dfa8b738cdf3c898988fe6334606670495c0fb331b05579f465b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54e6138c7176919e04f3ac5bef6e24bab18558ad5653b53913c199acea5bc25f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9798b1259e0e62db37182678dd31616e5aed0140e0eb74ef8c10a36a965c6f2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bcfc307a7a601f1838b26f91e69d2143944db8c863c2923376830b3bb7f774d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7435b9a8c517f836d3c7bc57213f656f91f815185cc7849583db2feeb823771
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9923dbad7267e8028dcf01ab006b36e8926d9fce8e609ac08f9441c4cf2b7791
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6cc053a307bd02b554a11dcad28d1abb8a8d8af0492556c98a9400fb9f8e1e6d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a377c90da438d77804cb2590926ce1da4770e5cecce81d91b0eeaa9a38e4cd12
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d543f235dc1acce468175bf381f747fc48ce9be363dba825ee5c4f5427db23d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf841b8b98978007787a6bfc38928ec4746f2b436ec937603e46f36c8a9c49d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f90f92f5466b734bb4a13c0c8e4bcc990963081232bd8020637a05db6dceb9c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db8936dc3686250cdc7f497ee19ca493b4666252a2e9e4a4068b841e8558036a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 276e90a0d50446f513175997812e70e9c62f793da98d6cd59bbcc0ed0df8fe1a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c37efd9235fd4ac743623ff04e7e2560a368fa3b5324725792326ab83e16a872
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a0bd3cf6616219181fd054c68b54a208cc6e89c0b950728e89a6a78d6239afd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 044d514b9a3a2a3c0b48fc1deeece92e25437d3d0776c1e9eb6e3a7c6df70701
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66574e7120f1bf50c48543fe34aa2448b1a49665451476af2ef9d76d9872f8d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 567edc994c0e01000708483a24ebba36cc2e811b32f5316f0df7d0b716f5635d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 851a36fcc8b19e71beec1deafc58c2678ee752b6b5b80f429d0689a94be996b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7cea11256d5422d1a2c5ca6c86f0b1f3f42143a69dfcf51703abce7a7e67f3f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5ac6c11739758267772b955e17352e3aea9cca734e0f814acf93483558a7138
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32b9654557665879089e0ea62caadd6c35b660d04b23c448bbc79d5bb589fbcf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2e876fc4e7d39cf9adea43935b0b6eeb0f1a3fd06ee3da15734eb4da4d5f2f20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 559255fcc2000b1602c8779d4c7384200b8db74d804908605364815c01c074f7
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              msconfig.exe

              • Path C:\Users\Admin\AppData\Roaming\msconfig.exe
              • Size 319KB
              • SHA256 44399ca138dc24d2a53d53a10484c4571e6842a5d7d075b02c9fe970dca1a0c2
              • MD5 SHA1 SHA512 SSDEEP

              memory/1916-2-0x00007FFF5D480000-0x00007FFF5DE21000-memory.dmp

              memory/1916-3-0x00007FFF5D480000-0x00007FFF5DE21000-memory.dmp

              memory/1916-8-0x00007FFF5D480000-0x00007FFF5DE21000-memory.dmp

              memory/1916-7-0x000000001C270000-0x000000001C2BC000-memory.dmp

              memory/1916-6-0x00000000013B0000-0x00000000013B8000-memory.dmp

              memory/1916-5-0x000000001C0E0000-0x000000001C17C000-memory.dmp

              memory/1916-4-0x000000001C480000-0x000000001C94E000-memory.dmp

              memory/1916-0-0x00007FFF5D735000-0x00007FFF5D736000-memory.dmp

              memory/1916-186-0x00007FFF5D480000-0x00007FFF5DE21000-memory.dmp

              memory/1916-99-0x00007FFF5D735000-0x00007FFF5D736000-memory.dmp

              memory/1916-19-0x00007FFF5D480000-0x00007FFF5DE21000-memory.dmp

              memory/1916-18-0x00007FFF5D480000-0x00007FFF5DE21000-memory.dmp

              memory/1916-1-0x000000001B6C0000-0x000000001B766000-memory.dmp

              memory/2180-187-0x0000000000400000-0x0000000000462000-memory.dmp

              memory/2272-28-0x00000000011F0000-0x00000000011F1000-memory.dmp

              memory/2272-87-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2272-88-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2272-86-0x0000000003EE0000-0x0000000003EE1000-memory.dmp

              memory/2272-27-0x0000000001130000-0x0000000001131000-memory.dmp

              memory/2272-1087-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2396-23-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2396-161-0x0000000000400000-0x0000000000462000-memory.dmp

              memory/2396-84-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2396-16-0x0000000000400000-0x0000000000462000-memory.dmp

              memory/2632-103-0x0000000000400000-0x0000000000462000-memory.dmp