Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2024, 15:23

General

  • Target
    80fffe9ef8dc02ef7e041acaf8b8e21b_JaffaCakes118.exe
  • Size 696KB
  • Sample240801-ssjksa1fpg
  • SHA256 d3de82a8840de3978014e00721d7589439ca0e18d5d20994eba0fed78451febb
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • 127.0.0.1:3000

  • fokzebi3ad.no-ip.biz:3000

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3384
      • C:\Users\Admin\AppData\Local\Temp\80fffe9ef8dc02ef7e041acaf8b8e21b_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\80fffe9ef8dc02ef7e041acaf8b8e21b_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4828
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2188
          • C:\Program Files (x86)\install\server.exe
            "C:\Program Files (x86)\install\server.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1680
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 576
              5⤵
              • Program crash
              PID:3472
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1680 -ip 1680
      1⤵
        PID:5104

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            server.exe

            • Path C:\Program Files (x86)\install\server.exe
            • Size 696KB
            • SHA256 d3de82a8840de3978014e00721d7589439ca0e18d5d20994eba0fed78451febb
            • MD5 SHA1 SHA512 SSDEEP

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 588KB
            • SHA256 7dcd03525f5ec7b0edb494404c46c98f0932976ef6edec35cd286daf00986270
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 148e701fcaff683aeb99c75ed1775dd7e1c797306aa5ac78104031f8bfa9be22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4dd3e7e3dc8f3d990f8c7e828cf2a1c794a48b6226912debf5440bd75ea84a13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 374cbfe5ada49979a5f7102ee740ca98bb6368ea3594744f2f481654f7c38936
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7ce88a941f906cfbc1d393ccd589f6eaa882b71fe71b430e880aaf19e6bf13c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55fd9e50b5969f02c95b1e8ea3e1200bc7aa911517d956b7fe3584369d3e587f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f48b3080863f9aa416090338dae7ed4a3e6db0f4442a9e6e94e58b1d851bce0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aebf331a00193f5305a8e74b16901a2c465580051cd55bf0237648e162cc88ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 274c6c69a54c92f6c0af4f0968ac4be5ac89a18a6477f1adda8f2b0a40f2353e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a096f211474c00c1d5f37cdebc6319961c4b2e5ca5ef9f4c2dc31c1c831b9eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 237129822a45516c7bb4dd6149d0ef3b39d2c2901992da7de42ca890e1d972b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 881e2328e0fb763e788474ad9a0f54fb0bd70afbfc9beea1b9fc902d742ec9be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc44fbef748f2d083db204de094b4f6e35c2844fec36a42a62dde9e59714302b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77d4b96877a9f0286eea326c6e4dd65be1e61b47493e8ecf32b4f881b33b3fc9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ec35e6647b536183b7e1a47e4161fc2e5290b868d249efedf643a9d92617185
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4df91ee490c13ddf487c1c20ad445a336043dcf2f8d5bb1850ed00c84a3051b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 359eb7defef47b7eaca98ac3c53f2032b7d6f27178e3b566e5b15623afca4bfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 521d82a490b8e785ee503fd36a84aa3c853b5fda5888ad2bb8209caafd6151d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ade745ff44c2e899fadbec64913717e1fb2b573db0777627ccce12fbc8ab2173
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ae0fa4d03e472b4c4704a5c5514d17d630403a750c67adedf4d96cb1451797e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ac7b6ecf4f666785ba20916830d0b6887986c965dacf4b195585e5ab47191c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be902fad3be10a1d83996a3ad1499dc4959d7cb804e80ea7df8c939532fae4ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4c0ec5333d6587fcdd7a7b8d0f4411fe106cffccdcf8b90219e4e698da5f50e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2e15d1a81fa8a1483bf2e001b5a04e857c4609ee8adba98e284b9c67d8f9946
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0820785433d81e8acf6db09cb87f96c2b425c39138746f2843669faa46532036
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ed41792f13b321d70e950e54acf005ce93dafca96239a894fea765df388d940
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e0ddb47f59fd1759e8cc22196f365449a9a922d1de00d612a928ad63243628f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f3efaac3e1adaa479ae702c0503e73e80aee782dc1ebe1542a915f591662f82
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b30617c62ed5c78f49179cd33d1e005c0e74835c65a1add6b08a990e00cccd95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed038ea03f8b8d232a8b306462015b946d950f13d44feba2d49619b7a5c243dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3edd78b0684492e75e0a0bfc41f7f84b792ccb9858e7637fb69458738b1bd908
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ee870b6a4cdcd28726f75c26846d5abe622a92fd8dd7073072be6bc742a2bf0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16641ae2d487acb8f2faa3ff589135bd950a2c80e365033ce34b3dbfc3b30632
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a392f7378f997053d08a84934cc4ea7d2f05608c0f12a642545d88fd9afedd97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64b5c7bbf322d8a1fad522aaf4afd8ddfe8ac0866d583962af4832f13dda4e4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b58a1fe35790df10ebe245643094b1200edde4c11078110804524048acec2d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2907d006a47f9a529800357f8d16ee1076c80d4706028f414a097ed7653c6ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 640ffb2a394327e258ed669108c153d7d79c43b5aca2796e6244f286bef12cbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea2717262e4daf9dc65631d0e87ee213ab7cded01432535aae82afb5ceb058b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 698371262e91ca52b04eb4695802bfb4f70ce90f87c2a7d5e697d3eb14895158
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4eb56bccef4cc76b5bf66baed23b259e7c9ce31f0eb0750319d5dfc42f12cae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7240867ed899b71dd3e4a9dbe42a85583ef035ecc8fc88191bded7115a0b6fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b23107ff4a7659aca715d9ad44edfd185fc9618a7e5809b28f4253363ef4113c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8008dd797a98a4cadd952de8a86bba0d951c86bf338f3a6aecdb776e88fc45e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffc9ec63a5e9828a66cdffc8b0086e39dc6798b83328a1651531a03123ac4ed3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99cbd9f8d9816ad6bf19d26aa848fa980c6ab28f9df8c7e4176de4b4e3c62dbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db2372896441fc16365714f99db977e0430a1d37243fe5e32df6eb67364019e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f91a530d4dab67e1033f862bae6fe4029430ad6953e828c4539373917f3fecdf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28580b9f73ab3449edc4296be66e83edf9d8ba5ddb9d7dbab1fddd7dd3165b0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc5fed2cd70fc94e5f32b8390bebcb606d4abad77479648d2c474a2f5475a69d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26cbacb1b41a80695bb0a8d0642cfc312946993182d2a4e4a01399270b74ec29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acc91d10f6f67c957b6e7ea9b3362621e67328f82879f868b3f3d58b8cfd4083
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6005d0a534e9518b62174a8526b61eaaf6e1aed3b5a8d72e6859410fef80e442
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e3fd7e798fc272d0a118cb5e2d01a7a18738c1940a64f42ad3eb417b463b548
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1675863ba8eb65ac61c9238285c1a1cf91b6663bfc78ae3341bb9c241f1bf72f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1119cc6723dd60e3f9a610323f431533c3423c5c9d36071679288955ab83bca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 993327795f52dc866cc5ca5e00d7e1175b32c524f7881ed3fa77b28d1ec1d32b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1713bdd89ab60c13df4981cb77b5513ebaff77b25b3ed27ae0eef6c80856f74f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6eaa2f93e8d3ea314871c2227fb8408ec9aa0d3cd2a3dad413fa7851728d2139
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f47818c3181bff3959f7f94dcf52a94f8c5ed4b1484eed04a19503684f99197a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 655aea14f1f578f0d7c60d405d7bc6c3413c6670d163e69d5053ef4a31642123
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9ce0c3eee5c97f79cdaf7c157562582238823c99c6a001331be00e3d520a31e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 079d1472b04b9d66fd437e04ad3b286e108b4b450afc309a2dbe72d3216e1c91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad7c8d3815522dc8b7f5573eceb66e9376a62485fbab26c3e3bf609aa60857e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6fdaeedfe42b88be10bb71e6501b8e94ebad939fa733b5d3d222fe073d79f6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 472bb771111a7fbd98046ff08a4da55b10623480b9a7192b098b7ca39d4a5afb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7957c3b1664ead6139e98e4f7eacb3ffb5c0996fded26f3fb4820c793d769cfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bebb2a5dbeaa4a33a4a5edd4e26be76e1f5237a0ab0a9db72e5d97234aea135c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d2eb2019ce02c046edd3bd4f3a9cd0c1d46d883d16147a59a73daefdced9451
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba2eb440ab5ee7d400fe819bc2323f8adf92ec056ced0c297b8ac2b9831aeb8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71269e2717e87610a685b407bd4feb45fac40776ab23384b1cce641dd966ee8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f689c9d3a9ee333efee8ddcb81237219227dec80955105a16e8a5777e0f0958
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 664836ae7c6c45cceeb8c56aeb3daca7be66a07adc8388374b978254d255e1a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 353441973d5e6d23020d55d2bbfd6095fb127e6bba1514d2084754d4e5a585b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25bb7442f54a499f16bd4fb084e792f8365867c42a41b55c84f9b03bc66e1302
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f0b90cf5d1f67f6e83131c4a43f35b024427bbe88182124fbff76ef650e8c56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 676166f8cdf592973f4086632a9377992d53b22b08da101b7443e78b7e3bde5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bf98d56bb95f313d768ae894d5505984454d714ef727d3a9e138d1d0d3dd718
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 150a14b2e911f5ca2a48ee72d6ef22ee4369aad5781bb24e9f7ac7c4850893dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88914364cf471ebbb51e8205ce253fe2bb7cb3989744a2dd316c7eaf60ebf59b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 588daa278b66db60854e16a7f23a846435b20e3ad82759a94ca2714d11580db6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07291d51dbccd59374e63509ba94284a815321f38d19018b41404d545239cce1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee10d4150d2f31480b9c35b719f8d078129a948b5f1e595b65f1428f06dcc471
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0135929d11012a05b52d6237ddde8ff33dcb1e5d0b02cf7c58d536200b287795
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a4e52e50ee14c9ac2a341cbc87867cd7907807376d51514435e63a28fc5eb4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a92d2964a3a5bbf724d1a07804e425bc741341e5b5dd4824366e0a67f93f5466
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2c60f3bd539b277b769425bd32e531fbfa355bde52950fa99bc237615afc3b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a40c86a030c804111b2aba780631b00ac7c08278ac09e79889ef7922c2aeb03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17f81d7d94f0e72a812478d5f7421b60d389f369fe667cd1951a9d6602c45e3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00c8569695e020e69f380c50054a65e3449d79dca3f3cf41489ea73ce0888eb6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2d99ff77f299386272e93251ad5227af500e0311fbacee50a4b3863f2378905
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 051d346cba3043fef9183653e54a10bc8cb8112ce9bb0985969d98c9f9282374
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de1d21afb91e3188877b709de61d18b4ec12fa8ac05af4a6e03da4f75ca51f8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca0746ef384f9a9259455c3a3fcf0cde61b417964c40b8a984ee6943badabc0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fff366abc1537a78bb28dfc985bce2e06a446c96941cdefd32473e3c581562b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d1f17d9c2a5f2b748e492fe9fcd9ffc321461120615a3f866630e4da831e19f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb7e17fef70ef570b1cd7eb36c67cee20021de6df20b7ea812d9e5153309d4c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef73ca26d22a0bda9d91d597db1eec82a6b7b6c2ac39cd8d09a650808c7ed44c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e124f94eaeaa6c0bc6fe33330ca80b21f71accd710b48147b2796f92f8dd8e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bc3a2cf59a828fd6233a5f84f037dadd31de77febe1dd97b4d38ae45ec45890
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b074479eef0e40d7846d45261907058fb09997c9e500f7281d8847277bf2da26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3aa482fa2a3c67f7cc9d47195673ad74af6ba0750dabfdf8a9db2c609d9e0d69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2752a22882dc8b310dde482c867fdf9201b64fc7f6e79a7442580419659a262f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eae82ec2bc9640c7f05f98185c476c414864539111c0a0e375acfeebe3ad4e29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2b709aeb1d706118b3a5a5ef4845a70ba3367614f2098f856f5795aef77f229
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7e8c61b41146e7d9e1a0f2a3784f18ede6203b26b37c7048bcc80b93ac113f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60a2292869c6349e924b2821c7e072fefbea54fe64e981d38970d63a78327b8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35f7748ad1e93699ed537d26b45bdce5da25026b2146f35f221144243f6688c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27df6c7fee2d9ecb8638598a4cc0fa1b1362ef64237d84def77127ae609b21ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6573c87e8604a93d783e2d88bc5ab8e784df0ba62cd86c8518074ef50ed9253
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00c8bfe17f41ae47301a3428966ed7b7e078f1392fd6ddc3770ce1185f715f9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a269b2beb6abc0aeeee20712c8a474bc059659faaa78bfe005ae6e9afbdb4b11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ed0750983b3666cfbf5c1e78b3b3159e7e047675e01d2467da3daafcc45f588
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9130872442cfdfba9d56f9925efa3c9f686fdbf0ef9a3c737fc428ad5b0ec97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3cea2b9252fdd4c93d26e04aabe184aa101b59a435a12ef6725a8eb5cd93e756
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c3747fa8d07f128974c4d1747f7bdc02dbc1fc2438960cee5b37da98712cb58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10d8e02951a41370afde87632938fd4454c72b3b0bbf5a58d3d5c7290b3f703c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f387eb70cf2bafe23d8ad50beb4d5f7bf2095f0ce5aa054a9d60228d98963e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20454133e07b648d61c40b52bf1b6b5e139a6563775d507dd145b82486ab1b66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 588599e3a06603b60983906db6a6d7fa14dc0e89ceb1124685d3a768efca6cd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9f1d49a0f32653d44bf6c1cd2c69c3979ac09ea429d034af8c7377297fda7b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2479500dc1a2c7cecd469f7e6501692f8ef66464758d70fefb58fa49b920832
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa16f3886104a57024f0c5dce9068a319931f2ded5210554ea21c8b548967b26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7726a30090c32a2b8d0d2b886ea88daaa313644bc608683d35feef75a55fdfd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd8e5d88a789c3c23ed8597a260432e5a0f21dadfe582c7bb0cfc6ddb06e6f03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 345934edec6e838087b93dbc35725f0579f67ec8fd9f6c36dad3e19a673a32e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8afaf6d6e7f2823384d776cbf3c40808f5228e769916f2872de8b19bbb5a1592
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82f5af7f9a0a8523e4432ede20d8987c98340af3b14bb9c4dd8a221c5f4a5489
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0c9272f564220f30f67f5ac47f6f31e139e6cdbad73624c537587cc4b2ad15f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9a27853164c4a56474a3299138a3634577abf650ec20e5ab92203eb19873ab7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3450ac26662a144b10a6d88af0f05f2c016ba6b57135157f5c8d178bb8538ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a81d1c8f1fd39637bb956b960bd907bc85c615d9a06d68174e70a5c5b224e84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fda2b907bb2b44b9c040cf38d114b067d5914f296c1202634514ed90c5adbbe8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 303b4cdedde1c7948b67102c3724fa6c938277f68448894a2f1fc7a9e720f450
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2deb280b9de026bdf269dd75bc2159482a846f6a6b97fd119c135f8af1a9b552
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e471e9ec5f3357f5090b4071f33825eaf5de11403e686679c01f252ce32d609e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0f9fddd56f22792ea92c1bdfeae80f49c3fe961077fb4b5d962791986ad3969
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd75a1f1a5826dcd2594ea486c43de6f1b7266b197dc69c34798d209f6661528
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7819ef3f65f46877343cd779c66e99a718d194ce774a9e9c17a514886aab1154
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32ee4cf583c50d3bd9df6c17234df2e02ea66d5272d87b792742da91b7e5ac1f
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/1680-705-0x0000000000400000-0x00000000004AE000-memory.dmp

            memory/1680-706-0x0000000000400000-0x00000000004AE000-memory.dmp

            memory/2188-680-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/2188-1799-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/2188-12-0x00000000008C0000-0x00000000008C1000-memory.dmp

            memory/2188-11-0x0000000000800000-0x0000000000801000-memory.dmp

            memory/4828-679-0x0000000000400000-0x00000000004AE000-memory.dmp

            memory/4828-0-0x0000000000400000-0x00000000004AE000-memory.dmp

            memory/4828-10-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/4828-4-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/4828-3-0x0000000010410000-0x000000001046C000-memory.dmp