Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2024, 16:00

General

  • Target
    811fa20df8842a7e7f8db4a6976b82e3_JaffaCakes118.exe
  • Size 1.7MB
  • Sample240801-tfw6sasfrd
  • SHA256 975497cd74934beea17c176b4fe0f08faa9187c1a4da2f32401e9181d89fc686
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

  • sonsuzadek1980.no-ip.biz :81

  • 192.168.1.2:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    ''ERROR''

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\811fa20df8842a7e7f8db4a6976b82e3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\811fa20df8842a7e7f8db4a6976b82e3_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Users\Admin\AppData\Local\Temp\File1.exe
      C:\Users\Admin\AppData\Local\Temp\File1.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3104
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:464
        • C:\Users\Admin\AppData\Local\Temp\File1.exe
          "C:\Users\Admin\AppData\Local\Temp\File1.exe"
          3⤵
          • Checks computer location settings
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2636
          • C:\Windows\SysWOW64\install\server.exe
            "C:\Windows\system32\install\server.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3624
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 568
              5⤵
              • Program crash
              PID:896
      • C:\Users\Admin\AppData\Local\Temp\File2.exe
        C:\Users\Admin\AppData\Local\Temp\File2.exe
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1380
        • C:\Users\Admin\AppData\Roaming\Sdat.exe
          C:\Users\Admin\AppData\Roaming\Sdat.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1828
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c ping 0.0.0.1 -n 1 -w 1000 & del File2.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2540
          • C:\Windows\SysWOW64\PING.EXE
            ping 0.0.0.1 -n 1 -w 1000
            4⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1524
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3624 -ip 3624
      1⤵
        PID:3720

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            File1.exe

            • Path C:\Users\Admin\AppData\Local\Temp\File1.exe
            • Size 276KB
            • SHA256 bb108dfcd712b1a0000453e2fd5ebd2b54889cbeac63493a1c509b6e3512c269
            • MD5 SHA1 SHA512 SSDEEP

            File2.exe

            • Path C:\Users\Admin\AppData\Local\Temp\File2.exe
            • Size 1.4MB
            • SHA256 fb5f53d880bbef1a11a2ee37ce7f3f1613fcc8a600c5806f680c8d6399072435
            • MD5 SHA1 SHA512 SSDEEP

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 e5bdecb116a272a99d72ecd1c24dcfa8d7b17776b12a92c9e97cb5a14e642126
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 eb6385ed167f7ecbb05f89f939b47e53476811423628ce45d864a5127d296ac0
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9729334f412bb944c83f3d59cda50147e8d659ec3b7c6091c58f369ed5ff51f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a673880e0b486053c38ae3d94e9d44eca7d423131c55feea6f3ae22995cf7ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53fa4b68c7b841ca4bb690afc6322a9d421ec10d14a103c8f0b7199f2f6341d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e60582538ff7b00f489084955d170a6a16e6a157b0c4c97c9d5aadfe5a192e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c52e0da20b9a0d160904bc38738c992b8f07ae25e56b5e47f20c555ccac8fa38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a5d666d13cc0414f3bdd885782ae4066a50fbd68473942e1e6cc0dda2cc4041
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ee08ff041795f03553e1adfe75b8a51f1f03d20d8b107292dd628c1b760b2d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b42287cffdb18dc7165959fd8ed62fddb48508413939812e59fb5e26255e3ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89562c6859011ce964a31a86923f76e14698369681d54dcc0be369f6a522df99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6046f07189a8fe23dbd9f9ef7b0601ea96fea2989d412c1577f72d62b6ddd031
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50a1c4401a99e722186091638f77129941b16b169406955898c594ca0292520b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 388b207a417992af9c7b6811814e3e53e45168a61d5596130d8c50749a7eb081
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0eb02bd7d81ac0547c31da8a7ec0392fc2d3194ac944c8e3caf5d90b2541364d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f04e3edceef7b1f565e179ac74d964c7fcc729dd261ab90dd86b90e244b4377
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43af7eb85615d860d24e522944cd8869715686e391ad6d1b56de2424294a8335
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9a807f2794fb31a21616de1c68e4047c0c962ff96ec66dbd56413706fd1d0fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff9c5da14d506f77b81f53b70487a3d975d7d42e2fb03edd1571a699043c13b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9fdb92ae5834f5456bd54072c51e0140aaec0d14fa8a1ddd8b0b066cbb6460d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9ae03237b99228b8c0fb502487c95523913e473de96bdc4c5aa4c4efdb36e13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fe3934ad010c61cc417576d06ea263ad502672a7399b2c702fe1a3b5fa0a20f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c80166bcfe74f2b745a7b2d9d47318ca1c2ad6f4097973a9a9b0d4086256d6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e43c8be8f94c39907450ea87cf30b76d50a41f71a586a16da85506fcab3bed52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14aae64a8f7b954aff2f0f87fa4f05c3ed96d03020e2a37a171a7b6d36bcb385
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74cdbd7749c9c46e1d977d9669d4349a9cff28f8c1182d9784ac94864ebad7e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6be1807796282980099947d06b02a3e6ff95e4cde7d0d0041d94bda61c959e02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f92188ac671adc5314e6b446701d00eebdda28f3e4d2afc4bce9d9a070390e4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 935ff682c3ac2d3c89f9ee59eefc2d812b6411cb94f2f4bdc5d7c9bb61c50578
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5163a506f9d7f139d82bc7fed38f6e60edf6138358c908c1ed97834a8af21c60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6981d03c101c58742226f002fa39793d59cbde9d9c20efd626c0039580716d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6b463eb877b3d9ec8000d6efd4ab740995765d63776f4ee48cfb7eb43054625
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 805fc3dc70f0030e42c269a00b5b7befbdd8b51faa6417d8f713024c6fdd8337
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20178af006a48ca7ef08acddec527d834191167bd60ef06b62237ef965e92857
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 871f99be07b3139117c918ebe5479a650f60a83681c2d0b12128ffad38b74e71
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68bf7b3156607bd714db161da0257d2f137c05160c52eead59abd3c7111e7cb2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c64386ca1062631cb1dd7b3cc3bba67aa1a6765843de89d1cbcc78353b3d66cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 589680519df248568fbe09b5a6929ff9f7e67cf97e2643b9ec4952bf0078e507
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd52bb3cf927e665fb84cfb584d3f65c32b86630d0f97599c4a94cf6eb579fc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21d9a6bad957645797285b0792c89b906ede0bbaea11897c1866cc9b888babe0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa96083926f438be0ad40b3c78cf08a8eb12ac43e04a58993880611194e5c954
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 172eb56a683938fd63b528e79153d821a6f2e04828341feb83649210243da781
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0483b58e70c76dd7c9fbd99086bbcc986df395be3034128282b8412f495b77ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3052640d2c34f61bae3670168745c2878c2b5642a3fa47c982a94436cc10de97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e779fee19dc9ae26b170ce147d0edac4c721ce3253288d47d4841186fea1599
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6575db64c680573dced3c773edef5c8b5d56485a057277b9476be71a0dadfa5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2da230202d9d04f736244fec1c0c6a550f07853d1e7d108c0d4d654704a7fb6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c325ab1d4c7947d19c61cd3cf0d3da0f372df35b890c730a94942fdb8afb9237
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f19e079c43f551479d5ada986b9e39f1e3665939fe12829920a0b43b50129ce3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51ed5087292b01e237e96a98134b2a949930e7b33d33273749b17e072439d930
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 393eb9f952055464bd5d66824d660a7d5030e976b741d3867b04eba78dfa7242
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99eeeb1410030d878f5c34d597d8b4364b29a92ae1e9a90a2625979c377be737
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46c0a81608a2fd16949d9ad73d372f58e540c4fee0c314c20202d53152e1cbae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52756ad636be8023ea74945979449c264f4a5a83b7336a3253da0cb1b601fe5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b61b17a5f91c58406b4ff838252d8458d927254bf2fc5a08e828334e8cc26a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee62fa4679ccfab5951253d39e7a318293d024d06d9603fa21c2f0fae6d12fa3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 754ed32a15b007edbef9b6655c555edac83d79efa5dac9324aef4d8317e74640
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dfe889337f94d7aa1e04a3ae2dd1f21c8e07571791a847c36c7e7c7fd0c79bf5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c4142b9a02e11d1c930647a3b8ab6da4205bc9d154a113f20b7155df8f5f4a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a10cec1ea4bd8698ae30db23b9d7eba66aa6e88e5d7d44976bafb3ba5afc453
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af621ddd714391c5993828be28ea945e90e71613053648325c0f7d82b8bdbdf9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6cc302e083db833f4c45689f00aed5f5d84b0b3936d01650fd5f60c70745b4b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80da1aacec002828db6823c093137fa5527a1372ce695fae6e6681acad11cdb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 938d843ab01c26d9b05d9275990dd2e52e4c2ac685c97c115dcc86abf97dd3ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46f82b924f215c7883e3bb617f826ef4c777bfbfcf4b99e4692f6c5e5099f2b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e5953a5e9e9374d20a1549ca457c14f9ab351f8225b98afeee9ac600d86cf55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c548a66137e23a50f1edb9844eded0f10a6c600faf70a23c123642d9d4bd7e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a90369fbb4bcef12d4a6209babcab7eb09e343a8fe7d17b7b3a2193e60345c33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b71b4a68f5958c02ee2be7ae4a5b2f57343cb9e17260b503578c1dd9412be91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25af8d9bdef676ce83b4e97aa732d03706b25ccce39781d7597a4039293b3c50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86be18758e92bfce03b12c5815aa47a3d68ccb5079e835b1b7bc4ee494e74ae2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1abe3b34e7769b72e325760b68bf5201345da347806ebe75399e77b4d31f1575
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa944059302b3bbb2c15b862b006f62b9a61357a7a563400c4d5f1b99bb2f50a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ba4d835517e0f153a6a4ee7f1bd853f6fc39c251edcaa79eadd831b1574d593
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff3578267b937fe83d1d65cf22db00b70a30e57686aaa193e0d8e126bf8c76ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0e16f6ad6167feb0e4454427abecf3312e284df63decb1a6f8151911722e8ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c35d35f24ff74d4721aa83e812c56ea2ba6d238b0a0a003b33a8799e0e61809e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa55567f854ee53846033051192329bf63684bde5184905248295ecdf6ae7510
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6e12bff2f5ce751809684aae182c6ad160a26bab4ce7846808e19ccbf2ef007
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42e505f158d34ad8cb1b45cdaa87b08569225ab679402c34959b815605a28949
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0432197ef3cc1aad8934e23fc807be056389873f85cd76ae66de63b79fbdeac1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a25a1dca4341accfc017e3d37e6ca0535d37ec4f4fee660e6bb771a40907ce9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 027f7303533c701ae0410e3ae8cff5e5d2d60b6b144625caeba59a25ea912961
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24fb42365ca30c9f92ae38afbafbaabbf28ce8cbaa6d1ab60fb8769fa2a4f8cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3bd2ecc9cb25401578b9cc2a816d86d28190288b4193d4a7b9bb31a5786b3fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 017296b9d9e29095968fe78a5059374eae9418b39ce39b41822adef5404d2690
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8576a8d4628ac9a82992ebb7560e76a14e6aafe3e07de3737a05563b5f91cbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8be1c08389411ea4963b11c212cd835bfd70adf0228353f72f2d00b478965ca1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a12a872cc94ee5ab0163026601aa73c48be37850492c702aa938b8504e54f320
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbc7d2c5fef16942949ee95d275acbbaac6a7f0e3b39b57df57c62545a1b7c42
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 056af9fc6046f537fa17409d7eb1392a735b9787f59e75fc5d7058aa4ed6b183
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8802adaf41b45bd988f435b91ff1b9d4747b5828adeff3520b404cfaa7047994
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b76fa2edd9e30139e5ca27b52f3ea3bd23e48cfd2375b2817bf1afc33a15daa3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59cc44db180cbf3632a6f76466337fec13e59fedac9dabd0fcb351027052e587
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 466dac2a488b191a8aa63d13c9a8c4e00fd09a684eeae3292b8464e034773a4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f678f441a371fc93a81b4dfa2610c0cb571ececa2f6c2dbfb42f03471798c95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 935385b6a2d6b251cbc93d28d3d8d7d7263d7490cbc82e02384383632a9fd941
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8d5b633aa51b14bdee2dbb4db85d02e3a5c4d6e1da406a21846d7d5f0d2b3f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbcdf8befb6a0a42af64309c9669d5ad08901aff5a7b2ce3120e01826a8b3f1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb89c2b3c2cbd22898b63706668f12530f6821d34e6a7847458fd42dc50a5028
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fac441bc66b986f77ed32f400e7ac88b90c0b54f37c4c0467a41312da6ca56fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3506f5d6b8f3a4f036ccd468e9c123545d854d8afcd5d18b372c704a1e124927
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 297095fdd752b55d09edd1094f0372ff7d55ba6e33a6870fc03f3a1bfa8c0626
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a6409ad8f3680741f0f293709f9a577570a9860d77b8b5842b4dc020e231ecd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a2fe2eeee06baeb20f3776b1f6d47c7f22d6ee7337ef6d0d140b4357676e393
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f2c58454e3ae1d684dc0f91c4d2578eb7c11846d6edf08f6b15d325fce49b47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 917f7b146035a03e452d92887e96c051c1ca812cfa564c87504b2e94c1a9f4af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9ab8abb7b646ed10c8afdf118a8ffaad6b9346cfc8063904e0d915ffaeada29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b41886cf282f449bd3e34f0894734f0651e4382b0ad84e120ba9d744213eaf59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf61143f4b26d0d4ecbda2e45d6de46f9d85f91c2138c6fa535d36cd4730b366
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c0e8e5a6924700a0a35caab9069fcff3554a9d9c783e51f4ab7126a0bf4def4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e249d0b7fa42f9accc2e0cb3292ef36891a9a165051a3c207e682481d3e1c2a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0652b8369d0c7f4b25f2e4ac6b5db3f6a838221295d0d72250d111102b5dc56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25e28139b582a4dbfe0e7c5de33ff263912773ae8c537e9f2650cda68bbb83b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01fc66e45cafafc910b9c1c408c83bb0b93a64eea59c2cb1e66d6999d1de3b46
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2489fea7ac9014a7dcb79652dac7db4d69ba3a5735d395a68071b7881fffb600
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 047317db8c3335396c2a447b97e7f98d0da0081ca13736df146faf0bd3f6d793
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0046cdb1258a02ae9f82efd0d286e8ca52b0a7f861ae8f9cc277001e610cd41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3854eeb23b05874802ff2f9c506c50788bb661238ae8764cb65670fab6fd2507
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3c4b8572af752cc29931ac023993640fadd48604c99319e46b2d1c7b294c5f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afc4058a00d78ab16f0d4b9b816fdc15e6c2735408e2602a92a31cca48423296
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c7249fe851ffec4d93f700176ebd14a68eec8be4e798d6875ecc479fbf212bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86720ca1383f8d5d089f0fcaad421b798f2cb31ddc26b199104f30e0f46c6e7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26850bbc2ffe85fe1c555dcc4bf009b75c41cc8f043471de458d8b16bbce8f88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dba9767a019ba5537617d44bd9cc08c1c0667f54385277821a66f97e1965449b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2c87684d97ecc1d76488160b304b075d78c3576c65499b0829a1d8322012d3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e140be4757f88537247e7ee45843ba1a28834498ce2da0a7b8365897b7deb54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0b769904b6726fe42f91e6720f1aa2129ffae6727b4e1ea69be10f64a83f831
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c97ecb360f7f78d16603874cc64df751f5e02f48fd580df80364a61a4f3d01e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f1d9960e8b5471b5d23849d2e1fad9feb85c51317cd2f4dc6f86b9c1383efbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a9d6d08aa305d1aa3d629cba094eca85ccbc2715da6705a61f03712a8b7fc87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95e2c425613c0b0810eb7fdea2d29b316d476a66fec65f0c9dff0d832d40afc2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ef022fb5eccea9d0e23904c41d73d115ea4340a6520a819f50afd817ee093a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e69e1678bf7c131fe9bbe60aa8966bdf3c1cec7971b7d70adaecce0bfadc008
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f03660b47ebadf77990be56b8e982e041fe38030d44bf1f32a14dfb74a06825c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f02541780d34f72a741e8581d1b7ec1b3283f0b2c0ac75f502e73439a1bd3eef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ff482a5e09c9523d3c662eed220a355b33df483381a1364d58a746cf803e876
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42c54fc3aeadd58b7d839cd932e6268a2d40b3b0a8ec9f68b01d447991713c94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85074962fa21552ff5d93649f2377e2f3bc48f9b2ca8b1c4b0844295c4603d65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41e1d2effda7a95dfdf62613e827c2c82f59ba40b191979f2501bd85bde83874
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e9ab11904cd6f882c8161bb341d1d216d496e52b97976ea2847f3e91be903c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5af68dc101c4382a54138a59af7a9f44cae4736baf6a1cbdc203513d01516fe7
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            memory/1380-128-0x0000000000400000-0x00000000004CE000-memory.dmp

            memory/1380-84-0x0000000000400000-0x00000000004CE000-memory.dmp

            memory/1828-130-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1828-126-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2636-76-0x0000000003CB0000-0x0000000003CB1000-memory.dmp

            memory/2636-16-0x00000000005C0000-0x00000000005C1000-memory.dmp

            memory/2636-15-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/2636-80-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2636-835-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2636-65-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3104-10-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3104-73-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3104-79-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3104-14-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3104-6-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3624-116-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3624-119-0x0000000000400000-0x0000000000457000-memory.dmp