Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/08/2024, 22:51

General

  • Target
    83ddc08e4b8330a45033eeb18ec395a4_JaffaCakes118.exe
  • Size 448KB
  • Sample240809-2s1zhaxdrf
  • SHA256 be3b7fcad24c3c19646d52bf305732dc44d30ec4bbeaa1328fcf7a68a6cb3cbf
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\83ddc08e4b8330a45033eeb18ec395a4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\83ddc08e4b8330a45033eeb18ec395a4_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3116
    • C:\Users\Admin\AppData\Local\Temp\83ddc08e4b8330a45033eeb18ec395a4_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\83ddc08e4b8330a45033eeb18ec395a4_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2296
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:2160
        • C:\Users\Admin\AppData\Local\Temp\83ddc08e4b8330a45033eeb18ec395a4_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\83ddc08e4b8330a45033eeb18ec395a4_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:4992
          • C:\Program Files (x86)\install\server.exe
            "C:\Program Files (x86)\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4996
            • C:\Program Files (x86)\install\server.exe
              "C:\Program Files (x86)\install\server.exe"
              5⤵
              • Executes dropped EXE
              PID:548
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 528
                6⤵
                • Program crash
                PID:1240
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 548 -ip 548
      1⤵
        PID:860

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            server.exe

            • Path C:\Program Files (x86)\install\server.exe
            • Size 448KB
            • SHA256 be3b7fcad24c3c19646d52bf305732dc44d30ec4bbeaa1328fcf7a68a6cb3cbf
            • MD5 SHA1 SHA512 SSDEEP

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 5e71a4b1d4a3724226f810166c610e5ddef25763f00e073afc842e42b6d6ad2c
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 b89496cced96e67c14e59ef12b55716a891b2bca68367cea9534c4392f6bb3c5
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 270e7668eb46931e1adb78129cad14af27398bc4adf887b58155f7ffb6178649
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c64018920341805c39a784b568ec5527cf1dc9564bf67ddfbb1faf412782201
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32224f3099809d9e31f8ad8c9787de15d492f47e0a97b53639beaa4c36dec77b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab5bebf31920beba7b2124428f2fe3daba32b737012d4e36b08a31db9ca7f2b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 486a6bc9c13b515478485876c231f40c99a9014ebd6dc4269b2454f03c068e92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc1d404949c9359ad6688458e2d2e5a62ea0dab3eb445d3c6afe9af1a9e353da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7161fccd15eab2de16c756b881be032a7815691b7b919a657e3f79aed91a5976
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b04fa657fcb20d2927d443528672682aefeccaf411dc2d7fd7ca5b85bf9626f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 388b7e6178a7654217d75fe98ef6b2ac69beaa93c4978accc9082e7396d2b6cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c59c5124ad29c3504459dd012aa3558c8529d1dc7973c7b7d575f622a0d4b4a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2d89b058e0ff8e087032149e6c478ab49cff6f9e7551552f8446860df84c05a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4022314cfc79afd13ee9bf9afbd1740a13391b75bd821796034b35467fe6ad86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e3ad5a765c5bf1f895b1cfe03147b111f67d893b4bcb5d12347efcb214ef6e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 555c93cb417269c5b9a87e767f0e638c028cbef9f62127661250db02e3cef40c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 043d19a225475899fcf8cf5dd0fd7aafe6b6b5d7d818a9064d010e093b954be7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c28485aa2ea793d75e65461da8934342465b933df75a24049823bc1f1147adf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 205196ea1b861e972183803cba255cc1868c9004bb938cf9c04f61b2288f6564
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4359862e105a624ed69edfd897cbdb3a55d20254a6fbe330f4cdf295307ba0b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f654787b85bd2b1e0a158a342f6b053252a8d7db8e4b05f3d21f8646fc09d6d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3fe01c533fd07ab509be875368d8e6667dcb9ce9d1b68ea681fb6efeebf5153
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85ffbc51923e84a138d60da84066f0242b3c1b1ea4807216ae6b23a025200fe2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5354595cd85f754ad5a059ea1a7802a5e6ff5207653cae49f18d8acb3d792d67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff663d96979de02f3b70f4b5c7396f36e11d7c5857d4b80f74253d9600409ddf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 131cb947dcae25be57873e98e1cd8d25ab4ac8ad55aea82b4e9e9c6f48669558
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f75c4bc92d611e35809204c61a1053c1bf2ba7ad5aa4f3ee0f885b65d94f184d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad3a5d6442c70a5620ee57a57b9b0f00960c7519f40d1a0b571f1f28e8752baf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0144c3229c48844fc578a672c1a92f8ccd55f16917f83720a9230d02897db07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 738b987c4b7fc05bce67005fbb052cdda135558507fe59aac669088fce307ddf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f4927617c915d76d269cd377e772fff448c44a64458a180d5a4ff152ad06820
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed0f27cabacad2240be755e079489f192aba42bdbdd1785a1c9be8a9791538db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c6e5eabc325f30efd82a0e2f96d03d10cab6903621eda7a5547805ad94fa1d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f91b28da4004dcbe7d86248dece7d943c74f735cd23c069e19cf8f5638c923c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17be957c37d9d7bdb907ea20972a46bb62807ed44717960bfc72977723110c25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b085fe5a311ece9beef6274632767676d6890322db0b975a4f65ac1fec18bc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60148bcc3ba4f98f828f4d5f6d93a620d1137e5415e10e2ef5d7f5a724d09d2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b323b67e8570966d5f6aefd327d056a15acbb0192ab252fa61e69ca32b5764b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c70a9b83e8a5edc460fab8700cbbddd7f823f5c454ec8e5987c7c87cc42cd30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f735b7d948205f1e75b5d453854f893a3de256c65376df9a10083ad4f0336369
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f04bffe8930d5b9ef8f5b04e976a09418438042c45cfdf054b36d18319afa9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f51304471e7828239fb3bdcd26146483717fc3ab251218ffe69b7125d865c6c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c5f3473421a904cec74a4d029544ab206f41631e6a3e03201a711171f23895d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b841cb7379b614e2c79a0e4d477e5b36c69c72ab2f4bfaf1a4f87fc507349ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55dee12c4dc46e65d02ec0d456a0eed1fd1bccf6ba87382ba308c155cda6ca24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 686525eccc27560ade246e30a0a9e8bf86e02fc2585d170690447901b75652d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62b7b2198daa9359f1dcf0dfdca568e0d286c315cc6dc8f3680bef06a9a76670
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d14f5c6b93aa0e740eb7f82b4c088b3910b7e5c3bd80212bcb6454fd1c2efe43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0c00daf2b031ac686d5dd08f8fc398b9b9809ddbfeab3fe91d74ccf8fb6da30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8226abff25fbcaa1596c1221e3e01022fda96ec913539b2c87817ca5c4417d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da7854adbebb0799680d81b43376d9e15272a63128666379b9155eab785d5748
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abb23142d0e07e529352ead93073d6a9cb8b2c7d26453a6c4091e5c1aceef8d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb8f7bb84fbb3a1e8dade0ff2e10ae09813e6f7de4e92109452c9d410d9bec93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5f97b998261e5aa6ffc874434909f8220482adbf62737c58b13e6e617d380b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68466de060e04ff64649eb75e4d60a148de0aa56d41261911f6de6188993ff00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 171009a6dc85becaeb0713ac4e707b5263dba7035678f25d84a1c8061e2d7142
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 441185cd04f44a4198a38bad94673fdf53e3c3341534a6ec6f8b036027ecd5a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c586f37f32af86b4679c55bcd08eec4b335cd23e31c6caac9d03d97d66aecad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0bdf295347820c5cb1d02fadec66e070729c1c9f1972ffa99ab43943843d9b98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79e1ca4e525feae9a164fd19151c7cd6de51b4343e6b2545507e4453b2c33733
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d37308b37d24b8ef494676c05cfeec67d04d301ce93772708dbce3cd624f2b18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71151f777196717c2517d927ca91ed885b57c2572f12024e188a205ac573ca2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc63f253999c5da8bb949b09e951f107194d0b14dabd5c24ba6efc579223f0fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aee6737f6b2eff2d5c7550b21ef140f1e81ef8e6d44adfc0b77609b03f36496c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 154539a985c9c5e1447d75b8a148e37531bbf62f55bb8eefb0502b411fc06352
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f713c449199c7c4f14d5727b23f4590077c2891412fd2ac021131ed9912993e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f587f8ddfc38563d97f4ecef9d366b1aa966b529fd79b9a2c3635ff0fde4a787
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c3d41545d1eb763c59cb1e5a53c53bb8f8c85cfd8ee07c24d85998a46d9429a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d74b43f604217634bf2ed70af6dc453ae6a19275ef8cbbb56b9d2a4527f0b0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0599dacb40f526353f8c6fcf23abaf9e30dca14b130f60982cc4d7b4ec9af20a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bac89e33ceb4cb5f0017167aa68055d4f61fda4775a2a738b48add2b7079eb7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11e1574c86b857b1e0349513083a4cdf1b39b143f352c72cd6530a0ab9f54811
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0be9f33bf5db856b92aa519c5dc7d8d8743e276f2c446129bc45c4f3a3f833fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5332b0f4d2ce17250e7cda594351b717c2bd8118ba89d8fb006d755ccdc91bda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56981802e93ab29bd1068f35b0ee5db0ca76a24d06c7e86eee95ecee6166ec17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3237f8a80e07195f75b310ad2bf92b1bf556920fa1206faa16c6b10918749716
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adb3b60e7750d610dfcdcd6171753c5fe046c5cf9b871bced6340c93432c1c5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2336b0ea73c600551c88788acc8e003623851b3f189ebffbc25ba1737aef400c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a42db58f8cedec91626b8d025eb7680cda5f014456c9f8738beac69407324f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca504010bc9625474cf3b70af6f228346e45d16675abd21c782f71257a3ca613
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 159d7054352ae2bf5fdea94fc89c410e2e7194ffb3ae48d0e394858c40e12e5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f27a6ebedf14020e1e236eadaad7e8e792685c28496f3e05d900cbc2b328369
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fca145b4fba923cce726b50a51fa7122dbd8b62a5570bb7301a8d875f79072c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba815b548bc65a83f36d5960bd16c81c805cc69e58fdc0fcf6726f712f1ddc9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43372adbaae2cf084216233617cd52a8b28d349316b7c3adb16ff717768d5820
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b087abc03045801daf8a6f26e19f1b044e5c8ebb2750d5ace42e497c7785dd5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a87f291c48d4122ca77e94293e109a55fa96baf6b004ceb6cf794f2622a0f62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc59654546b7aa6e961b4cc9463cafb2eab0c5da12be635389a017696a596b43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9270136e2ca8b14ab8f0e91efdc07fd9f80e4bf69b1151cf92e5e03f26dfb42b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5bc1b734df1f512def63a2801bdd227940afa4da349a31f16b5c889bacd8635
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a95055f6e8e51fb62f746f9ac93c46e0d87adf88d993c72af6a8a25197c88b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4cf2636b33baf82d6e875dae2d491abae8b596a47933b2828b65dda966cd743
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c8981f603f2a3b2e5c78fbdf10cce47214ecd3c4afc75017c3d72e60ec0f22f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f26b97b14197502b15da4774ce6622a3c64f3d8fe72547fbfc9a6c3a903b305c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45400b37d7d4583aecdd8fa08557bff187d6a9ba967821b221959af58aab9332
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f13cf798f2ebc921eb4a7dee0627c3c30aab2034e46948151a8780a1d5edd16c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dbc12850fda2cc118ec04f39b9ccf106a925d88530e9a8849729a13359b2b6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3fd98280fb5423742ad7da083441bdd88da11d3bb22a36c9cf5710a0b5387ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1509bbd04c3ae0da7336175a26ac85a7ade30411301606ce0d495bb68b7ac257
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea0723945507c98b31fe3a5ed03d38b7bf054fa6a959f8085d4ea002c89ca873
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b530c1e8c82d7f454ec6640de92fce4daf10f01db08943b038ba7862742bb8ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39dd3853a7cc48dc14e77b62718fd25e6d13e8ae0ef5fcf917bde72ebe24332e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 646dff92d8680480042f84171bf574328e8e4142309e460b2ad5ed8a5af34973
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53754fd2fe80f3fca258d0d7d47332606d4cf58cbc9a41907f77322b620faf16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f9e7ef750dc7fdca6da3f92d6600a0bd57858cc5f9b701186bf9824943b05f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bea596d2015140a38f6f2a914e0e28ba37be05e7b128555368ba4b6ae336089f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12fec77159f10f33c6a274ddb04938ea5c598795f13d2c99687a4242bb35a38f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e729c084a7628751cf6f90fe996c743399a77bf7a03cb0a8f4e0d8bc1b33019
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 150c013387e9982cf77fd8e58f8fc963e9601356844697acd3aa0896c215b94f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b81d8dca28333c1fab79a93650c621c2c3766e8506b276c439f229487c07cd3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2bd1ba206a0c7869941bb880069aadab5a4cd501a32bba47b4f38b9adbe9ff1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e53720592efef96a4b8c66766f57a17036375973c12efe81896088ebf3eb84b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b06f29d28798b0cfb5012cb4369fbfa24231eb16ca3e8098eb3592eb7e6baa21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8896dfa29f8a01e7a678cf68ac66374d8044d57ad3f81573ea5eb783a0653069
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e302b06080104de4e1758626031b57394b5147ed56f969d4d213a3653d499ad9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91617d8f9e4624a563405808b8f394aec9ce4ab9302fc3cea04b5bbdf697513d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60e9467fab08466ffcc9048e81cb2b2ee37fedf63cca26f9e03d517ec9736ef9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 709dd8a1c92aafe2ef60e87ef15801b9e1a94ab64203d1c277c04543bfdbcb5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1568a26fdda4c270e6ee72f821bcf2e5960bf470e1305e5ac34c319ec334ea36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca4550441ff1fa5d0fae20929bf7fbf6a6b26ffad929b0c63dd4e85f2ae825a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c4e0169134323e3fb618167bbc915d8777fc3e9371dd16b8a26af194f6b8d26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 907c7bc0239f699abfe5d16e9bc357ce4a5a30a03986b966a97c2b6dae4eaa8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4224b3234d3786d7482ed82e039ff535588a04cbeb9ae59f7c794fedb274dd4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 363c21c4dccaa7d2027f9fa58512b3ac21db385e16fe7807875e96b648ffe5dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ff52d0dec3b1fc4cd32a94af247ade19f1a2a71e6e50efa360de1e1833bed1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fe33f7f044b4e17f3172542f2822051fa93eb784f1d550b8428fdf684aa52fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86c46aa6f55ca74280caa1899a03abca27048b25736dcde38cf98605126888f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3786953ae7390d86e252c1fcbb3c887fb873f7852c783ae91f8513f3c3efae55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8b038a1df5a13baa632ff8cb491e988c5368cc07a1c3a3a24f2e1375f5e69a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a49e976b52632310bd6f21d3c458efa8af18fd5393829bb21b503e1d3f08e423
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7434840425041247c692e7792f9ffec3932b28032ec51c6b31fb653481c8910
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 124b0f844ffefcef14fe8ca3a4a144214325e37941202eef3aa5f9b02601677f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eacdf0a046ef04c8425875414f9e51daff3cdc41771ebbe0e8dc966b905ecfb2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db0a096d48ea0be7ed96565faee4ca7937c4d08ecfd9fc2a55d3b685cbc27f0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7d83feada1781b208113e3a13e5fa52ed5bd020e0f129ae3f9bebb81448fea6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f30851b79b7f610f2055cffcf557754641d9ef238d9c63774615b6c3c2e7ccf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff696a46f014392b9eb9f59573e7451748874f003aaa981a3be374a263bab5bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba51d6a6e64133e1b229946da2c2151472354610db3e839dbb02dbf9a63a9c29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65ccbf0609035f5967de316c5e36343d767c8121c9a3bc2185230d034fdb20ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f11a86b650dbd4f508a6826ebfc7665b02d3f2b4921e3dc977748180824e5a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19a60655125427fe31089e461b33096d120a2762407b8520eaa32f0ac7fa0002
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0133d39b650f4f8f7467185cb8b97ce2038c5845d32cae899588b11ecb3d8f7a
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            memory/548-111-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2296-80-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2296-11-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2296-15-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2296-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2296-7-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2296-12-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2296-8-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2296-3-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3116-6-0x0000000000400000-0x0000000000470000-memory.dmp

            memory/3116-0-0x0000000000400000-0x0000000000470000-memory.dmp

            memory/4992-17-0x00000000005D0000-0x00000000005D1000-memory.dmp

            memory/4992-19-0x0000000000400000-0x0000000000470000-memory.dmp

            memory/4992-16-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/4996-112-0x0000000000400000-0x0000000000470000-memory.dmp