Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/08/2024, 23:14

General

  • Target
    880f20214db4fc98fd4869ae9dfb527b_JaffaCakes118.exe
  • Size 464KB
  • Sample240810-278mwstarr
  • SHA256 8a86714f55a7a82a6cc809460a3eafb34cd1eff1562bfb409f58524aa8056e6e
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • 127.0.0.1:90

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3488
      • C:\Users\Admin\AppData\Local\Temp\880f20214db4fc98fd4869ae9dfb527b_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\880f20214db4fc98fd4869ae9dfb527b_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3756
        • C:\Users\Admin\AppData\Local\Temp\880f20214db4fc98fd4869ae9dfb527b_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\880f20214db4fc98fd4869ae9dfb527b_JaffaCakes118.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:208
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:1592
          • C:\Users\Admin\AppData\Local\Temp\880f20214db4fc98fd4869ae9dfb527b_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\880f20214db4fc98fd4869ae9dfb527b_JaffaCakes118.exe"
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:820
            • C:\Users\Admin\AppData\Local\Temp\880f20214db4fc98fd4869ae9dfb527b_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\880f20214db4fc98fd4869ae9dfb527b_JaffaCakes118.exe"
              5⤵
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3140
              • C:\Users\Admin\AppData\Local\Temp\880f20214db4fc98fd4869ae9dfb527b_JaffaCakes118.exe
                C:\Users\Admin\AppData\Local\Temp\880f20214db4fc98fd4869ae9dfb527b_JaffaCakes118.exe
                6⤵
                  PID:3320
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 544
                    7⤵
                    • Program crash
                    PID:4452
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3320 -ip 3320
        1⤵
          PID:2364

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 b9b3ce89a30022b58b6e43c5e7bd79c380c416de1ee9291e79ce7a0790daf6b7
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 230KB
              • SHA256 c2aae013ef3944a0fce53f52e797d2afb4be84c98a9d2e8b1a155ce10f2aac25
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a789be267c8244dac313895f73cf1e6fbd835dee22a3811c326a71c75bc15a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f32a2b3dd1b20019ee9fc9d31869abdc3d0e86e637f4e6306363e45d49d9dfbb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a585755bd0c38b73575a5d0b7bfbdf7b6b449b712dba047a03bac43580ba1a26
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ec3b1a78460d3c2d51bf72300fe9c3fb63ed0fea49c25cdb5ab0d92a050f66b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2063af4b182ae491108c76c9ad79778ddf341177766e1504685a68259dbe534f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad31eefea04cbb543a90f86ee0d4456f0ef3a8d81dd0169b1df1bd243beb064c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e1be96bc3f2fcfc5ac0cda9150408d83e59cbb70039d9755e30738226091b47
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6da580cfad1b10738c93bc8e57426864439189fb266d5cca3cd197ad6ed40da8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9241370bf137fc670bc35585043cf2cc85971408c017248a42ea20bf06cacc0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 577c3d9036dac60678495ceb35fc36ec01ec4169a44b794b4504de3c3f6a8c02
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f69024ac47ec7494362ca5ff7110d723b75b4ac3fcb35d0557295cedea1ff8e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 412a27024e906082ed366b7ef47434c8deee7aaabb2ce13442df6fcfb9189eae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb20b391cc2ac10e085ed0747b1ed254ea8436fe963827b357e5403d0db6e1e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab44e2cb58187f3b1bdbdf51b4a3d28431867f98f59146db84b4da5edc9a1ff1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a93dd6d74b65242c07ba94eeef9f532287273903d8df98b0a3311a2a9e448b53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e8f6cab9e03f15af02efce005310f94bb5127ad5330eb58c97bf52d279052b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d573d0e10db0090bff110ede7e0921c01e31cf7c637857ff82261edbd65c0d11
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 224c512deb32f78ed85cedeb8755e99f4690d3d0959d9f5291f3a5841fd4a0b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f56839847a09a4c611f29df81c106f997b728558822a4f4976a9064174f1fee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db1b86f0e37bd03b8e2077a46a4bc40f9eae26cd51da236efe88a125ae0691bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f66ccf5f707bb4047f58d8697e1b37a9c947e15408c3d429fd2dce6095be876
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 506822520c15345567aa224acb73aa2f48a4551783f66e14415e8c1d625dcd56
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd73edcc8cabfebdc58d4b03da697c3201e92a4db92ad30951a86c3a370b9202
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f6963b344bea84043e8cbf5bc6058af3932d8fe52f8952dba1bd100df20b58f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0bd28efe400d1bffce7bfe36e1cc3191abbaa36f9299a0bb11c75062f2399982
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bde31dbb66b0ba1bf155f39b5d5df00d74d21ebc36df3067ecf45f6b1961a8d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9035fdd6c40e266120e6be6ad6e5481951f12ca3e2bc87aeeb229f70e7a5805d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 893122163f1f47251340535a8ec5bbb4680c4e20f95655c7fbc6aea969c70ac9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e746ee1eab58fb2d2f49f60b0004c1f9537854f52cd0f04035f13b9215b38d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f10f30555a49c43c3af7c830ad44c3eac4d50fd49d7eea0ecdab6a2ddbc9e334
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78dffbd0680482bd2c04ec99e82a7d786fde82aad81c71ffe87f677fc4f01177
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5125181d8e34a248a2f396ec0b51cdfe45af192a9ce99648298d826b39f692b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8fbb98b3aa07f5153da8c4c92765d101753eb42fbe169f77db451371e600f2d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4d3c19d5316c9e6f1a6724bd7206469067c085b54076eacf31b3f9d06e7b7bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cc1d7d81cd06b43410020bf839c9e38638f0e7afb588dbf8c7f8aa4d83db8ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8afc065b3a6c7b929f9686257cd4eeb5790be6792e9b52251c08a377fa145ce7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4cec733b34907aa88a3c1061d65156c6d4c8d624841d600d78f94aebf11e8ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70051112d0f8ad73277072250b835ca4d13262da8378731f1a76100dc25d7c8a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 81be5cb88ba2b9ca0acdc839aa35b6afcd3430e0c32e01d5e659916109a4668b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c865baef3f216081af796849e4caf7e21fc283020d64357c710ee046d75afb08
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 15afef331c1bb61e7bc904d91385815157673dc3056be9793a134a77ddf7ec16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2216b7966ebed96d9b5e264bc7ddfeaf0720a106c75ac9632fc3d58d8a1ee0bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ff4358721d1ffafa5d518c4432ea586da3be51d5a2edbae1e722212ec9dd432
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aaa14e7d4510d0616362bd003b389ee1e1efa4b9e09b1cc1432abedd6350b715
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41276b5d11f05927a199240dabb0cd4103c931f77aab4096c8849679ce5a5037
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a68f13023cfd806f5a00de2727c51af9cddd7149de178e7ebcf08aaf67269fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 077733ea2ec663bd309eb77ffce769eb3a8ea0fb96f51c4d166be4857b1e0510
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77816ab3bca4c8687091751f71bdb577f8cc1ba30356f7cc549ebabfb4338353
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fdd5cc346276240367ef569b222cef08a196e0fb57ed4648a9867cbdc28511f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 601376cbcbab24c7d58331f10a55d89b95b22e3e2a9fef445c7010fee982ee2d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc951a82d1f4acdac8f3b5866772d122940fc8b39cd19a49448a8e158d95952e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b3dbf3bcbec0580d9e35ca84d4d8b1fb9d54a7671295cfbe2f8c98e594713a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b8b24bb627e27aa4c469dcd63c10dcec31943a0066214a0f2b847f7816d5377f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bda217cf4365205556c59e1d3cac3ad312d0d6d15fd4245dffb4e9c88e9ce7f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a4c9ad6ff8a03d2ff526f4dd9517231b460141fca54bb5b2419ea001b1d1382
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7aa9f5b5da17a859535ae2d2a60ab3d54be0965baa3dbad06e51aba78511295
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 99b24d8d63d91481e6e894b62ac966f2478edc0328618316d16ee0b436dce7fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2fa52e155df9db043621099d8da8fb8a86a2daf6fb0a899b14b4250cbd8527c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d2fe2bfde7334800a034271b74b384e356f2643c886f56cfeed2be33b7d68ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 242bebf107decd9d8e26fcac1b2b6fa0e388c87bac4c7bc0698a2aa119288f55
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 37f4aa111a1573942ddea2551b60299d381ae19f6991846cbd33668c77d02fca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee9fc9c3f8a1c6cf2e90591bcb852bbc65b371f3df2ce4f6fd8822d151364627
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d7d6d9630bc6771107a08bfbc5ed68355c8b222ff7801b4c8972cf26f6410c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2a1842825ceb670908c725f357413128ed7cddb9d82b892781e00eb07f73c40
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 554f2032b4bb0fd012badaa01edd250142f14723a1acb0b141347708f36af11f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c2f91e88166872143befffa7a21953267a444432eabdf8b74c9af3021518602e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a9182556ed5a7dd9ff1e3af8fb8ff0975417b493853b78c90fb2fc247897268
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54c81d4192a3cca82ff629671bdc908faf822c5c55857f33448993e26106c593
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72f5815982749606519fd9108b7a8c5390503633a3b47845731cd6d700658ffc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83518748bf951e729a4c0974460c10eba7fd1377003ca3f82fdb65524f607846
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8edac84e62d8e8b27c1b084b2c39805926fc4f2717684aef79e3f66eb5ebb566
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aab76c91550bf0924eb8b6a1bd969d41d645d3ea43202f6e1e2156dffcf491a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7a554f4962d6c82cc61a5f796d4746ca11c7701e2869473d8b1b59cb846f27e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ac73b0137cf1019dcec79c4cc5bf5d75f373ac6e1978b3f9c4e249367b29ba7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 efe1545bc9865c59096a80ae9e4ec49dc84aa55ee33ded17ad1e9f2ebfcd5aef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed19057effa052dee1c58b9eac548fe27201db34b6fc1f0d2945019f8a60dc0e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c68ed7f0757c88ed400b619faaa3c5b0147de342568da8af1ff5b870551b565
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b40453c3f077973a5633fd6ab5ed45aac02ae1e1186258cfd16a91d70ddf6ee7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 255f5a80c0e1053fe1cd5a4d53e5d3b1bb747407b5e4192ceb86e6979f67d423
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f1873c11ac12d9c916838e18f5e3404f38acc2d5eaa02525c1d75a474b60d270
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6954015e96670c973865221a6b5e8baff12d5e9582e4bdf158775ac81afa196d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0df5cb326962ca743d4353d7a9143f7ef2127ec6c274a2a087d505e3a9524dcd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b6de11f2471e80d8d2fdeb0c61fb83fbad64d50e841bc132a52664c67dca706
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b0c3ae48083af1df0f63334797419c4e5661be77faea149e76b49080c63e36f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57eaacb9fc2903b0f1ed7912ee73c01de53bc7ce1af420cc159cea328f6c474c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f50cc901428614f32981d39c5fd004df2200a79ee0e9407073a0c1dab504e78
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f2aaacb3b2b4957e71c61dcb352a6e2188cbe47a6cda948ec25442407ac96c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bbc96dafe1ef7153d123c9eba5779965d407f2725b94797e8e23ab5c3be11e1e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0336cbc9a3c061cec79058b8f1fe3d842b867ddfb29ee0a50f0476c903bae8a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c09731de183629aa954b7542461075b40f7236f8ddb5a4e9434790aa2f53bf09
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 90054b1c023965fb119f114523f68880da952c676d9c7e1de44e66b8a6c13983
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e441a37e808d2943f3c997b8acefc7a6f2df25aec061ef69ecaa911b6100b961
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 62c2ef70af61c716734b68debb5b8749e0b7b952bb922fb4f05e9544e5a2174e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e21efe2a0dd0fe85b72a168b3754b6f1b3f51e9c96ef6acd28c571f06837fa98
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 453fb20e5528aa0c83e9a6b1b329aaa44bbc0406709d89ec44f98498c828d79c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 00995e204c3c7562daf97e682861a419faa3df25d42283e41f3663794663e7bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a26cb8ba1daf6aca931663008914ec6ccac0a53921571d09ece34ced6dd5f91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c5f6fc1ba442b1dd35498832891685cd1bf857fd59cdf2aa7b09926e94522b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c42e4c069c15a1354cb8503d6805addab8d1adc4aa5b7a313c446a27b2ff00d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c591a329a98c8eaadd1f4f9b14962f1e360c0c6bbbfcb7af33f00f745cca2a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5fb512c4cf99decf88eace27549b6e7e664aac94e22120f6b4a24bacbba90a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f685b8f84f794e6d171fd3465363796fe85efe64ce735d3c02339b383a59afd5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd56c9bd133dcd815c432c61fb91267ac2176bbe751e58605a6e237f1f0ccbe7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4338a45dfde3264d9c5ce1982d8a8093f2f4a5024048cb8ce03be3bb234bf19
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ecdddd999caf5c87514ce1f93ec095f277caef646869739be1f0412cdf865e74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e6502c71187cfaacc5c7dd8c0aa86f5dc038ee1f445943333062a6ec1441c3f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a34c96342d2b8a69f2ffc71d38da740a56e14b41738c41bf3367b37099acb07a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4799fc53cfbe17506ee9acef087d522b68ff18cd4ae558d7bb328158855672c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25bdadb45a73334c70042411b3a5791b21fcc73e40c87f7a87a0f05fcef9f2d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd72a835dce445772ddaacfa5c6a09549c660fb5cbb1910cbb5782b621ced2d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94853ea06faf16fcc12ee9889c460d0781d5dc4d272defb9a5c2f32961ecebe7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f81fc9b46ab2f90e59d9d9062d75677bc3fdcec5d6529173d539a1174af5b656
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4bd7acd274ef2ce1a442378448c94e10a53f054905f50c6e332265e724f12b08
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89e5503a5425b8a731ba240d9c1a9583e9ea51b9e5bca1f9f776a7773c94649e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a428d312f512ddb0801d4bba8b8f16098b66c52a93fa5468b4767b81beafdd42
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 268ba45a5b325e5341c5a7929dfb6f2e8f2da88f7f92f2c7c689516841205d54
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 449bbc4baa1ccfb7a45b84c0c6cc7abda657a6d7cb93830e5b4348568e897374
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71f51f6b5af0a559bfb7cd6807c51a4196d255e4ad0bbc09c63e88bf9fd7c4fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b92324206ce2307e5e45f054e6ccebeb59e63db4b24e3b64f495369228a5ef83
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13d6e3b2f08001181c8686aa8a3ab336437123f5a8e185202e2b84be236983b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8bf318e5b38b5ca44d87126ae5f87d847d7b0740fc982fb92a5102576ac7201c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7cc62e537b519f27e2d8700aef2b72bbd3c823c0627eafe49ec5123bfdce6628
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4351810b22cca43b6965661aeb58234194b241b936faa7f2fec42b6e78750217
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f59db78d09937f02948d657b4a294e16c13f7ea842e3e10ba09d61ef66e3eea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2ba6c34d2119076debb695c10651f69b8b3840dff5490bfb9745c38cce1df9d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b04111b9b2f41658bb0ee82f909d909fae7e672b7bd345037689a66b6e367f31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 818041373b48f50122363e92ed8913d4c2d95890aaa4b224e7bacbe1ce5bf907
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 955007ef996d489d2e1c18e451c081692913e71744d16138cb3cf0c9aad4bd54
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 420e54159b1322ade3e5f59199fa841128a7ab76f40b396890a0b31f27965a2a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e4cdf3553fc1e83ddc1b6cc97d2ab43996e9e9d01dd3ce85626e0253f804e12
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b39d103c0d58850ad28682d35e068eba6c03fb960ca19fde6987e6191caa46f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 969f2e02356eddc7b9868bc743d6961df674b513e6bc52a92850796441606231
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 576da6668d83febfdd56e4e5bc3bd1bcec4959337af9ade3704927ab240c3199
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 915162d1fd13a72e7cdc720989e3751bb81e105d2ddd408e562c3d60265ffd8d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 abc989cd0f310934bd0c96f0d2354ed9a18fe81f1171ad8bddac936b100d4cc3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40910583e4ef79d31d937b7fe9380fbd1865ec33fb77824da2d3d68344ae1fea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a9830f19609b69b4b2b2f984e6b025e409e0167cf54b7efaf2eea0b0bd2ff1f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2912967f740673034102c856467e800445ed8cd99736f98da1adeeda2840f6c0
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              memory/208-144-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/208-4-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/208-5-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/208-6-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/208-9-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/208-12-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/208-73-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/820-1288-0x00000000240F0000-0x0000000024152000-memory.dmp

              memory/820-102-0x0000000000400000-0x00000000006D1000-memory.dmp

              memory/820-145-0x00000000240F0000-0x0000000024152000-memory.dmp

              memory/1592-71-0x0000000000160000-0x0000000000593000-memory.dmp

              memory/1592-17-0x0000000000F70000-0x0000000000F71000-memory.dmp

              memory/1592-16-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

              memory/3140-172-0x0000000000400000-0x00000000006D1000-memory.dmp

              memory/3140-166-0x0000000000400000-0x00000000006D1000-memory.dmp

              memory/3756-8-0x0000000000400000-0x00000000006D1000-memory.dmp

              memory/3756-0-0x0000000000400000-0x00000000006D1000-memory.dmp

              memory/3756-1-0x00000000001C0000-0x00000000001C3000-memory.dmp