Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/08/2024, 07:34

General

  • Target
    8986c4fb000769612c5188b8d6cafaa3_JaffaCakes118.exe
  • Size 444KB
  • Sample240811-jelcsavcjf
  • SHA256 4957eb245c1437e11e4e368c21616faf3a07b8d8a70395f156b56d2aaab94d0c
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3480
      • C:\Users\Admin\AppData\Local\Temp\8986c4fb000769612c5188b8d6cafaa3_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\8986c4fb000769612c5188b8d6cafaa3_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4592
        • C:\Users\Admin\AppData\Local\Temp\8986c4fb000769612c5188b8d6cafaa3_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\8986c4fb000769612c5188b8d6cafaa3_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4356
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:4340
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:4368
            • C:\Users\Admin\AppData\Local\Temp\8986c4fb000769612c5188b8d6cafaa3_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\8986c4fb000769612c5188b8d6cafaa3_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:3560
              • C:\Program Files (x86)\spynet\server.exe
                "C:\Program Files (x86)\spynet\server.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4192
                • C:\Program Files (x86)\spynet\server.exe
                  "C:\Program Files (x86)\spynet\server.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:720
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 720 -s 532
                    7⤵
                    • Program crash
                    PID:4364
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 720 -ip 720
        1⤵
          PID:316
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1436,i,12470628711992022444,7767535593390851522,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
          1⤵
            PID:3440

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                server.exe

                • Path C:\Program Files (x86)\spynet\server.exe
                • Size 444KB
                • SHA256 4957eb245c1437e11e4e368c21616faf3a07b8d8a70395f156b56d2aaab94d0c
                • MD5 SHA1 SHA512 SSDEEP

                UuU.uUu

                • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
                • Size 8B
                • SHA256 68c7bb7f1d8ecb2d6579d86a6e7230af4f5906032fd2b430e2b4f6ea91234ff0
                • MD5 SHA1 SHA512

                XX--XX--XX.txt

                • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
                • Size 229KB
                • SHA256 e83613eae07ef4e9f603faf39d9a206f4fd9a834bbda47afa6fe828d3262e3f7
                • MD5 SHA1 SHA512 SSDEEP

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4340ce76c8f4cbc964ed4c4667c2cf091cb01e9241dbde518098ca86215e3f5d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bd8bc59cdf597dfe3b0428ee330884c0d34df7fd6efe864a4ece2729841790ca
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ed3e133a9b825ece69ca680aa56c1d38545c56522878a15fda599614b13aba21
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8065a474c4b5ac8e27f74795eeea29e28990e28da5ba84fddfcdd45d6ffb59fb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7971e30bd44595a2874fd44203f54fc452908cf1cc51d14226f35b612627e99b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 26ea15264f18a24bb1a6812ca2fb82b10934ecc9065fd79da6f9e629a8f71347
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6bf4d1ffac30f897773e3d5bb724fec351d69cc97c5a30d1571e37af7d6fa1e0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6deb7ba4ac98976530f0f69bf72be8a57807a91a4887f6f8a2554a23470aa595
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5ac7aa4b4a6cb64dca66217c9e035cd4dcd405fff13a695729f8f924d1c19967
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5deaed0c26a115c578a55096840ade1476c85cb617edb7e24d2cff23958aac2a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4ad68a84d18b8e7327dd7e4888b4c87cf44f38851d16a16480f7fc846a256b86
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8b185f2eba092ef8f2e563694b3d6cf08a9378c1441732613e2f64f726dacea6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a6a469bf87022148dcc6f6ef3d196f8869c735b26b5a3832c4bb2b8f2e34b83b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8358a7ed74d723d83cde684b3799b931340bbbb406aac2f1d1d502cc2b0dee36
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f9f6ab70f7ded0056c851607e98ae090c7d2b7c6a227fb6a0394ffdf69d9e8ae
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d65226a0c5694e9fe8623343d35e978b644f82f1a488e9b63a0f1b40d1292314
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 15e2312f208da4066c7b6603b1c57b4d6ac8959cb1901a0ccaf2297a228b3fcb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 17c377876e91faf281e120653d1df0909c77b217313a62095865c9d1be8ec3eb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a060a7c79207cf6587ffdb4157d9e8bfbc88e4077d7fbb48cddccc5d9e75def9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cc96d3d5c55683c48054a30743ccc3905d0e1b6b087815050752164d95d3cf50
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c55e1f5c557d79b4cf13cd791cbd003d5088848e013b870b69fba418244036d8
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a5deb2b5225ae98e590b9b65bce3cba08831acadf58d1f4543118f9c5bb42fe0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f415dfedd0945c12311e11ca292de1193948a4c59f9bff743538d9ad2dde4ac5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 90cb72eb11fb493c975e7ab7ccf1ffd000960608f16e27c7348e3c6839238cf5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f586197be45a1b9e2f2c1332dc2f33b19268d69ed8524e9cf94db73efa1a5d6e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d7d1946e2cc848d596df801e722580d49b44406f4f42904b867d73cca9a2792e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 387a720e5492d022d0da26c26628d92e1a0bf2cac5d7d3c4ac4def0259cdb59d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 94674246d04aed945fd26e7cbeaba09aa04074c414d4aa465514603a6ec90aa8
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ee413d7d92a396f4745e8214e6f2da4aa358c53eaa5da923706e408c5ea2ccb0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8e0441f093b99e555bf55cfb172c239fcab4b331cbc3f07c32a5cf03d0dabca1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8dae75913d5dfdf0aa9b43040bb00eca5e4a0cb429997a03562df3136bf0a552
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7dbed83b2044bf3ca5d59902fcbd065874918d30d95c87c41f5163f5a40da8b4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b36ef176bc75c66cf0c5588b4a8b1c2a1b7d232810c66cbebf83a493e41fdb4e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 39ccde938a530bd3456992d6dce34c09169cedfcd97e838ee5e55f02bb778e2b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0141ac5f182b193d5273cc33007828f0ab599ab0819079b55f1310165f2dc9b9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 fe2956ee8bc09c1a9728c9b84b19adff37e88399b1e1307d09f4ab496cee2e47
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 62b91fba0fa2089f503525a3591905bda6788a5aa8c5d4564698b33eb6987d65
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 43c6443be0f159358e7f507c76e5130584a6b156ea008dba99e7ee69d7f436c9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a89dcab0ce7273dbbe93c85a426ea5aaa2d7d8e7be9208b9c97203553f59176e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 669e09b76dea3847d047c9270f81c4262d4719048cbac3ddb45ff5c97e5feac7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 886e500ac9f2ee115e88e72302866b355670b4f47e2afa07222743c2f256c8c9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e95b2f165e5049f5f28f945c6c8dfa08c875fc98e90d015175e43cb969478e80
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ba0c65dde72480d193968bc282f91ee481bc6fd6b19dcf61bc44f341528a4075
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1d9f8cb4e444a55deb60136b8df3fbffef86fbc2d8b71d5caad5234b1b7b106c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4f67cd7a17e9cf36f20be3c8c45be9a1ca0e8278d6d4727e1633c557ff1972cd
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 413b699d2463f07837f7ac0a8a94a5f144ec7e72cd7d02b05caec824369f633e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 da4b9f2bddd95e517d7eb8f551aba0f7d6d6cf4f8043b9ec5c4aebbfe19b9b74
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 11b065c6d32b22814e8d63d8875f7766d2afaa89ee795fc0796b337a8a3fe786
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c775ea73a515f3afcf3d4227306ffc45bf3fcaf75e8d573f522dbddec86ef0ed
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e8f1a8e0d535aede818100661463b429b40b5a804139f35b4ee7de53201e0268
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8fb546f226b617a1f7caa8aa954e6ea4175bab866427331fb5c29a94d9e25232
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 56b09e07079674febef8944d0d22f678a25388177aa4da895999ba8b613009bb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4220848f00253522dfbf6d00879615186fbb07e92f03297923d4f0d86f5395e4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7fc4ed017aac3c8c95a656e71e5f2e52d28f6bf1fc518b5349e81700545732a0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e21f07720c9c099d3a67be3bd01821de1a66ce0e4e28b6afbe5d9dcc20a5f969
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b8f12de09c1bcbc292df7794c06a9d863aac3fc84135eb35bacda4f3ab47a3db
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8ad9bbd872779a351203c404b49f7f7f079b607db3c6a3b889018d73847ba9be
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a1c0dcf43c82d039c460311b9897c81fb2017b314114d8f1be8e5bbb5b52f9c9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 400c75a9936d7de3d3fefa287d47ba050a35dfb3e9f460b72aa3ec4d493eb836
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 aa679d7248a28103e00be3e70e174131dc7bb3f13fcb6969077b4e48ae6f381b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a60e1bb43c8bc75a3ee51852dc608cdbcd0e9f39daef6a71bec86fd87dd45ea9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8b1b8a12a9d48f3aeb5df26853093ee9740dd89889a7a83a9f937635327bf502
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7083dfd4c154d76dae736e50cc2a334bd58fc98dff6fc2691ef122d02de6f1ae
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1872d09445b45c581be15a3f5223b956c222d4173b8b527f779387ae9b39e980
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 07146425f345707bb8be02dc2a256949f90599673cc298406622026e512289a6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b3a0b267a4fa7628ed622b1f42484b8b2482368c65b9193eef61387b24179c9b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 05542db8e03c61865caed3f895844366d934fef88575f7f1ad854daa3aea53c5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1e2bd75af16f5da56b7694b46201aaec11a1743acc4a30517e020eb48f2bf8f0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 df62e31a44b02d99bf905343344bf47c34a4473aa1c5f733efdee78d6c55d7a7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 61d0b6222370dfb18baed2d1875fa6de2b6de0ccc957ebf0d30206a1ce8b71f2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 46d66ea099c7d463471dc8e9a9c80857b29b7d0fde0636bbcb5512a9b80ab107
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ccd464e5d060e44a2501bf58da2b1db9524623a0560e3cad27fae7341bb83e30
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ac528e00a8f8468d8ad84ddba2bcf26011347ce52dac70ca11894fa32de58d28
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6c360b7e9970f2bb365c6efce2d7d3c706c9ba8920bbd5c84a3f8f857949228a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 46b10d4f233246463c77fc96e5be55951a233038e924b3c96cbcdce8d74730f1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6be6ae1edc9556f9241a0babef0f3a54ca0688e476b3b9be4c314fccc6c06776
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 91fb7b87f6d815e60104836b8c491262c122124ac21fccae48e203f90f4cd984
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 58485901cabf4544ee05469d916e80a2b4092e51781b353d96d0797368e30794
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d34a21e8854a67be146c736f232df1b5f1258dafa4e70d11fde7cfe4a819aabc
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2723f8350911d284b1257ca6305678b8a5b701322b5fe6fa2d3bc81b6a30991a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0135d021b0376841cf9e563db7f4a658e093e4542fa6b11368459ad130723db8
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 28e1867ea0fa24defee51d5a91aef78f648be3fb0d58a05ca63af6c8d6b6bd17
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 fb971b06c225f11e9fd6165c1d49cd7a15704379cade432e549580abfe151a7d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 51798b91df532f098edc8590b8db1ff9914cde759c2d54a37f336a2e2e42b824
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d6a777ef5898b7f4ad3c5d6554e6ef4e26d43889e3e6afe7104eef82696aa625
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 87ff856def80887e05318681160138946e390eb7ae4ce8d6f27749f277d103f7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b02086577f9d7ccb1390cca3472f76bd2a678cfee635eccd491687f1d675d4fb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 99d83eae82732116497cbc28021f0227f0044d2cba5baa3b97c339fa7d068c58
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 71ebdce017710f67a793e87066c5fdae9346c7baf715e9c0dd4d856df8a48de9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a458bcf1b4a3382c4a4d465a774df57f65124286d7aa4b952dceb0189e7378e7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ffc2bac0fe2b5a27d2bf1ee78d7f694b0f769e580c8b2ce9ceb79cb9c4f78c1a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 afb3fc4147ddd9361216790bd47da58c4d3bcd173cd4ee480327d48b83fbc4fd
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 61d46cd8bf8d91f2ad5ee2476fc6997807b98d9b14f099c32758cd884302df69
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 66063244c999603014d683e60bd92486544bce30e562aa8958b4f8b12304e473
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e18e154ae02facc786b63528072b37998543e365349d3cd56e0c801f2857a1c3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ad08d7d59e53aab189edc7c3b3ad9ca4534c0d686740c35300534325c56975de
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 df6f04f8c29e6f51260961df77ecb2a395c24fac16fafa9e75b8919cf73124cd
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 500f1c163672c8fd11d2a76f1b353516a169529a6924b331822cb3ee54b4852b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 164bae122251dce598021d85ef4726627d237917a5685b910b3cbe3bafd32107
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d147008fccd21472f5ab9af0ccc8eec846ae6ea409cd29014d741022db37c827
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d986a0ace86dffa3d5f69a26a62c8e6b1feb34ace8bb509234774f4d7e8ea741
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9008340122218859d86f09e7a048d15f5a365b9b267f5d27de4e933e2a1cb78d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c3d64fc0606f0c10ed33702128ec79f39b5de254c3a0535ba5a34f05334d0474
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bbf4970381e154645b22c216d8d940541b65fd5279a8595199e8af18feb3e101
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0d725d1178391105020b890d55798ffcde94500e4906e7352d1afb86abe16d0a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9c65e9c78371c467388150351b1f2179d987748a5cb69b301abd88f08dc5e60f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f61a6b25ec1804ee777c9cdd433530580cff89094d5f6507d64a5cc7486dc9a6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e40600031bd2dc5c734913fa8077948361207270a2711174bd43be8a8bbc2607
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3006eeac32b2e1357295caf484de898bfc326c1a0d4fc63ccc094ab65c883023
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 694e7f13621b988cbe230ac6aaaf91a8ba2ad13c91f3d577c25e9d351b6ed386
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a9849b4cd067ce88bfde6f912ca620ad13d8917bfd0556dfd4f9444f5d0eea97
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 fabd4e63ab844d98c9599ae9eda01f73c65ce1c389033c92f427a336e5b731ff
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c2aeaaf34d950cce0ab7f7f3fd5d22de97ab43815fdaaecd3ff005d2e5ed1187
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1b3480bd0edae2f819b248e906af843c96405af365d102c42b29429a202eb03e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 826a50e28577fc607644a8c0159c6cc3f918af1fff76199e186ae492f728052e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4fe5bf37ab43c542f1700827ef604cf0daa6a899a9b7490fefb5e7bd7bbe8244
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 eda808aab203ef723070e3c509ce754a92d3a0c55916703a14df7576fb6eee66
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e8b3b2209588ce41b978d80f289979f70a9e670015abae673b51c65286ebc089
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 335e789a6125681aed02eaae4ae814758363293234b35c4f31e4cfc0af02f5d4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0a98af011d646cfe667de7f74451d6bf146e425fffe72d1bed6804f9d85d8e0b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e971d68d19dc9ecec18d802e1c3fda23ad900eaa74ccc437f02e078b137e148e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d2fa9041f10efd80f4fbc2fdc0c2e5fc0365465fb3abeb0069a0ff5867e30aaf
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3f6ef864501592df3bb8fe07cf76375e06577a4039c4296f05cede1b9e782adb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 aa64752eda2d6e1fa91cb3dcebebf55db7e3e9a44b2eb255b7550d6d1499643c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a69df5a1cd9fd87cbc08f0ec8e3a7e72c2333ae21dfd39dbddba07b9a80c5fac
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 07d2e2ab00d8ccc3b2ddcac9c8c3360bb1f2c15e0c7712c33fcfbe6f48456ba2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d134e539baf8418b3189a82801098a94dac7d6f06451c8098bc8029407184ddf
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b5efc20411095b26fa3de30b41a8bc34258373cb6eb8e577a67290e424666c2c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a9db209cde328ba12273b0c9d544671c47b86fb4b7d9465edb20ed0cc6c749fd
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4066a9c4b1e80f50b381667f1751c47c0c342a2af91294bae84c32567404900d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 44b034f617c6e9f1c7c643dc6bd0a4e930269e7d74b5ae81de64088e559cc262
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0428bf6326d0d2aaedde738ff2a048b005e0956067932b1a251d3904d56ea2ef
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 60070455870510d0c71b8b5f274cb4397a2b3259984dd48bbf5e0a746eb6b330
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bb8658d4f44bb72a010569223ebedf4c1ddd96a1402011f833e6c901a305c348
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a9876e6b5a39d0ede063a38b6b594cfe2a376f8584df08ec9fcfc9a83e8d8c0e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 75f0f8d59f23e93aef6b16be643e10d66e69626783946049278ffe639fa735a8
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b00e4e100c9de6f3dd3bd81b39ad600441484daa59ef3c10bece45018913693d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0c302d6445765ef62b8a5a406d11065e1bf60df7d1d6742146d81d90257c0bb7
                • MD5 SHA1 SHA512

                logs.dat

                • Path C:\Users\Admin\AppData\Roaming\logs.dat
                • Size 15B
                • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
                • MD5 SHA1 SHA512

                memory/720-191-0x0000000000400000-0x0000000000457000-memory.dmp

                memory/720-186-0x0000000000400000-0x0000000000457000-memory.dmp

                memory/4340-26-0x00000000007B0000-0x00000000007B1000-memory.dmp

                memory/4340-27-0x0000000000A70000-0x0000000000A71000-memory.dmp

                memory/4340-63-0x00000000002A0000-0x00000000006D3000-memory.dmp

                memory/4356-15-0x0000000000400000-0x0000000000457000-memory.dmp

                memory/4356-158-0x0000000000400000-0x0000000000457000-memory.dmp

                memory/4356-10-0x0000000000400000-0x0000000000457000-memory.dmp

                memory/4356-21-0x0000000024010000-0x0000000024072000-memory.dmp

                memory/4356-25-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/4356-13-0x0000000000400000-0x0000000000457000-memory.dmp

                memory/4356-18-0x0000000000400000-0x0000000000457000-memory.dmp

                memory/4592-12-0x0000000000400000-0x00000000004A3000-memory.dmp

                memory/4592-0-0x0000000000401000-0x0000000000403000-memory.dmp

                memory/4592-669-0x0000000000400000-0x00000000004A3000-memory.dmp

                memory/4592-16-0x0000000000400000-0x00000000004A3000-memory.dmp

                memory/4592-17-0x0000000000401000-0x000000000046C000-memory.dmp

                memory/4592-9-0x0000000000400000-0x00000000004A3000-memory.dmp

                memory/4592-8-0x0000000000400000-0x00000000004A3000-memory.dmp

                memory/4592-4-0x0000000000400000-0x00000000004A3000-memory.dmp

                memory/4592-5-0x0000000000400000-0x00000000004A3000-memory.dmp

                memory/4592-3-0x0000000000400000-0x00000000004A3000-memory.dmp

                memory/4592-1-0x0000000000400000-0x00000000004A3000-memory.dmp