Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/08/2024, 10:19

General

  • Target
    8e5b557ac5e016aed59978f894d8593b_JaffaCakes118.exe
  • Size 2.7MB
  • Sample240812-mctsxs1bme
  • SHA256 00cb81b2b22bd810986bef5b2eb9223ae001fde20b9b3a53a8102f7b8dbcacd7
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • 127.0.0.1:90

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3468
      • C:\Users\Admin\AppData\Local\Temp\8e5b557ac5e016aed59978f894d8593b_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\8e5b557ac5e016aed59978f894d8593b_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2132
        • C:\Users\Admin\AppData\Local\Temp\8e5b557ac5e016aed59978f894d8593b_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\8e5b557ac5e016aed59978f894d8593b_JaffaCakes118.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1996
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:4664
          • C:\Users\Admin\AppData\Local\Temp\8e5b557ac5e016aed59978f894d8593b_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\8e5b557ac5e016aed59978f894d8593b_JaffaCakes118.exe"
            4⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1316
            • C:\Users\Admin\AppData\Local\Temp\8e5b557ac5e016aed59978f894d8593b_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\8e5b557ac5e016aed59978f894d8593b_JaffaCakes118.exe"
              5⤵
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3964
              • C:\Users\Admin\AppData\Local\Temp\8e5b557ac5e016aed59978f894d8593b_JaffaCakes118.exe
                C:\Users\Admin\AppData\Local\Temp\8e5b557ac5e016aed59978f894d8593b_JaffaCakes118.exe
                6⤵
                  PID:4192
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 532
                    7⤵
                    • Program crash
                    PID:3676
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4192 -ip 4192
        1⤵
          PID:1040
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3908,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
          1⤵
            PID:2660

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                UuU.uUu

                • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
                • Size 8B
                • SHA256 d85dc13d189c08beb623abfdad749316040f055ae02c7495054b0c460b8dca09
                • MD5 SHA1 SHA512

                XX--XX--XX.txt

                • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
                • Size 230KB
                • SHA256 0c18e7603f82a0c90d44d318931d7eaac52468db2773e1881c5bb73e4b8b3d62
                • MD5 SHA1 SHA512 SSDEEP

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 85a3ee0674fb6707e79f3a09d06f80b8681bbc4ac0a62f296023cb947af05540
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7809c4eb2e6ca9b38b0ca292094b2092b740823a0e003cdee3cd2cd3ef0aa7d6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 12565e2578f77f94b510186a129d6de4cfcbb222eb056b17107c495d575dcbbe
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d6334c5223a20558ff456afbf510932cd9b77cf14f1f0dff192d687a647fad61
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 899a671fc0b109964d0a0b178c68f52b312d8fa87483134c0258f51ace166164
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d686ebc1691f6e69ef4b01b7f58f4c5d77c2e720547cdcc4d13130eadd65d3ea
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4975c640f1545f3219e67e06a14a94a3557f18b0f0da5bbc717026603348868a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 00fe6553df7339e1258bf9e8c0af53251284985e4711df3f93ae0e86762631fc
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 449d03255aee37efc614d8b4adb5bf8ef02ac440fe32c5e40d3293d2f37d653c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 42a331e5ea85eecc355adc4d73cafef4101bbbe8f3f30aff5413ff6006ae14ff
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4568ed64fd9b69e3cdc2c4542689dbdd72c0ed39369e044f609e301b3abecc90
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2c5abe9913942de283eb1c58c46c3f9a542705ee1b69e18261a41073181d3059
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7fe432742eb29fed55db1a47699d5886677888a1b3d7d89935d3bd495f4786cf
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e45a4ac87d7388e0a65078ab8e7e47a036ef5346f507e9277b8c9b872aea3c30
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d28c8b4a76e62814fe7b830b9543f3391b4c89cb2c640a09467ffa0f7b569e09
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6c7d5a7b5f986d242a879a081b86e18aa0193d5bf8679fb8ae79276570076c1c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0eed070dfb3203aaebb10c8b9158f1ccabc5cd1ec9e78f2db543fd75adc03c4c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b559cb384869bdc6c94f18d9b765f01a446e3029d928e0c7f8675613581c9aa1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 317449e634a5a7f7cd757002ebc94ce3fff24142893e783896fd34b0b1f077d6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 052daaec2bfbacdf206ad53e7a8d0b97b1348aac72883ecb025d0f117d538537
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5fbe1502e0a9f6d883488131a807bc722dd2d1b992e93e2d7358b21bc0dd5e56
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4df53a145854417fe9a4078ec214cd6860833d0ceb0b58884a076390947e3bb1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 fd455fa40802ebbc42bc9c88e54f630aa581b00157789e11d986fdac5f48601b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5c7c72f1c0c8219ffa232001bd07df165ceb8b7df79fc0a3586d927b4618427f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e824c0147bc7a128d7f69a9ed2b89fb31270059af8007cd41fbc77d225162be6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1dd3eabe26948b7d7d9e94dccee68e0f180f342fc67afaba03e34181f0574d38
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0447889df139b5bb0fceeb84974b5b307f2dec32213e1ad6712fcf2ed01abcad
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d2be81388424eec3b13240916c7d67f12d1228dc089cb4eed577633c34494927
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c863f0eda9729210aa3ea7e13920ec01a2d080dfd032b982a6a4b9fd99f3b872
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ecc4cd611bf9a033053d62b1eb4ab4f95f8886806218cbd4c76fa709a2c30b21
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d0287776a2ff9af7413f516100f29d6c968f90e41547e768fbc1abf4a2382b9c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9f3ff2c48de7545a4130310ddd87481b20b5f7e0c167b161c2b31c02bcc60263
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 417989206389e2bce26181de264eeaf1b695691c0d23412366a506a632012a9a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b39176e0113c240f5689cb928d6d6079b040b4924d86e719aaaeae08a9a9949e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a1da876aa8eb6d0612d1f5b6ceefde5888780cd180430bba691fe658b2a73492
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 76af111ef46af1c8d5ac3d56bc3cbd3d8fdc870a332f5f7548fb5f18401f2b3b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 32e0fc2572dd3ba129e2a85943aeb717e4b728fa06e43852788ace228e8acff8
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2e1b758ccbf0da04f5e99f3325f117176cbaeede1584bbeff77e23238d218e7f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c5f1db4d5795facb8b8c30dbb632cd65d6551524d922ef5bc2893463f9feb64d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2ba97a0391021354142c41ebf00ac088366264c99655b3873d4e8f9bb05e8b49
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d40b5d467fbd5953c5b9b968136d89ff4dff6cf814c933efe8ca851dd0c94424
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 da5def941fa5235ed79539f4a6ba77c72aa0e8c237e1c2addcd89907e5a35a6c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 23dc89ffb2eb03a361c21ad309e58f97405e443fb372e190617b5cbd4e24772a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 969e9c0e42dc9a5ca8b29df3cace80539f75b152f8bc70085d6aa9271d6ddc6d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ebb8cfd354a63fc5b5ae166b418588ae19f8b96a658be70f4a097d94c041654e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f0c97d5c026b62c2a1339fa74d638caf6ccaf582716ba79d24e27b26dd11e117
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d6908f1743df94afc740ecfbdcbed5d7a2f03189c1fdd34843ccb0fa7faae07b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b3859a09a24ba46fb58d34a3cfb8ffe6b6f3f19571ea5faefac7a16dce0bbd23
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e14c52dedc1bde0f0373482031b780febbd3a5b4eda2f5d8ab605f50840294d7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cb152762409565d8d540c42227f09425c53a746e3d2d09b34b15e4b1589276dc
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 59bf38adf654d070d4b91da817b496a1511df53c6a9ea0dd658d04ac8e509af7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d4f6534a32f8ec0e0734aa07279e1e2fa3a70d3efa28bbdc261201d047ad3e54
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 831107585676f808a68d9788db859301898f66544139958f6eab8e371c05e0d6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7be15f8b5210cd9b25ddcf89420ac6fc27557ef5c51406668592e967c992c1eb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d6c36af14caba2a71b3f1e1410a32a2b7177441737114533b4a604ba22a5717f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 feb64de9c87bca5d409438a5d2d14b346aca4be1fec2e07e891ba1bd5afd88f4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 787baebbae58355461603937b88e5facbf16dc0ee7398dc5dd8e6578a380ccc1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e128f45d9993153f76249d6fd57bf085bdb440c0e5724afdc2fcb06e2afc3258
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 165d6468fcb4aacd92ae89d7dc5f947a796140bf452f873f110ca464af250350
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5b798236f0c32a511333d4034d99f063d01565d7fcdcffdea8beb2e10c5ff912
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 60baf3106ec0d3345d167af4226c486574ab80ff43931cf6d8246b637f60e45f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 de46623b2ebb99c228cc79e3966b84a30be4df54a031971d9eed2d69ef60add9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 75d0372071120cda37156a837eb94523eec94b59d8f12cf9e58f7f01108b7112
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5420cfdd16b10882335175cda680e577b48acd4e7eb47ea02d2358877ba2674e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f6297b8a44b2b97305053c8dfab745a9a21dc618a38576540d72259fd06cb279
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 108969a171da53ca0129117b62a68c162fe7514bcd9373ce250bad9514987f02
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bf8c98542520102518cb7048ab12b4cd069101b37a050ef7be6812887fd88b3d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e7743e352deb1375077ff620b6ea20b5252762a720c383e19f5d91fe06ba27c9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b97e17a2f7ff326af2bb36879f97ca6a1c4e0ba6654f2e01bdcb9e305b90454b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 592f75246bd1f0d835e917d05cd819c0419c27c87d910347d1914365e4b7332a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7a97e171a93e2148551abd904c4ee06eed8497e74f4a2e6dfa7b4bbc9904cca8
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3413889ef29e4530f646370ee7259f46789bc58766d8654cdddea2b1dab4f4b6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8dcdceb158a78bdd6ac16c4b6f3691633a490b06d3f602ba8598caee3e28095b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c3bc30df4681be47b9a6514e9c834bac1de66f49952efdbc1f47ca3c11a67897
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1765a978ed852f4d9e23b4fb8fe957dd63db0c6c7277e4aa75f3d92769cd5eb5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ff5936ea756ea374df0bb6e61c468c80102db6d9b86c4ab1579cd7a8768fea03
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 eb237bbe8a148535550ac3ae1808809eda88edb08c7ef27d486e04323156207f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 af6c3c085c785a650291baefe97d5201e69c27c35ba19287da8c902b7743678b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d0f514edab945c96042f711f449c03e1edb6b813a9fea9d8336c981f47f3dd0c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e12c02f390386b53a9984ea1ffa9ad96b135c6f619787ebc3765b3866270f322
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 33ef987a8c2ba64562bedd8c13c9afd928fff18c1ab2048096d56c8bd4b72a76
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 29df6bb6db3ed250411f4c3ce1fe217d499e479b0794ab4cb65bebdffd8f0466
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f1eddc46ee99188a93efc1f099e4d4a56c25f7fa42c116ae1a5b2cbd84c552c6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 593be336e174b27dca7b2ef9575ee3d638597cc616d2e16a30877ecce73efe99
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 858b6a65d9c03e68f6e8d794db3ac1cabfb9bd16390b4db177b76f61c63d97ab
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0395144d16cf0ac958d031657f21a1ba1cf1580647ea277925918f237e3580fb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 11b03bb6005fb5a68dd704789862435524b957a52e7fb55285e89e81c81fe129
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7135b57071f7d3c76bdc30608107213029cda15c8e00b77e3e3a22605256dbce
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bd552c1d7661a4f1371d4bca6918bad9c84ab19101d288b9b9a8c56e41c172b7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 09c8cac8e745c4f8b338c2709f22360e2ba0bc8bcb47cb8cd40b595fac047fbd
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6c934e67c6b215e46b2ac1ce78225bf6a0f2123099c0d11f013db848e3d6b572
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 27bd1b7e49f6733fd663b5158411ccb13502f9dc311f027ac61c2019b33ec0f8
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f292660d963d2d3f4ddb6001d86a8ce853a87e0bcc111b95695046f7be1437b5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6f59688c4ce8aff374c348ef4a94d02c7f52cdf77a3b6ab76b52528eebe831d6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7d9f0553557cca21fb82ae9c970ae303352b3b5a7e3425a5b4be8116fd58d48b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f1ed72476d8285f3264295e2e1a5259e80ea4998a465f89baffa801c1bcb0eab
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7fd151b8464e9b23b66742cf8aa0999966e1384e6fdea3e9a5ff1ae6c8d719b3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2cdfd1890690d6633e60a592b8e5b6f56f54588510d2b196d5c60be22e11d3b8
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6320c47ea9ad8f1a3718cd8ea9dd091a444c755422c04f88bb8dc290dd4aa2be
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8786d49db31e6cfc26d3975ce1056290f2f0011ed4c1c196e3fa35e7d9ff098b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5ebe3045e55c51167dee16a75494c57caf8b8a327cd7712793caa0e0cf9ed0eb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b40f42c4910fc309f815b99234646b801576c8c9a37fde0c7189a4cd1673789c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 17eec5225bc51207c789b746d1e75929ef8181b3a93818fb7eb9c3811c573552
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 83f6e08aa221493ae0b8eca57c1bff0a76bfe17bf64e3a9f7b9229dbfb7497ba
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bf73eb07db0eb63a051bb9b518adc40f36045a60ca1a1417e56018079a66ba4f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 239c2eea0cc96949d70fb29747c34fb94f6e8d51d3088d324b30390e4c0674e4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4061ebe850ea935e31d03470ef715898f8e8259108bac5cc3954e8fcec46c8ce
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 abcda426b0d9d09e6a9abb12bcbb3a41f028318514351cfe054b9415ab2c3dd8
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 300c8400c5f13ef1d6372152e16f2136d4be355d6aa35345610fb8fce2fbbb4f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c1df720ea955d9470e5a297e7305f436e846d6c6977244e9c6f5043168991990
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 615ec4a033b71738d780600c3abe865bb733df5379bb41b6f34f08394846c958
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b95df9c28b4c96d9d7496ace8cb02e9c3824041c731433e85d4a5ea507ae0abc
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d7d6ec1f5f8a12190f20179f816a00b5e05fdd233cc96d65e0c0afed8060aa75
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ea594f6156627bfbc73b5cd4fa1db8dd8833e20d55cde5dd5c91ac211de98ef9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 284941d21edb3bfb8512c092ccd5f849d5ee4c30a318b9f79ecd096d509ef103
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1c6da7174fcb26242f04f8d1b9bc1a2e4fe0ce0efbee355d10754f57b354129d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 022eed5323fd8793804c7c69f1e5b9c254d7ffd5547bba8087ef70a614154a6e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5286fda9020d37b5797888709d1599a929c7ccd7343d399bbae5bd763dee07e5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 79e2912eeb56a89b19567361c578232a83cf401a30c47ae9c832ced3d12b4424
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5c9f22b7f0bbab02b06165ca684dc1fed840fef75dfa699e619b2e4de2e92b16
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b98f7b29488e9a8e8051770614beb8c7fbc76180f099b19136e4a5a1668ed219
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 045decde5260db1672343f007320f15a4e64e1d59357f3e03429c468093567bf
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 58dadcd6934c822df8558824bdc0cf45228bc42cd536d971841d578ac924f37b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 604aa9ed2045455fe02f67b4af649aed1b3369b762ef261e3044c2be67edc6e1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 643be095011448352665aebf2063649e390a3cf9d3e3a72b7315a9a28ca42f88
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 844107b5a56d7c698b46dc0f8b12219ba8d26b8020b79009bb2e8793c4d19f0d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 54c8776140259e916f33da478f0a7cf4458a15e6386e8ebc53e76c7b0b611ade
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e2646234df8758dc4805e4481a753ca83f99a5d28fc301f819552a2756dfa062
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b27048e305979ac85284a866fc56c12e1c9dc1020b14c7dfd2d85f9dd306070b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cecf89069f8bdd1f45b4faadd28c937fbee5cc01c21d8daae0ecc1e10828470c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ecc2bdeef63e960d70f67fcc3cb8ef6382b51265dee6b3889a4a49979c6f76e4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7c2dfa70df12334ca7db486c6232d41010719a81407e055e52c563878ead1fa1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4c5cfb646c132acf40fe2bda16d39007e7031a19ec4fd3d8df7be2d1bf2dfccf
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0fc94536da1177fa99ec332d20e4f7352c9a1bfb987207957bd6c5ed8b474589
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 3ffc058b53885967f1e20e9d3c173de350c9dbda6447c87b5e244ca8a726fdf4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1a0954e9c92570c8c6e4348cba11cd272ed312c36a78af8b2e529d791703dbd4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 55211290018182e8b34b465c820e015870df26d7b487e2e4cfd6c161ef3d6770
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 88a6fab85e64936652aa30e0bb1c019cc22f3baf9e62b68233e98aa4147cf5fd
                • MD5 SHA1 SHA512

                logs.dat

                • Path C:\Users\Admin\AppData\Roaming\logs.dat
                • Size 15B
                • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
                • MD5 SHA1 SHA512

                memory/1316-140-0x00000000240F0000-0x0000000024152000-memory.dmp

                memory/1316-1470-0x00000000240F0000-0x0000000024152000-memory.dmp

                memory/1996-68-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/1996-2-0x0000000000400000-0x000000000044E000-memory.dmp

                memory/1996-8-0x0000000024010000-0x0000000024072000-memory.dmp

                memory/1996-7-0x0000000024010000-0x0000000024072000-memory.dmp

                memory/1996-5-0x0000000000400000-0x000000000044E000-memory.dmp

                memory/1996-4-0x0000000000400000-0x000000000044E000-memory.dmp

                memory/1996-3-0x0000000000400000-0x000000000044E000-memory.dmp

                memory/1996-139-0x0000000000400000-0x000000000044E000-memory.dmp

                memory/4664-73-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/4664-13-0x0000000001220000-0x0000000001221000-memory.dmp

                memory/4664-12-0x0000000000F60000-0x0000000000F61000-memory.dmp

                memory/4664-791-0x0000000024080000-0x00000000240E2000-memory.dmp