Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/08/2024, 04:12

General

  • Target
    add16e6b671a97d57e883ca87ec4c2be_JaffaCakes118.exe
  • Size 802KB
  • Sample240820-esslsssgrf
  • SHA256 fca23ef7f4100bd739bda0fcb5a116d11aea2afcaae74aee56f4a04217d65f2a
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3420
      • C:\Users\Admin\AppData\Local\Temp\add16e6b671a97d57e883ca87ec4c2be_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\add16e6b671a97d57e883ca87ec4c2be_JaffaCakes118.exe"
        2⤵
        • Drops file in Drivers directory
        • Checks computer location settings
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1692
        • C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
          "C:\Users\Admin\AppData\Local\Temp\%tmp%.exe"
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3100
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:4828
          • C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
            "C:\Users\Admin\AppData\Local\Temp\%tmp%.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1420
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\system32\install\server.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2364
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 560
                6⤵
                • Program crash
                PID:3256
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2364 -ip 2364
      1⤵
        PID:3348

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            %tmp%.exe

            • Path C:\Users\Admin\AppData\Local\Temp\%tmp%.exe
            • Size 290KB
            • SHA256 02abc99f001f0438f26ba898e73f6fc951352ff69723a266a100acecc13a0324
            • MD5 SHA1 SHA512 SSDEEP

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 97417da54697a50fe068e37eb503878eba5440a8c6ade14a9d960b21a06598f6
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 7065aa5f576d7e1e138f31234d76b9b66b3a01570013190aca15c60215900b4f
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6cc88559430ce1b9d676fac58920edf9e59f29d9091d616ced4284886e8b0188
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcadf670d7e67328f3f2dcc8a2711c31fbb251a0084be50fad7ccab89186f9d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00d3a22362b56d284dd81c2ade11b4536a6cd2b9fc69f00e28f7a7890e5163d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b00b41de6d2951c4d514f9bdc4a587ee36ba4bb8a965cbc47e33a67515f5f666
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e2a4c1fabc386400f25123c853f519092900504b6a5df1840c5cae9d09b19f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7efb0b13e0489beda0c7e163f3cbd7dfb747e55a390bd59a0e5d00ee6645532f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85a4bb09f014163bd25980e7d2822b286a3e81a2d02202c864e356467b722f4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f47f41b54e7df7cd84089244ca80e264993f05bcd17244f30c1cb7cfb8960974
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a3c90bfacf1071f16c13547e8c6262964a06f4cf68c995175a4a7b313ba0b5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6122080523a6c93c74164858b42b19354b4c00926099d981f42120c01a056e4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2d870e6990f9d8fe458ea07178f838aef463dbadb7f1a7519bb42ea90710ed1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc9b971109d6cacb96aaa35e04769ca8c12167a50b84c0ca543525d41adb8b54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8806e0f60a74ea3aa2f17efff7b9ea955b9e616fc6e45d8c4ab41f595b372155
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e1e5f3e9714e3abd1a083847bdc26f5cfd378786a7945681eacddc48f93c459
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1085f2744b2319c442a10a00825d4f5e82114fd0e27ff5da3f4fabd05ff53d7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa0fa049665eef67953bc1f71fdf2ccb69cce00ea191380774e3fbc7cf581f92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd463d30a9e157cdf0e14c0fe630ba1c3f35ae1f76e0fbfb1fedbcd8cb9f6253
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30a1df4684ebe0f23496035028eaed7d4f3d16e711af72819b9653c90a2312e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc18f27c0b2e4d1d5973ace78aba5305f7be21ff1014d746170a85a5054349cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f207385edc2a214c06b8b3b076049682204933d09e6ced9a44fbfb394fb45506
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49100741679cd19068292e75fd37ca1f2d2f2c8338a562e1ddc8f0c6b3a9b9f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2344889c0c86eac8b01c2e56627337d40b4e56135bde74f1c987f34024a66948
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b3b99c1f24644e99691e83833cd29adf6e845d14528f6f13923fea27fddf2e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 deaa67b6e767754edae2ccae9d45ae8ab279fc210eb0e7e61aba6c226903fba1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b156702c993b9b53f8bdc7725f9bb126e619df48bb1886ab447608310770841
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65fca69692793257cab450bda259ec8b122d5d79de3a96acf322460fccfa2fc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2516cb908823737dd586c3fc38814cb9d7065b384120f9b60efcdb0d5c77a5c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91ab7bcf3eeccc1023e1041ea01485cd081bdec30aa06071061c7ede64a5d8bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1973cf885732deec9e99612eb6aa9cf7fae49327ff2dfbd46885d03bad5b38f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b46a0491912d9ec5d30b88dd0bef777dfcfbb707596f5f658046ead67b658610
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3afdf9c6fdbcc48eef80fefb1d0f20b9b0220588513593d5fbe4b8fc359bab78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46be6ee7f5eedd576272633f2c9fa0d9fbb74566c2342c98fe33589699472287
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6fadbc2021dc763efc3911abc1be36a0e9e1251e0878b95624e84f23fc7893a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c9b46a31b71c59983cfd7612f7ab194ceb68c1505da1ac40851f4d6194cca1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b18f057c59ccf2c6c27d4b324e5f6f6fa7eea85a1e6243f6358c8de8ae89cbcb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b849eebe75457663fb9b28c20da12e32f68eb2a68797c70a3f455d2315798d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5f3d0e3dde8e1bd79760ba14548a557733dab5650afeb27f2fe21e81e24ab24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecae5c68ee126f9101cb0a022dc5fa34d233fe25a4e363e492019fa5be80469e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcd2f4164dbef6a1347f117214efe274786e548c16af6c1a5700fe28a6997977
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61adb73636ecc728e00685decf6f0fc64b0d6ddef9310f251b80c9e8e7ca33e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c3ef3995a65176156d3701ea2b066a9cbd158e1c9ff34d4ce466541374c0ce4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa35cf2e49ae3ccf4f420fdbff88a549b3b767398ae4f91a3a98f0e656aa3ae3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cdd883e4c4a159fe1a8baf72c3a9d79a3e5411f19cdfed09f54fc999c6cc6960
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39423314abfca1c8fe55cc1777f21489c91c2b2ea6f151088b45c3a3f60d416d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 220e9a04385b7d9f5a951321962ba291451a21cf9baad8714ef2af27e572a678
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1271f16a347fe13581e483dc44a2612540e96cc6cc51133c59c51a0a61ec2c66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ec0d6ae97b66311cdb50baac98dc89abaef5fff81e547e8da5cf7892f191d32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5ba209ae85cc7fa7afd4c19288a187bb4632da354e89c9fb05136c5bdeaca81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0503420e71514b2eca9ef323b4bf8980a11e412acce76644a11622e0564abfb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3cb15dd71cfe6b4dcd60fe4e4bba7b46e9d3dced8cc532a87bfc3514f81a77f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 deb9dbaa6a9cc9015c0fe6cfc66af7ca3ed535aff02e4c9c16d40389bf5f1901
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bf664179ce72f13c7f229add7e9db9e368893a908d73b3b219ff79ecf2d29d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53ab759e123a658a740fe5bcb82b5a5c512e53159fd1d4e58226ad177ac3d43d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 261e79b0bafb8328a444a1f24e55c6ccb8692c877c63e9af2d66e2b90ce15672
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03b5c064fa6b3a8203ea4f53940e19fe196e8ebed7877188ef8f2a07f60ad92a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0da7ef600c33d7b1082951b303bec0d5bc3a3a9e09a693f602883179b74369b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a239550221a97be7b8735cfaa98c08a050789cf3dcebf88f369a24a37582c4e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fdea88e2832bc15ec7bb82f4c332483bfc9ded1edd15f5f7c142ec7ec3b89b3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b874dcc8487ea0d9d465821d74f6048632ec5cbc1c1e2d7a7f2129902d8e663
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cff20d1b87c6c906d45637e6c99b8968e22b4082126139fbb0267f0e8e31db21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2d1f3ed3178c93b1ec3955d2d44be8e2bf7f04f6c3efeb8e4f3e4ff12742d75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fcf91adf87956911ff4d3159bf2a380681914c5e7a6ccf8c6dd4d63f9f23643c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f862f4f7c9a0147dd81a6dd8fc0c87c58ca7960748d124ba91451626071b8bc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66b4e71c32c2474ade71b9acdd7373c6e3a4052aa2b9fb8bec6058cc16001421
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 053b8f78bbec5f8b7d3d3e7e7e465750fc58823c893448c13038b345103a4b73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a12c5bb5a1f3bcf0b62585ca1222a7cac97eacdfe569ff1b368c5dfdae3e77d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dcbf8e378a03a44757bd3b222e913de20b5e0b77c87684c7e33827384677603
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26383a1e625397c021f5236e77d6515466c60267349edd9000030b5332041c46
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fabe3394cd6549dbbca5f23c70a9c4f382b604822f987c46efbd27b993dfa410
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47f159c488dc1c18a5fb7c395c6869386666ece4c07deab32ba00265d28c8d02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25678ea2a9d3d77c062d7c25e4a012a42af77070df9e429709d9142ac21981ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9be7834530af2630b9fbd8350a2bb664e444eba56bcbfa644318b81257e0811a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06fec3f521cfe52c6b4ff9ed108011bbc2ec827b9c0842e7a6006877ab403441
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2be821cd9c612de2aa70e6d976913b04328b6b91b30894a80da354e40a4115a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e218c4abf736c2dd19b755eb319a68f856a56f234738f915c5509a9fcae8aef8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f0988003cc8c6f24b81d8eb16cdff05bd2288ad6ac4eeb9da7181ccdbbef1ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 343169f16e05a5fba8263635923e029e5715a495e302c0d84b20cc1732ad0c42
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 368821f4d29f03758714f6a561a1f5f8ba5c600eef586222af8930f29e2b0252
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a9196d2dce28450f8c1cd9e949b4438a6f4811f8fcf7887747a8f6d62758bf8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0fe2888e3ce69fe3e18e5f7e2cc5c85e542ed80acf050bee6e667efaf1bde56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d31c20e42570771e483488c6077b68e35de2046c898c6fea4a740a10b9c7a3eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0718caf9dfff2a809b2b692f7c8b9ef107e53d21c359d83f40c92fb7375519ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 134ce16afd330a82a011ef2c2924d313f7d7db3d607f7fb8547c4034accb4268
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc8cfe682f6ff693c598cdcba6cd84803252047e3fcf344457bad834c59e37f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6c773c35ea13140e0e65358a9f8baa0f1dd2713bbcc170aae465d229440ee1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4e7fa50ef307f7725002c298f9a4b53b7044e10529d5a1ce42bb912166b816c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f4f92ee256a0139e77166167a601a0ea0f9f7e34bc2361f1581efb53033016a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1092d4930385cede5c692f10fc6dbc7b743b1f925acc053bef9183da93952ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a4bf2d667ee1332ffe1bb1ce54dae46c99ec7d92224f89274770deb7de2ac1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cd1d57ff76ddaebacc1f1a49ccf33b50dac9403c1311a8377051096d485c6e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b5b9a3f3a48cd51702629505e691e872e5d10291a68d0edad715d04c5b8d4c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb2a0d2faba6de6913b7537001a32f026fe588cefebcf73ceece4043cb8cc00d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0eb49a3e9a4c42a599c8add04de16737477f195f3faa9613382cf030c19f824
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e3d95b522ff415c21583e8f78eb3d9418f499e327e5f1b04b81b6156553e2f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ad2b895ebd29c5b51edbad437c6ed692e1a0f1b9d240054a6a7cb61a18891ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45cc44ef160f0a6316be1491536fd29ca9a09ce3843adc0a4aa17ebae94449a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b06eab9470f06aafdf893da5d462be3a62978f8d8de73afc2e9dbbc9a0857a76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d09d9a229e281d397c125fd8416a6115bb1d67ac1a8e64acfd1eb19340f2c067
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a820f97a7231b9e1afda272c6af23e1ecbeb1415c65cdd10b7e5105cf7b1219c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07b723161da9cadd9d7d059f3a206e5ce1abbf4e63cd732bf26501ed4efdee15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10036716d00d45fce010b11390000a749107d34084031f0b9fea537b15259dfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d0d8eb5177b39e5fad181bc78c81742aa1d81bf9e39b137a7f22b109b5a68ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 829498f3cf5b8e325dca5102bb5ef067bace2a4c6a91a1b54a71f55ef95272d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c423c521130b157e43a5acb7d297674508486c178fb610fae774e04b6ea0e20b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ccee1d4127643b94fa0ab1c6fcf76bc8ccecdd4a087554230e03e34b982b016
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abbb7655a2947f8bbe0a49e750babb802ac60e242aa3d785f2a2a2a66017db02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9f51bf6a35e7ebcdb08635ba6e8fdfabb5252490b14769c23d43dea2f6be909
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cc1566b2ea45a4e5d96f57c4450d72f3d5f755822b7cba91d2d49558d91f37a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e1346aedf3e22ea45f5c7dbddb68cbee98c9239c7874c0f8023bd524abea46a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93f1a904a7c0d3ce713254f3945419a9d8790659b9399f634694ae4ef0492ba0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a39e4e6e60164ae8884549029fca5174c88c4208c66992d7e5bc19d0d48a7413
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 249bc7d7d0bb13b66e3cbfeaf8ee55a91cc13525dab5aa80a3a03179d23532be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 044f82aa2871ec890d38bac4000a1b4d37167930ca17e23e1dd6254cc572939a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49c65059220fba06219301e094dd949bfa91772a2c9b991224fcec7da051bd57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b87e5c1b211d949100784b17db292f042bdb9f5ae9ad235fe1298cb40c475e7b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 108ffcacefed179852ebb57765489bebce19dbd6a740b894f977e30fd40ab78b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffdc399307c4c83f40b725d4ae3f1c5f8a3e96eae3bbeefc0a8743e4b2ec7238
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c4257b2779963c6e87f28135392acd83971002f26f825e3ed99fb084ae634c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 147edb2dbf277a7c254dca0c4c53eec7f1892170fb25475a1736a6ba7fb700cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2c2b4201daea6d97e5a1830e4e10250f88306ce17a3ae57188f1c2c826e0bed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bf41bfcadaea8fb9197fd4473e0ee63081b57fbad3f014fffd13de83fc1e9fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f015178fdbd55beffaf363cfb5873d4dc771cc8d2c21dfd55352997ee249542
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09da0b8b32e07eba603ada9600fbd399c694758ba2178658658cddf46692206e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6acfd2212ef888e14fc21b9e03fbdedd0c529264d4495173ac1eb27d746517a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abc6ef08bae9c8aeeac64dc58d77bd59a65243176424dfa0866bcbb4489a269e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0304ac5a459b29bdf38976f9499a9647d3dfb9333237ed7ecf6c8f869a609e9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c8e9bcb0ed0f581ac408c77e60901ca2296535205f28f9431f4e8c763350cea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff186ce118f6404bc4654625ccae19b438073d8008e8644c875631fc921c220c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b1ebd9bd9f2bc90556333920f9d4ddb18fc6035d4c4e407c39880e0e84e630a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d7629d77d49fb8033e1e82d907f7ff716b140828b375ad6736ccfee427f2864
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e95ec1e9e7f5c087ad176f479fce5c8b6d846def845d72f63d78904bdfb7d307
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d230e0c1d7ab2fd6175c58c116d3ea7b086193934fe2e3a6ff8e9741a7b78214
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4e7bc26fb86f83a144fc9352e332b3697d98e04ddbe506b462046a49af9e503
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c07b26fe161d7c2a163708216bd9ac3737758e42a71e573aedc23ff3eaecf0e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e065cba0b682a30985481411eabac29a4b23fa95af1c48b5f91f24b62156e790
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d969b6f707d618d17ab39d84ac3d26f7400fcf7f3197484c547533502b7c090
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d708d806ce7282f79486acff6b1aa5c3aa3e33a121d917586078086559079b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f28b2b455a03e22aa18fd3d809fbf0f9f5a75ec7d900f19f7581fa6e13710717
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            memory/1420-156-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/1420-202-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/1692-2-0x00000000754D0000-0x0000000075A81000-memory.dmp

            memory/1692-18-0x00000000754D0000-0x0000000075A81000-memory.dmp

            memory/1692-1-0x00000000754D0000-0x0000000075A81000-memory.dmp

            memory/1692-0-0x00000000754D2000-0x00000000754D3000-memory.dmp

            memory/3100-22-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3100-25-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3100-21-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3100-83-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4828-27-0x00000000003C0000-0x00000000003C1000-memory.dmp

            memory/4828-26-0x0000000000300000-0x0000000000301000-memory.dmp

            memory/4828-55-0x00000000753F0000-0x00000000759F8000-memory.dmp

            memory/4828-91-0x00000000753F0000-0x00000000759F8000-memory.dmp

            memory/4828-89-0x00000000753F0000-0x00000000759F8000-memory.dmp