Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 20:12

General

  • Target
    bcfeebcca47330eea51e777f28a67484_JaffaCakes118.exe
  • Size 571KB
  • Sample240823-yyyjsateph
  • SHA256 e4585f31a1f1b0b01fc6418a5259b5fc2a211beaa3cfe2ecacf1233450da0017
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bcfeebcca47330eea51e777f28a67484_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bcfeebcca47330eea51e777f28a67484_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3424
    • C:\Users\Admin\AppData\Local\Temp\ayoub.exe
      C:\Users\Admin\AppData\Local\Temp/ayoub.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Users\Admin\AppData\Local\Temp\ayoub.exe
        "C:\Users\Admin\AppData\Local\Temp\ayoub.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:1940
        • C:\dir\install\install\server.exe
          "C:\dir\install\install\server.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3868
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 560
            5⤵
            • Program crash
            PID:2252
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3868 -ip 3868
    1⤵
      PID:676

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          UuU.uUu

          • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
          • Size 8B
          • SHA256 11bdf73749d080d219abe4c74e6b8431fa90bac939492cdad00f34495d1601ed
          • MD5 SHA1 SHA512

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 229KB
          • SHA256 e2c434bf9b0f9914f83875c47e1d5f1922eeec6221999273a266ea56c8b769f5
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1637220a77241923e99db5410bb270558929060ba6ba426674ce45c410ab5714
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d2ed4a2ab5b06df3bdf62105008ce0c15c365a7c106797e52368da57b1592dbd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f9aa055ca7f8e56b8ad1459f44dacb04ff101f2f44517c752d948a8ec335544d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3ae6941f97dd1c654532836eb21769513ddf0180a1e6994a5367f26b08d8f152
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 262654f6f54f4de42866324e7a2c50d911dedb4c5a7d4271d447d17d955c6e28
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c4d71088f048282c2e5e51c61167edce571e577cf1a157392e4db1bb01cfb0d9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2cb3a8c1495e4ffd30e089cd2ba02e3d4e15f99f0575319fd94c018855b11e7e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f4ff2422db622babb1171f874bc6fc57602df603c3334e8eaded40f12f1dd609
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4e4ac6250927428d562676f2f62e5642f684a09d3f06037f04ef32479b2d3080
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 df644cf8dfbfea1e571329bc7c66db63afad919793af698d0ec7e7f1625d7840
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 84d677ff8d187422a77427b85c84492c66f92e778ec1e3b648b8fdb5978d9975
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c0ae5dd1b3932f8aaa9917ce2eb9f37a00cb03ce09498e97a11a24c0c7855acc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 25e5def7fb80b8991ed695b515c12c5eed293966132302cb7471f11402279220
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fe687d78ae0e31f4bc9dbe9aebd30b2189a0d9caee8d7be7c118f938d5417ecc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c65915746d07590e763465bb0f371eaa0a6b66f655f8af697494b6621b7b7d6f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2ac42251916fdd7699cca957bcc640a70c2d841107f351169ab66a9201b90f39
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 33a2a2e21e5c9c9b81b2e9ac3eb7555b317eddf85a2cdcca1a3e694ba0986493
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 db028d948e48be17caf40223573f0eb94763653db3f682614d62aab68273b982
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c70124e5607c6a2bf4c0cc97fc0adf323726c570c08dafd982b60fb04e31b5d3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d30fb11427df03441d498a45bb3eba9db28c8d97b8114acdfdac04b3ba22bc3f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 786defa16c8ac23e3273467e04f4e4a9fa3a1ff15693ea9f2cc0b1d2fc7676ca
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c4771cee922da5d5fddf3bd9dd26552cc8d270ebb107d1e87ea8243454d9faa7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a9ede8962859112a8059a199a492959d8336a6030c621f8c15f940471c4107fc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 35fe1822e36c60ffc43feee8ab9dfd30d7783359655130a2affd4b1485de0626
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 68d4b4b622d576247f51f9a437c37e62247b30d01d4907b2946e66ce0846ebb2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b3099a0b5cc9db5bc87a3f170ab296c38621499b92349a11f59db8fe750e4f62
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6bf78c00d2bb9fd9f02553e97bfd0c5754ee3d0fb261a873ae23459c36735d38
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 08ee1b29c020436cd2dad524dbd7c28640dd045eda571f9b6b6673d00431ce29
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a24598c0d3ac695448d824e7cb27bb329a7bfd3e942887ba6fd1f64fb77aaf8f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b99062cfd4312548d479a70b92a4969ecb538dda9d8c29d0de20e205976d0d12
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2cba1f55a6730d5dd14822327f04e5741cb985f8a938da13034100c42199169b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 82a574704afe8906f35495dc1c903ad8b8a4384a32e6d59faf0f4e12d06da826
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a8790efcbe21f0ff117d42d17e30df0ddf6d1a4f6d7f5f12b0dbe25a297caedf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 66ec21c4fee75c14c4361e73698611002b362624292c02bdf0749d81ed1a0dcd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 939b6d2a7282f5debf49c4f64f5ca3a0e40b5230ef629cae4e635e1412fcb681
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 44c1f960dbac7f9bd519bc1d42b36f5da1be98cc782e6164629c3ff1230d8f50
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1ae5c3ebd42441a756dc90c5ea0125282aaf8e121f3b270ea99a68b3161fdf43
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1d6f0029ba56c832283179f95636e6ef8d2338934c87b0c253656064af1a5659
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 491751776de4342d27d6dcb85cd4b93155b7e878425ef23decd38fd33e3aefb4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 45b67bc2f431408a0633032c08d319faf612d8e75b12f83c150718a864963471
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 98f97334c2deb15938da878a990575801f1d6fc496d631c95ae3d9b4c755e4b3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b7e3bab95c029a5428ed622a0768381fd1b302ab573d97aa6bf1a15193e9be28
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 91c7a4bff769150d71541324bd8bd62a3458337cef24ad1d4da40acefb8eaf89
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8cef9d3c020eb1fb3270a4ebdb881f161d0d1b3a23a8e34a263b40fc729df0c2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8fe3bbc7782d47cf3bb789a275429bb3f5f681cb1772ec07ede4f64f4a23c8f0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9d524a648bdf58e30289979a8f7317be8b05e4fc4296835371681ac660d280ce
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6c8ea7a7cc50a2ddd89dd5906631ad68379e673abcb867ffcc73a3ac0cf58051
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4b68137e4b47396986cbbf88ae5540b72d9e4e34eec027fd93e2bdb0a07cab03
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 355cb4d509a90a2d45b796931e92e56b18c7f10f625ebf4965419e8b3b180ad8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0fb90b738066a36195440827d3c798276ca943ab35c8be2ed76de9667ad4dd5c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6d71fc9e3960d89596980b9f06f4db78e8a7c5509b83ec18fef591ac46951ad7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6c139cc3277c0849d17746d4a4701890721ca3d02d399ff0e91f5c1cbfceebf1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 58ef474f273790fff7a57fe3e0559486bfb558930a155a860e8dd22f1e1fa208
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6d71a6fcf2b88c3a619e72e8e8f99a0946ca86472adf83fc1610c48c442dade2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d8c329d6d899a6a9ca2754ba56c249974c4704659ea7fe1995181dd313de4ded
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5c804d198d0d52a0db8a3823717a4e9fd9607bd822b8d447beec10e9a50853e1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f59be79c102ea4153bcb6d995b488f98a6a36ddc5bda13d3bc748c4405ee2da7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1133cdb37a88b1933d31c4b38f84fcc9931b343cd5511593f31fc5f093e5c346
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 913e994909c5978d04e349aac4735f195d7043d5bae9bee7121fb0175eb1ab44
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 418b9c32bdcb024bff80b7ae2611c2b342971d47ca9e1cf3f0ac4d699a2cc148
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6449a32caebd8c2874594b4b2a177018d913d5ac69e96c61afad378f84f28f76
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 73d260825ed110c2bfd6576961241f0f05f372e1c29a4e348a6a88469151b724
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 71423107db7c3c13d1d483156bd9fd2990bba296666e7247b110ca1bc6b6bb31
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 06879aab026bc7e69bb1a39ffc506f78fd5160b7528cba715809cbc6376e5788
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4915a17fae2a29c12e61b361cdfddd3e8f81a351745c68756b946dd00f03f22d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f7733f4b053773f1c5ccf23782bc5c052be907be1ba964eedd35954776be107a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9a614ad3a8dfc5c8d57bb9414509286a95be6449ab81fce68f0d0efe09ccefe9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b158f748c199fac3a027e4390e91367f2eced498abb5f8699ad2d0336d166e6f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 02f51855751fa01e5fef9db6aa3771df84d4be5bf1aa44906c47360554d70a3c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8b9997ae4dc5de2c9d7d1f5ba0518a0d1e179bf844654281320fec8926e5d0b9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 db5d9c9c38346eccb969726fd0150f5285d1e2c59b0dd1d34b1f37b3f7ffd9f6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 43d134872cf1a80f6772c502a714d3936bdfba99f0f93eb0f33b23cedb1922c9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f6c30b8e535ae5130dde42d707bd33c5c6a4df9f4ca292480b393d1ad405de87
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 35f8c94334c17cc6d086b4d8f0532e3e02c27cd9016590f5e5bd530de7ef247d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0e82b912e8b650955d44962fc21a4e64a027d2175088f211a5cb501681f61981
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 86afcb713a8867aa801561f0a1b49ec66695445e93e5a48ada56a9b37d3205a0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bb8daec3134878c36810c327cd074f6f93e7ed710e4e8b3cb9da9d10b52a90c3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 29a3bd87eecad815f8f67194ccf46f23226047c809e99c6f903e7b10a282e344
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 eb3444f3dbea2e9ba24f62e8715ac87fa2f75d0de4d8f1183b1528af0ba5adbd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 914f6cb504e93a34df052dbc5f299e5889a6c3088e5fd7bdc9385586c548c673
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c7c0d8769d5ce621cccfa673e373fd2f0e3ab6c9a84cd31d44fa70891f29751e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5946a2737e65d4075014fcbb1b1cd5c7b195bce862a2911bfe1a522a41e07a38
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4de7f8b3bc4001a3218b027015ac65e17d79bd4ab6435abcaf8a23a28a2349db
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ce16736436e80898f2a2e853a04e40e4e2de5c861625199463276c490114b4b7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c84a4156e4a728538536bd0b3dafca08de14abb86f631b6da5f140720525d627
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4b7288fe1db7ed10f97bbc31e014bece457d443692b14a35cf9e157effa07d3e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f7829e9a4d3627ab22f63905915fba6c25e77f6dc1fa0d81bbb691ab46d404ec
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e0186f5bd5626671283347016d7069a5d4e282f0d40023a362cc5b5b197f51b4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 12451f26b270bc343203860bf1fc9c705ad7169d9087532e8d9803dfef569495
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3f25c9f861090b3ebfb88b8b13cbb718cf1364f292a4cc7d256b562b19fb2ede
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0381f6a074c4f5d17507e1ede634ee61bce524d9957aa8bf1500406e1abbcfd7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7c46b8dbc5e921f34a458b6242d5bd1903869e6bcdb7635e57578202772713ef
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6e4e3f42785c82c23f794b7e36b9086f9a809e5561f51f46faef0dc014a240b4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 14b507e6e91d907297fa797ad15e95a19c414e0c6e7366085ff5c6700e88893a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fdde5e294d055efef50f92d038e39e7c0cc9ec86d25d037f617aad686febac15
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8cdd07c58a236bb7a6ee4fa87cbfbfaa5e7a64e67003af29570faca0e6d4f449
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b95f6f4de7594a13b4e29909b69a55619e6b2bb030c45006ffd09fe4f7798b57
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 33fbf27e682c49dc9460c91b7693744d0cc78a5ee7095aaee6f100051b0ce8a0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e110615b19e3ec6f19c727e686a8a1f84d8e1b7ad6da8db95dc6001ac4150254
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4760137b7df6886355c4be82b7eb8e0d7140036540aebc90c7eb5333ab5b39f7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d2e229af57935717f4c7d62a371aabd0765c2e86f3eb455e3dea020e78c2f481
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 868991b9867769e531a1ccbc146802a633b91b0cb60c0b8507b1d9a875a47350
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8aab587c5827b0a8cb53360ab05f72bc5c74d0e1f8a5462a01592f7cafc311d6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7f79a9f0b528c022121100680a957d0970aeec665f24efd6952094adbf4c430c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 99186fb8f2782c8c053e6b7229dc4e1f402abad60229711c8a55a6035450a0f3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2d537256b23244827377c25cef0a899a5d43dd513600a5fc5ecb292de0c5b2d9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c46caae99592ac89f7c99be4e2f89c8e565477755f0eb2c41251d689896ff199
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d36a93ae3d20471dc681ff6d5e41e5e529d47a69a897163c598bd0d637378382
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6b0ce3145c1ed4b0ac15ca8b409a138c1e0e2ea87e90696b01dc6dcb422108ac
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a0495565f79240fb665fd1807bc5f50781265dfba6271390169843d800e86df7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 082627eed9fcf03e22ed341494595f97b9313b350a89aa493d4e746f7070620d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e0da11ce91322f0d0352c3cf43f7cdbe74f19c82fbaf00e6a03f57e3211d055f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1182626a5951b66d42797ef82587a679af13fefa51f9f421f9067e9fd7b5246a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b67bb2393aeb26c6afd33e4be4e69ee5f656bcb41eb2feafb83b583abd091eaa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cd83b6472e799da31fcdaa4e9a260c2697c3434ed1e3b2bf96a20474b406eb37
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8debc8c947cbc725d1420793ee8dd65c26dc825ef93efce5b33e39953b114b3b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e52f2bff43b8402e0e55afa5165866e04a5d978d80c337c0ce57c724f91bc27c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0d08f28b22a3f311260a7d71a0e822ce2dc67967707c2e554c1493c3d16b6df0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9b77f86fad009e245064a901823c677e7629ed236a0e567317316c77974534b0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 40e7b3370b1bd3735b39a58a4fccff7be1258e6f811e329c2d67ec71d40e7e37
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3a298d7e9a7cfdc3f804da782d56be97276a66b7e7590bc0c89568e3500e5b83
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f8accb3dd1c49d1932b9dda9ff7ae30acadcf4d0e9bf9609fed1b1b06d27f09e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 302a3ba6dd73904302ff89eec04a53a5330bff1e0869266e1e585a80349f450b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8e2cf77e8ebfb74e0f463cd49763ff44ebbea547662b661a21edfa58f502dbdc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2b8493d19bc88ab2daeb7e27947247501ffbcd6ce843eb7b2e5728ebc83e7efd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6ca8549313d6c4228ad5e4263bbcabc0139f1ee6a9e3c644bd06328e339f2097
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1d7b7661852bce62ef7a63b1be835cc0485dd11181f0dea4a0bf0d7bea43ad38
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1a080edd1e2e28018b2357a2a469c317db7accc10475efe750fba3d09a7fa9ba
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 906eeb181577751df9f24bed7fd224563210123c0d463635971290ec85e19c92
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 34ad89825f717b45a36d9759f66bd6d8793d0edc801aa8fec1cfef7de6a65fbd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bf43daabe863c1d11b714980a6bfe520224f7cfc7b145637244e959f0d8f33c2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 39e6cc2175aeea0b31978d0f19bbd371d2b042bd7091bd72c46f2d21c3d27ddd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b4a562b6f7042d5fe2b7208e3d3f5d00aa2452e42de057a4c5b269cc82552caf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6940f069456371d334708d3ee7c66007f42d962039308aff90c1944aa048fefb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 128e13eee14fecbcc0939dafcab887de82e5e90938f77d364db6fba0f79210ef
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 78a1ca3d7a8948cb9d5fac6c2c905940dea29c8cf2e0b89727f8fa2004c26944
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 196137a6695d9f1a69c3e8dc99f603cfd436b2624a036fe5b363f4238d1e3d44
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1058f14822e06918444785fc7daa79e857d828b0021ad7de5554223c9879d446
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 78a30a8579eaf43f55e4a2d4f0fdd1ad53ef80d2b168faf0fde669fe8a8815e0
          • MD5 SHA1 SHA512

          aut72A0.tmp

          • Path C:\Users\Admin\AppData\Local\Temp\aut72A0.tmp
          • Size 276KB
          • SHA256 fa25683b8ea446cb37c42e4cf588f7e25a050e49723168edf5e825948b9f1698
          • MD5 SHA1 SHA512 SSDEEP

          logs.dat

          • Path C:\Users\Admin\AppData\Roaming\logs.dat
          • Size 15B
          • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
          • MD5 SHA1 SHA512

          memory/1940-78-0x0000000003CB0000-0x0000000003CB1000-memory.dmp

          memory/1940-79-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/1940-80-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/1940-111-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/1940-34-0x0000000000400000-0x000000000045B000-memory.dmp

          memory/1940-17-0x00000000005C0000-0x00000000005C1000-memory.dmp

          memory/1940-16-0x00000000001E0000-0x00000000001E1000-memory.dmp

          memory/2600-31-0x0000000000400000-0x000000000045B000-memory.dmp

          memory/2600-82-0x0000000000400000-0x000000000045B000-memory.dmp

          memory/2600-75-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/2600-15-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/2600-11-0x0000000000400000-0x000000000045B000-memory.dmp

          memory/3424-12-0x0000000000400000-0x00000000004C2000-memory.dmp

          memory/3424-0-0x0000000000400000-0x00000000004C2000-memory.dmp

          memory/3868-107-0x0000000000400000-0x000000000045B000-memory.dmp