Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2024, 15:18

General

  • Target
    eddf2254f34e2fce6a0c7547c6ad6764_JaffaCakes118.exe
  • Size 721KB
  • Sample240920-spzgtstdpq
  • SHA256 c6cf0f3dd2ffeaf63b038556d5bced468ff704755a874fec6d6f077c915cdb7e
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3476
      • C:\Users\Admin\AppData\Local\Temp\eddf2254f34e2fce6a0c7547c6ad6764_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\eddf2254f34e2fce6a0c7547c6ad6764_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3676
        • C:\Users\Admin\AppData\Roaming\iEpicTrainer.exe
          "C:\Users\Admin\AppData\Roaming\iEpicTrainer.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2588
        • C:\Users\Admin\AppData\Roaming\explorer.exe
          "C:\Users\Admin\AppData\Roaming\explorer.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4956
          • C:\Users\Admin\AppData\Roaming\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4888
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:3984
            • C:\Users\Admin\AppData\Roaming\explorer.exe
              "C:\Users\Admin\AppData\Roaming\explorer.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:1456
              • C:\Windows\SysWOW64\install\Svchost.exe
                "C:\Windows\system32\install\Svchost.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1600
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 560
                  6⤵
                  • Program crash
                  PID:4960
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1600 -ip 1600
        1⤵
          PID:2460

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 8d069e02d31d8a76e81f7bc5d95d732976abe93f386218cf423d76a56fe70c56
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 222KB
              • SHA256 9be4867453afc4c32279586ad5ce16a87873a79853fb130fd812506cff26598a
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0412e27b2f00d427da6d967acdb53b6c369c0af12bf05f042cab4f2193ee1c49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 084e980f72c589e203a1879039ab4cf70c9c42c86000a0d73263e6a347cb04d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 772e60bac1d75e23427cca8d9828bd351b8fea636067180e7308676ccba049de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c81d685ec53b5de414bd74508cfcaeb8b071f823465ecfb7b9daa62cf7155666
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be76e9688b0afcd59ff9529369a930829b218a87d861b041bd58476f52f99906
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6af55d4f4ab82470a047a64de7c205d329ee88771c64b3bd4162e6c15d3febfb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27ba0b6e3956834200b030692b0c435a9f5890faacfe7fe0c30360662aaa89a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 caee7ac9e39242010a9bd29607b10856de00644841b3ef93804ba3b9178c79c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ac26e023ab9418269dfd99b647ad5a30a999a05eda101fc7bebdc3dc81bf57db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb93672a4b9a5c7f84ab59eeebb2a2ac275af2768b0cd18e87a46cecab7b8bbb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c6c0770f8803a81976d3b54e7e163f212cdb3c008b98ec7e4418d0493ddee183
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9cfe19e0b5bea45d271e990db19c5915cdf7abe5d9903d660f7850e947a53685
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d38948fda83fc3c4eb434900520ee5e0441fc328e1b83c547dad0b94b4b63635
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58f0d3b5afc77e70158ab6f28bbd40fc00168c426c969d2bc9d56313be56ebf5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b01ccfc7e8740d9c9779afcfe33fc62c931693ae210e4f218d814508caff569e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d8fd08c62d46994fd6a74072b3af5813871a1df532ee1c9f4d89f08b14c47d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28f4dffd11c3f5fdd4c1b22210adb4203076c905114dff5664187a2b3cb00709
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7db5455c1aa8793fcc6496b5d38f445c3e8b8e037dc1ddc75f28cd042098fe7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60d8822b154979e4ced52ba33e4e0a2f838c15c8b9340e3fdc5ab9009d300429
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 524fd9b2c2495ffb9593d81206791ae3b1a58974f76787c1db4dc33dfb87a90c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8202bea95c0cb867d71d2b53ac9cc90ddcd3788ab40593bef37c7e6abcc84e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e710338d627fca996e2cd7b4ab96163aa05d413eba4f0693da7ee14f0fb451d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35a6a98426b7dd4355edef68018dc6fd5b3ee73686845ccdf9f5a5899f7cd110
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 221ecaa159ca98fae31756a7bcd305599eb8951a3b92905d9e2ec023a898dc81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd5f99b77480d635d54008574727da18726e90aada99ace5e694f7dba0d60c9b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 62f21d9a4eba416a861b031bcc79dd38109c6a29e1e1f3ce5ea1e1701c268765
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4b6c2c1c9f964472d6e0e1d54788eb558f9264c6e86b92ce840c8a644790cdc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87e8cd990b04a10444303ccbb249ff352f53e6b6e3adf06e55c2f87d832a6574
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2ae7c3bf4910e8d9b52051932f247396882a8ee0daf737be3cd0a98ed43be3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e76821a61a3216fb3b21ef595e53225482350e836961724af42187ac9677e0fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 314c509e07b32c17091bda7324acbfe0b7ace320d2a6ffd43414013ae33fb93c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 23aa11cb8131e77a86dfef1056c9e1441b766ea64ab7345a79ad108483fea078
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e27fc79a7f383663722cab29e9a1ac726322d48854699911b44e73519c62952
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fbf2794691dc20fe21724b702c4508169e128d1a99f901444ed3361236fbd169
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 289c4ae5d4a850dd9c2261326cbcc96fda9d1c2555c6624ac1cbf4d61e421929
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0462c0d1828f132b60cc9670502e2361b8ab3d10aebcaccc316e431ba01bb098
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 06ba86e7ec8849c30d1b0ca6471aac27c1f87f8a15f82e85b5a2175cbbe70066
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f8e42a6f2c1f805d6c24a4e63c193a451970952d2f051cf9e8bcdf7167cc8d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 879bd1ebf7491aa0bd1b80340fdbd99ee6994993a913ad01aa1c5bf3931a145d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a41c278a96b88c21e97c918e5a4f1e1595cb66311028f3ef551ebcff32dfc8b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a713a16cd6323c496e1a120650711f7fcc8e8a8d227cc7593df5b597ce369520
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d48663de1027dee3fc3a588b3ebadf65116b9fdb63c2722e18c725b411968dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7b42d6a4fc2438a10fbe65e7c1ba9796aca049618c6c8bb7706dd5908d08437
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77347932da25d022d4d4dc24f373c6f66793abdd920b2329132395eff4fa04b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14ee44354555fded30d2eebc42de1f963ddb789e9155294713f9d6a60187476a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d56be15da3684b957642d67ce38e48004917cf287d1d7a074495555e8199d487
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec735199e3871bb9aa9a119ccc79e2344dacf14d8e149b75c41beaba90b4823c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7297c1b93725c0cca1f42fe510927e976464a01c9e5d72ebcd8ef654364bd36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5f8f977c874a9f7f4d0215a7fb673aab7a9848074b7c2e4ec53ec5262966b1b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b283a75ce06da3aa77001fda1336e5933b1acdc8e75a932a5319ab2c4b977557
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82565d8ec1dbace2b373e5241d80c3ca05c07de83d4b4362d3edddc0574fae96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 200f51f69e1751ee40baa171bc10ff73854a7ff14fe409a5a1268e893db669a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a878b376d694f1b454244cf8ed6fc5b4cd2ee4d29c9d256efe47a347ca8902bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e11cf5e8f685d054103c5dc82e86076f0007a6584969ce1d0d11ce3218111142
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b30a0fa096c5c8c5eedd699944e2f57c5b6bb90923c7e544d00b9fb5a97f1a2d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 876fb459530d518030afe50d5020d22a40b481e3dd388997e7b2d2e6166b4adb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dad46c746fe8d1fe96af38e8627cfe136c1d05400ce0ac1926e0304473937949
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 19474634d15701df992620a4069ad4e1719b04a06f016fb21d383f6e09395369
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a01ddf58ca7d89ae46372f5196d94d7e47b3f45626d91b8018a0a1dcb1b08f07
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 171392378ed5d208b59d18e1ebc4940c15e3e780363d8a70eb821a8ab5f38461
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb4e5f0a3a10f74807e4d62fbf2442718c79cb8513a6953677c6e62ff2f5bf93
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3246633b7539e831121c61f90d8fc7982210e6ed97952152ef75c165ec05b516
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a28e83fb6186c5d002cdd957f69e05a08b1ff9bd7c835824795cdd08b01e6e1d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 313fac7a9aa4f9b3a4710fcfdf44e3453ba044119606de165ab4ad086943214d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6778c37ff4d623fef1063c5a48c2f931fd0568399898cf23f0a1216abd494da1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cb13959c84bec321b6e32e7c499c6b6367fda40e9e4bf6faa9b8aa99b9b7f64f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a8b3d70783d8b0651b9a57e7f685bebcb0d491e203f107c707252bc042b0ce0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 222c49cd31870a495ae9f0024147466f12cb45de944c4fa3d78776eeb2122942
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c46a0801545937f530a18cfd00e4b2e26ca7874846bdb2a1779cf3c3ebc5e76c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b776fefe9f2f35053317fef749746acddc7191a227d4946b6acef99a303692c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d93fbff868679019e2a04eb32917e0d095687b1395efff199f5f0fe47abae833
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0ccc8de6601dcd49a04f04cd5aea7aa9fb2c39a6a2860d79b08640b43220279
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 19b6f222733fc9d5e714b0c18edbe58cad5bf9996bbd08f6d23f522fa1700c96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 182aceba3174ee59afd49e70b8cde6112b97bcd8be6e03bed3f40c6980d5b63c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54da7642a5d971bb53e99c6bd3de7850cc26a3e714b0ff013cbd0071f0f6c364
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cf4b097f288afdbad2b31d1c27b77a3524b2bf03608d7feb7adcaf60db14a14
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f69dc64d1ddf56237e505461dc5c25617ee7478f79b2b083f58a4eddc7e2b4a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2fc43e4b2d3b183f9e37b466ead3b54ef8835fe598a5524b1f717a77a575ce61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38a47e1e4dc662750deb6065ea5c9046ea537130f25b1eddb678668a50db2521
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 692710faac3bab6985a936ba3cd3dcd2e7706e746cc3193b8adf0e5ee6d2b861
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e23be8e370f9c404ccbee4f44084cafa8fac959ab173c9fb9d9758a2b3a50301
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ac4170d789465549615d0095d4848ecf304cb7ae2c7ed1eaf129e787716ef354
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77b595242418924945299605db13186d0f07354cabda1220e1ed8a246809a565
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 657d800fd35a22d0768015f69f91987d170cd64d999b6f1bdddef8ddfeb445b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b23d4616b87639c826b57725190ab263189fcd42fe22647cfb1072a79b72705
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be23f056cfaca3f333f19ea3459efb6168226e98887ceaae3781f0d740aa5238
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3d4dc578d5ee046f089483bd3bae2460465f15fd155f105a3cefbd0da53ab772
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 37215c591fc792fb82c1ee4baa36e645c1e6bf9c1480686d6640ff66239408f4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b6c258f157353abb120504620025c64d6e404b397aca6188708dd8979b393c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 76d60ce7ab264bbca9dfa5793f266757fbac61f3a2d2c32218e4defdbb53ff13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1500ebdea1f984d893b8a7127515c18c0f0082ec838ef20010248f8feea2aa82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4c73dca30ed3560496b1267a46e59c51dc709c020c157ddb5df006dd8a99b28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1e8fecb7e3133659543a4142c9f879ab8c55317639d8abee2a19d3af5c499e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2409a0e825cc4db9bf3837db06a327dc79d17eb5161aba3ce3f4701c3ca3e630
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 254aa0b66a809f4016f5812e873e54d6c4a40de22db8d4c37f3d246b98185ca6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 efa658423dde58f3a09d46ea23cc9a4dc22f2f51e787277cba0ac70da5b466a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 771310d1a07609c20029ebcd9715ad987ab772f3f8424612acbdc8e8a58377c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c77bfb9e368b46806cfd01fdbe14a371fe52e9935eeae58deec17f277e3ecc93
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b303c0c78ef87396987a7aec70e722313e7be17a10c925f815041df41a41524
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0a93d4d6de61d9725f7db611e4009bcfa7873f5a2c073c6d02d888e167c5ac0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d683f1b90888d204fa05c2eab354253aafd67f86e1ee156b56c4a0ebd80b6f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a8a5d81ba8ad3682f14c7da0251742b0bebd355638981898107948258bf8824
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a00b70ddb5f1c02c1e1f8110fc8d35d8f7a6121ffe83bae57061402c2cda5d59
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3008927ff7257bf813a0dac6f3cc86e1768049b8d76a0457da6e9a45c0099694
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e45b1291e42b1f424c5662216001d1d0c62cc91a4f180ba1e36562b0d34916c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d660ac75272b2f8fd6820faf136aa4e189f91f04c6fa2ddb16ccb4fc293a645a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5952f5f53ffe027cfadd859355a3dc1c49d12137ccbdf7f441a2c3f17849f61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66d3ed45efcf46a63e3f74fa6119a1bc76ba86df00e10c36da4ea11e108f6c7d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f499d2b5cd8f5ea67c20835ff89158c3f3f9d6309e6feb3f41f8bab79fb79de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e39bf5b7f4d05f0746299997d7bbb69b40cc23c9ff66887f69ddf9d3725eb895
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e69e9689e331434253e4e962f1d4d44dee1744e6fcafc7e5d87e0e3140c74bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f0898d3bbfb4602d7a02bac812fc4c8b97935530b0ff680474243fbfbdd58ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0d5ae3ceac785cd591db012b7f02e36d127705215e85ba6d094c55684fc6b71
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef1ab0eee570bed83128f40268df8de40458a6d7045d094e7a921c72e449fd48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 908c1f6c936813381e955dc36148709bb8f0a8a01bec0466c408813179c7e186
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 059aa2eff915c596e17b35618442cc658aa8568101c99d044cf66529fb833e18
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ea040a05e0eeb03e78220b052438fb651509a545adff5acd56157fbdce4df0b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57b42c473a24d790829e1055c889e5ca08206cc21ffff16f801ae2f84ec130f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d35ac3b55ff99e7147b5b33ae351fb15fbb78b6f9b5fdee34671205e2069a66
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f18390478c2839119450ab29bf181106f212265f31e664bdcf79ddb7306258af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9414da4ed2b93d24c547b3dc359e5f661cfa086aa31b57f1426196ad982fa16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5318c3cb1b915499827572ee902e18cff950af4dd902b7e61eee9e6627296aec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e678e46dc6a6d7fa679c72da07234beb97783832c2a1d091efec04e8869c7028
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 49e998f94c6c3fdf8c845c77f181449695ba522d0c25483b5d5fd70fc1faa5d2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee9b209ff19c22a50a8627e868db05b7b81e6dd1d7e5e6e8bb8e8b1aec27169c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08e677d3dd115fc6bef4ccbf48a5ddf52d188c6038933d070b52cae03cd456b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf4aa87b14380ba9ae78ebc097db00cc71775c64a2a1c12e9479d3f2ceec9adc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea8c8c4395b3e09cebc990bc875545901b361f152f7e2b60035ea4b59331e224
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b5afc4f9410493def0fd1b29bbb76f7dad59412fb7e3d7745ec315b9545deb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf9b046be84604481bad7df9fb9920a22c677138baba12804d218df7145beaab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82c5b10fc7724afb45e1bfc6a757aaa977a9d2cedf24f33f41e01c24c2cabbf1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f83693a4f8824f79e12d5e214faecc8e5c40ac4a61d94518cb1036cf54649ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a881fd59a3deecef4a3fc8c11565cc1dc752ac454aec9b63b62bb0f415182119
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 862a298bb6a4fd9c0d48b5e097cc5e35d21fee85422c8a02d0fd17a345711b87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4be5fa75ab457e8ae736d15b6b2524519ff4c1dbbb9e740bc86711ce4196ec21
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75fdbf0904ac08bbcd146310910983e9695153bae2c1f43c535411c6a09385d8
              • MD5 SHA1 SHA512

              cglogs.dat

              • Path C:\Users\Admin\AppData\Roaming\cglogs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              explorer.exe

              • Path C:\Users\Admin\AppData\Roaming\explorer.exe
              • Size 283KB
              • SHA256 677df7c4bc795f7427207965997fc6b9198415985d58db4de24b8019f1f48901
              • MD5 SHA1 SHA512 SSDEEP

              iEpicTrainer.exe

              • Path C:\Users\Admin\AppData\Roaming\iEpicTrainer.exe
              • Size 54KB
              • SHA256 7900f45a9321c85a8b0f077eff9e26938470dc7dc345645c6d3b418d88917190
              • MD5 SHA1 SHA512 SSDEEP

              memory/2588-26-0x00007FFCD1AA0000-0x00007FFCD2441000-memory.dmp

              memory/2588-27-0x00007FFCD1AA0000-0x00007FFCD2441000-memory.dmp

              memory/2588-201-0x00007FFCD1AA0000-0x00007FFCD2441000-memory.dmp

              memory/2588-25-0x00007FFCD1AA0000-0x00007FFCD2441000-memory.dmp

              memory/2588-24-0x00007FFCD1AA0000-0x00007FFCD2441000-memory.dmp

              memory/2588-23-0x00007FFCD1AA0000-0x00007FFCD2441000-memory.dmp

              memory/3676-13-0x000000001D650000-0x000000001D6B2000-memory.dmp

              memory/3676-3-0x000000001B7F0000-0x000000001BCBE000-memory.dmp

              memory/3676-7-0x000000001BF60000-0x000000001BFAC000-memory.dmp

              memory/3676-200-0x00007FFCD1AA0000-0x00007FFCD2441000-memory.dmp

              memory/3676-198-0x00007FFCD1AA0000-0x00007FFCD2441000-memory.dmp

              memory/3676-36-0x00007FFCD1AA0000-0x00007FFCD2441000-memory.dmp

              memory/3676-5-0x00007FFCD1AA0000-0x00007FFCD2441000-memory.dmp

              memory/3676-6-0x0000000000DC0000-0x0000000000DC8000-memory.dmp

              memory/3676-4-0x000000001BE00000-0x000000001BE9C000-memory.dmp

              memory/3676-8-0x00007FFCD1AA0000-0x00007FFCD2441000-memory.dmp

              memory/3676-2-0x00007FFCD1AA0000-0x00007FFCD2441000-memory.dmp

              memory/3676-1-0x000000001B270000-0x000000001B316000-memory.dmp

              memory/3676-205-0x00007FFCD1AA0000-0x00007FFCD2441000-memory.dmp

              memory/3676-0-0x00007FFCD1D55000-0x00007FFCD1D56000-memory.dmp

              memory/3676-37-0x00007FFCD1D55000-0x00007FFCD1D56000-memory.dmp

              memory/4888-45-0x00000000001E0000-0x00000000001E1000-memory.dmp

              memory/4888-46-0x00000000005B0000-0x00000000005B1000-memory.dmp

              memory/4956-44-0x0000000010480000-0x00000000104E1000-memory.dmp

              memory/4956-40-0x0000000010410000-0x0000000010471000-memory.dmp

              memory/4956-102-0x0000000010480000-0x00000000104E1000-memory.dmp