cybergate | a9ead492e4535d03a8dd87eccaaa745f4004bf87092d4e271404f08ca821e45e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 03:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
Size 681KB
Sample240407-dwxt9abg4s
SHA256 a9ead492e4535d03a8dd87eccaaa745f4004bf87092d4e271404f08ca821e45e
MD5 e3f0a052efaf3a5539e76a46ef987f4d
SHA1 1fdb523f28097084cf22da8a8c003970ebcd1605
SHA512 f2ff30aa3640036106717f9d3ba3db0118d003ac27c7661775c2bfce5b11db7f0b77b16d3ac9e401ba5a3e5752e5b90894bfd7b6c5a3e974787f446ae17cb3cc
SSDEEP 12288:cH+RCFVeDtKPhbDv930+ROHlZF7kOubhMsjuIEHkifR2DFP+vPCsy53bKQa5fEf8:GPRD93XRs7gdhfSIMp2JPyCsLQkEfq6S
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate vítima persistence stealer trojan

Malware Config

Extracted

Family

cybergate

Version

2.7 Final

Botnet

vítima

osamax55.no-ip.info:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
password
abcd1234

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe"	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe"	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{65R2103D-8CIL-LGYY-FI5Q-H3HPDY542G1S}	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{65R2103D-8CIL-LGYY-FI5Q-H3HPDY542G1S}\StubPath = "C:\\Windows\\install\\server.exe Restart"	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{65R2103D-8CIL-LGYY-FI5Q-H3HPDY542G1S}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{65R2103D-8CIL-LGYY-FI5Q-H3HPDY542G1S}\StubPath = "C:\\Windows\\install\\server.exe"	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
6488	server.exe

Molebox Virtualization software 1 IoCs

Detects file using Molebox Virtualization software.

resource	yara_rule
behavioral2/files/0x000b00000002312d-694.dat	molebox

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\install\server.exe	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
File opened for modification	C:\Windows\install\server.exe	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
6488	server.exe
6488	server.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
Token: SeDebugPrivilege	5524	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57
PID 4144 wrote to memory of 3448	4144	e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe	57

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:764
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:64

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:660

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2892
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3752
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3844
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3908
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3996
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3460
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4332
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:1908
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:3728
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2156
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:4236
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4448
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2972
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:4268
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:6200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1124
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1392
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1964

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2516

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3360

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3448
- C:\Users\Admin\AppData\Local\Temp\e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Modifies Installed Components in the registry
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe
    3⤵
    - Modifies Installed Components in the registry
    PID:912
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:5488
- - C:\Users\Admin\AppData\Local\Temp\e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e3f0a052efaf3a5539e76a46ef987f4d_JaffaCakes118.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:5524
  - - C:\Windows\install\server.exe
      "C:\Windows\install\server.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:6488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2180

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:2020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4016

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 9e653be6e7e2a9d30d29dfc13ea37cb8 MuKPY7uw2Ei5/CTQyRCw8Q.0.1.0.0.0
1⤵
PID:3404
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:4100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:5096

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:6936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XX--XX--XX.txt

Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Size 604KB
SHA256 91c9a615094b304645a7081404c3bee151bdfd474855a23d169f7dfbcc703c9e
MD5 e93fc10ea17465b14e29c315c32ca670
SHA1 cea3af296b787f2179fefa35df52a68804bc5527
SHA512 528544f21bf1fdaba328fb771439f19352cdd68802585a269ec896e01a5f82ef0c1e68a03378a1a0c5e3dffdcdc4ecb4191ad0ede2fa88495ffe633b18d277a1
SSDEEP 12288:iQ4dLOSwCDfJqlE6uGiGSAlVLuBRzXA2oAMHVB66EYAUTS9D/ksSzQRD:OLtwCc26uGi2VCHXSBzTaDMsAQRD
MD5 SHA1 SHA512 SSDEEP

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 26c8c172bb39f07e240d01c00ff954545d990fbf3ba3025b87c6ce1c8fbad79b
MD5 e7d8044a4ae7cabb4838f2b3c385dcf2
SHA1 fddd898c65bc94c95754167f91e09c629356d446
SHA512 983877095b891ed6c71dde79896c1bb22f57aa2c88e0c6f25aeb82ca8413d36085df60002234e2f1ce6962db8e5b8b7313eca2e59352d62f8556cde04459df82
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 2a6ac7ff6593db5ddc68654159c924951d01c3784840159be74240f836376863
MD5 69af995d371189710bb9111a0abc204c
SHA1 5bba2050c14c176e18e2eb9ed62fa82963e09177
SHA512 607e0b99ce3cfc8fb6551717d16a035846e3c7daa5291d01926b511f27c3946126711935db0020e8a5b2be8e6658a6cc9221d80e21253ef23a1896324c5c11a2
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 7010faf47bf8fe6a3f76086dca3ba6a9ab17bdf9f0a7408b24eb0d718d80828a
MD5 1d6fe72c4fb81aed012f67dceb580557
SHA1 da50e40e3a09ed1dfc244824abad76505fa61b94
SHA512 d776950e52c011f212368ecff9fbd29c69cdd6be943d8ba86bf95776477812d704fe410ce0cebe747d9f2b0cf8804c109c6831c25857b5ae17acf849f95519e3
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 1c9a8e17e1d22d19f21a7ab0922a29d202251b29d0db0548644404f47427e1df
MD5 603ced98d1a609e19345a1aa2b61b13c
SHA1 2130a49660e48b1a09dcf76fee9f55bf303900b8
SHA512 3fcbe78c911db330cd074c3c2dfc8a2aa053dbce48ec89690fe51b50874c239326d7cbf68e7b4a68e5d06a9222c649032732f514d388b890c6d13ce4f54c1b7f
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 707ab3f1286ae65ca1dd398f03a7473362763496e402fc9e5a76a3f67420f09c
MD5 90b2f376755c55ee2159c8078639794a
SHA1 01a4944bfd0984645ed5ed62d018d8bc82aaa8f7
SHA512 caad22a7efa209b70d20389382b9a07a021614e3928e26a0144aefc2cc6ab03d5131d5f8f8b46b4f9cc8b054fde61b1b81acc8493697bc5d92bf9faab65b0760
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 072a61186bf75a98ffce85eb564299585e7ffca037b5f4d88450329431e05fc9
MD5 85744f6de424f6658d111241478b9247
SHA1 32d600da3495e1c7f0b660064289d3fe1ebb2cbb
SHA512 48554fbcf942a035ee0fecb15eb1c7320098051ca16cb48a05c726f19f874da5050ed1bfb5290749d3e0b5f49eccfce1b51e41a2f3b0d94c818e7c159f590a22
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 4345c2daa7df1e84339142231e1ed01f2df48a01dff46f9fcae6a002f6a5490b
MD5 b517478e69f9861c898362d0e5da043a
SHA1 510c0fe2026bc341df7c14080d22fb99152e06fe
SHA512 3294635e4b5e6e261b0d49775ba08c66619b72d37f576d49833288f6d9f025344a5e44c4c646d6edd4755fd678f64d2b83435577e5a80fd43ebedbe0146cb08e
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 6386eab3ad76d62e5d4526ef732a86a3f13502f83858133a0a62d27b3ee228e7
MD5 2734351ed5dcc3ccc62539f00e298685
SHA1 ba488f20552d3c22a0effaa1992527c5abbbff84
SHA512 25894eeeab9b297a6c4c66a08fdeb62daf6447146823d872006a2a67f1ff0f4d109f532806825cd463ef9afaa76db83cb1502cff183893a40ea78f769ed6c115
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 61e38e9c85cd9ee9963886ab24c4f9a07d806c74a051c772e98d126adf891463
MD5 d6466cc79e3faa31c4c3c896c5ebf486
SHA1 6c28958e6b5e353f44bc375420b8402554f8ed8f
SHA512 e108c90de4320e14a403b327a8670e3506145e83fb07c52e03b6580945829834b7c016fdca3d2e8f9b0d2b15ed5f4eb28f87696e10663c6080aa7e808708f639
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 8e8b140f6cee64cea764f1d4954573a7f2f6d36be8ce285d0d3f70de4aa7df4d
MD5 506ce3977fd126ec88a679460775ef0c
SHA1 cbfbebab2659eea2adad36b9ba5b78b25738b159
SHA512 5b96605ecbba24ac8bdc28ef518916d4db2102acc44e4f85148bccd391fd656866aae1f2dcce804142f98520c77ce4b0968e8b3e292ed7fdaffc7a0908192e02
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 c2e3a1cceab47e11064ae34d400436479f3667ad0651fc4a57b4cd5669995cc0
MD5 6c4582011b0e3f016f3dbe5c25f6cf8a
SHA1 e7e959a2496dbf2e73776fe04fc056ed77675aea
SHA512 1b06ebfbce9fb25eb31821d0061dc7c901c03baa7e1647e80a0655067c9c63b64198c24c1aa492df61c7a4b4634eeb53563197dcb883236be2a7dc805b5b35b9
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 7a03c17056fee8479000c1c7b0904ba1b79ece421f09bff4301b6e8b530af801
MD5 820413ef61e4a6dacd4f50f05152e54f
SHA1 b23232d8c58a9308ec8ac47c075b98cff4f2c85d
SHA512 e16ed142c90a6a083a567f03f3daed6c6f8f63d77c8507a6bdf9de0829571c342240308914639d8659078dcf62e71159cb591e023c6ed94f6b1ae6f1d8ddc809
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 677248a5ae61ebf31ec7ff256617ff83cc21a89cf1b0d9c59539f0421cd29a8b
MD5 4b581dad20776f5b3724ee7298fcb271
SHA1 0e0bdedc6138ba47eadad0fcf0341b478f0e5761
SHA512 1ee35701ce141c8295ff8e980aacfe49b09fb31adcaf0b3b90f390f69d646e8b01ac7d64713de1044ffabb16c7ae158e1499b8d5bed89714802bc7071be3ebfd
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 4418d59dc4645323d90edaa0f6afbc0d208a860051c19288fd451e703f4b8f92
MD5 3df7f0060b28cf38e62c9e8e4c65c3b3
SHA1 89e4f2870f8cbd712f2b0f0745d95a0cfc37767b
SHA512 b1d0bd0296e3502c8be1959ffd966cdd1450c46922dce0f775102bd92e1cc4e23ef9daadc503c51c210a91e8741c08f2fd289540c6346069d163d5a1c486b4ac
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 47470058a5a0242c9b71ea0c7398c9123de2dbba5c105c59bc7d47381ae04bc7
MD5 e8f75031ea0e252885a63c56a119445e
SHA1 1a48b3bcb7c4333fb8f5f117eed0993681139770
SHA512 7650803315982947bd58ceac42959d9761ed9954e78be287c0fd088c5d6e1d1d950b80ac3a51aa50bb5f2bd40d2b848c3e6916fdb614e1957ebe356b34bb3e29
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 d44d6bdded9771b18c5329ad64a6be644cee191d400fc628f5272806ff2a74ad
MD5 2f5b52c5bd32752dc7ea459f6fafa0de
SHA1 87596284073e573e203cf63dfd256f037920fc7f
SHA512 76e3457112659bc115c9e53a41d7f6a9dd47fb0461b85fa13d66aa211a95153184d9463264a91ab95fd6bfdd79809b1770e5ba280891d4e1afda1af663620fb0
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 f6e119a0b9875067ae2dff724c6b955979197f2a0a97a049c9b985006969b09c
MD5 f297dbf1fd80accfed73c16f7897fac4
SHA1 65bd8b21dd335709cc35e5e529fa873c8c0d8561
SHA512 e9305ccfb302499a945749fe16fab4b5e15e4c4e86ef58b2955ed1347d870fd8dc0449297d818149d5632c40ff09ce78751b9813bb6348e86c3110f8dd716505
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 9e530c822b5eebdfdc8dddea7c82e1203ea2082a9026282d19834f97a30e7871
MD5 fca440677c3fdf2b123bc107c995eaf0
SHA1 d6266c3d01fcca045325b997b0056804259338f1
SHA512 a3c1c953874445439af7890c92b61f608652ca5071dee9fce95945eb23cc587974df929f0841bc0aaca09e82b9616762747609518b5d67a50267d25eb8dd0a87
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 39d194bc5f09a69ff998a93e70ee1ea951c9d25cdac48dbccc425b626205c4b0
MD5 3729874b6f0b5dfb9a2797330432ad96
SHA1 5bc8ae13811697080b7e14663442686639148570
SHA512 3a601c72ac7622007e5c4b59a16a8bc5aa1e2e6e4b0ba7295cf61a2eb5d31ea201479dd7009caa49ac998f367f09732716bd4f31e5bd9cf1f70c5f5f289e769b
MD5 SHA1 SHA512

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\logs.dat
Size 15B
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314
MD5 SHA1 SHA512

Submit Download

server.exe

Path C:\Windows\install\server.exe
Size 681KB
SHA256 a9ead492e4535d03a8dd87eccaaa745f4004bf87092d4e271404f08ca821e45e
MD5 e3f0a052efaf3a5539e76a46ef987f4d
SHA1 1fdb523f28097084cf22da8a8c003970ebcd1605
SHA512 f2ff30aa3640036106717f9d3ba3db0118d003ac27c7661775c2bfce5b11db7f0b77b16d3ac9e401ba5a3e5752e5b90894bfd7b6c5a3e974787f446ae17cb3cc
SSDEEP 12288:cH+RCFVeDtKPhbDv930+ROHlZF7kOubhMsjuIEHkifR2DFP+vPCsy53bKQa5fEf8:GPRD93XRs7gdhfSIMp2JPyCsLQkEfq6S
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/912-692-0x0000000010470000-0x00000000104CC000-memory.dmp

Download

memory/912-3349-0x0000000031C40000-0x0000000031C49000-memory.dmp

Download

memory/912-22-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/912-21-0x0000000000E80000-0x0000000000E81000-memory.dmp

Download

memory/912-2163-0x0000000010470000-0x00000000104CC000-memory.dmp

Download

memory/912-2047-0x0000000031C40000-0x0000000031C49000-memory.dmp

Download

memory/4144-2-0x0000000002450000-0x0000000002460000-memory.dmp

Download

memory/4144-1384-0x0000000075B80000-0x0000000075C70000-memory.dmp

Download

memory/4144-691-0x0000000075B80000-0x0000000075C70000-memory.dmp

Download

memory/4144-4-0x00000000772A2000-0x00000000772A3000-memory.dmp

Download

memory/4144-3-0x00000000024A0000-0x00000000024B0000-memory.dmp

Download

memory/4144-5-0x0000000002390000-0x00000000023A0000-memory.dmp

Download

memory/4144-716-0x00000000024A0000-0x00000000024B0000-memory.dmp

Download

memory/4144-6-0x0000000002450000-0x0000000002460000-memory.dmp

Download

memory/4144-712-0x0000000002450000-0x0000000002460000-memory.dmp

Download

memory/4144-7-0x0000000075B80000-0x0000000075C70000-memory.dmp

Download

memory/4144-8-0x0000000000400000-0x00000000004BB000-memory.dmp

Download

memory/4144-1-0x0000000002270000-0x00000000022C2000-memory.dmp

Download

memory/4144-9-0x0000000000400000-0x00000000004BB000-memory.dmp

Download

memory/4144-13-0x0000000010410000-0x000000001046C000-memory.dmp

Download

memory/4144-1382-0x0000000000400000-0x00000000004BB000-memory.dmp

Download

memory/4144-19-0x0000000002390000-0x00000000023A0000-memory.dmp

Download

memory/4144-1379-0x0000000002270000-0x00000000022C2000-memory.dmp

Download

memory/4144-0-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/4144-689-0x0000000002270000-0x00000000022C2000-memory.dmp

Download

memory/4144-690-0x0000000002450000-0x0000000002460000-memory.dmp

Download

memory/4144-711-0x0000000002390000-0x00000000023A0000-memory.dmp

Download

memory/4144-709-0x00000000024A0000-0x00000000024B0000-memory.dmp

Download

memory/5524-1377-0x0000000010530000-0x000000001058C000-memory.dmp

Download

memory/5524-2444-0x0000000010530000-0x000000001058C000-memory.dmp

Download

memory/6488-1435-0x0000000002270000-0x0000000002280000-memory.dmp

Download

memory/6488-2174-0x0000000000400000-0x00000000004BB000-memory.dmp

Download

memory/6488-2175-0x0000000031C80000-0x0000000031C89000-memory.dmp

Download

memory/6488-2173-0x0000000075B80000-0x0000000075C70000-memory.dmp

Download

memory/6488-2172-0x0000000002110000-0x0000000002162000-memory.dmp

Download

memory/6488-2164-0x0000000031C80000-0x0000000031C89000-memory.dmp

Download

memory/6488-2080-0x0000000003D90000-0x0000000003D91000-memory.dmp

Download

memory/6488-2078-0x00000000025D0000-0x00000000025D1000-memory.dmp

Download

memory/6488-1892-0x0000000000400000-0x00000000004BB000-memory.dmp

Download

memory/6488-1439-0x0000000002260000-0x0000000002270000-memory.dmp

Download

memory/6488-1437-0x0000000002270000-0x0000000002280000-memory.dmp

Download

memory/6488-1438-0x0000000002260000-0x0000000002270000-memory.dmp

Download

memory/6488-1436-0x0000000075B80000-0x0000000075C70000-memory.dmp

Download

memory/6488-1433-0x00000000772A2000-0x00000000772A3000-memory.dmp

Download

memory/6488-1430-0x00000000021B0000-0x00000000021C0000-memory.dmp

Download

memory/6488-1429-0x0000000002110000-0x0000000002162000-memory.dmp

Download

memory/6488-1426-0x00000000020E0000-0x00000000020E1000-memory.dmp

Download