Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/06/2024, 13:40

General

  • Target
    026f76b7ceeb1353397290fd300a2230_JaffaCakes118.exe
  • Size 318KB
  • Sample240622-qyy7bavaml
  • SHA256 a5dc7dde3cfc58148718cf5251d33fe1719d75b3a4049a545f5203b70fcef320
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • xxhrfxx.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3212
      • C:\Users\Admin\AppData\Local\Temp\026f76b7ceeb1353397290fd300a2230_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\026f76b7ceeb1353397290fd300a2230_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2464
        • C:\Users\Admin\AppData\Local\Temp\026f76b7ceeb1353397290fd300a2230_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\026f76b7ceeb1353397290fd300a2230_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1076
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:3200
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:4060
            • C:\Users\Admin\AppData\Local\Temp\026f76b7ceeb1353397290fd300a2230_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\026f76b7ceeb1353397290fd300a2230_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:4652
              • C:\Windows\SysWOW64\spynet\server.exe
                "C:\Windows\system32\spynet\server.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:796
                • C:\Windows\SysWOW64\spynet\server.exe
                  C:\Windows\SysWOW64\spynet\server.exe
                  6⤵
                  • Executes dropped EXE
                  PID:4720
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 564
                    7⤵
                    • Program crash
                    PID:5076
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4720 -ip 4720
        1⤵
          PID:664

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 d211830e1473ed0031cdddf40e78b1d4fee174d60643c51ca66cc8cc43855284
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56d8b10e90ce72b8e7966eec6513076f5bb5c9dc5dfcc2fd7771033a22f126e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a88ca398ae93df1d626f8be73b1c3551c1d08310a273fe41a738ab4950065dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc0512d25725ce1f9ff7cc8c3061244ac043c93786706855302a260ac78a1cd0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ced6dbf728e36d85e2603b3237b94ea6e89be4e7a18422873db02d7ca774173d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b736117640f91ef798bec2a4e0fd1a3e9aa9a606c9d6f872bd30fe97826d2a90
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55840501c7a47cbf60548e76cc86861eff91d08b9f9a2a2bd72317e9493a0ea7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50ab2ea585ea305f1a13a1e910341592d0b9b00f8551efa91c52a883294ed064
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9155be0c75b44d8cc275e72f6c0e45843db7991539a397e5668aba08173a188
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c65803889b710249f821187b809d24ebab5a7c9273a846d283a5d8a07fe1a0a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b6b99e5bd56a5756e533b50c7ddfcda886908f9a4713858dd823bc0c33351e1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b283b2808d44c6058d4d1f056a86224f3aa7a4318eecabf80e3a7f54c9433798
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43b5d5e55e7402d6a90334a9cc92daad19f9cb28a146655f6080e276daa4d4e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d44d69b1d32e155c8d20d871b45dd151c51d08fdf8b6b94d3d25cd6de01223dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 716d4c537796b0c09a9e9aa3028d06caf2f303c72e1ef614491f2a52247bc9c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c18b9e13d1c23f47acf7f045e6746cbc0beaf29059e55857a39079396b38ab41
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c6792da096f4133b0fbc99e81b02333eb7f4b00808ebbd8af65614cab2d86ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7359c44a4819d2d358e9e0d8b572dec40ded11fa814842fdabed7f80a0aad3e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b24d983cda61abc9cb3ae444f47fc23d89070dc30850311f8606dae31077007f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a957c6f93ed86146a73e558e489f8816daecf5f43d164c1f21172ee669d6a4e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97cc0ebc01e719a7b4eaa836e27a7235d142d06c265fce25755985c6c057574c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5cef0b6220f57e0a16eafbaae6da6aa91cbda293ae3bebc8541c38a262559ae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2241d63a6239e50aa117231f22504397a86a5cd3fa0fe3e1c4859e3904587c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3026f5139aacd4962694b66cb8660fe5a87995bb08060dc1a2e94391db466003
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2c3e6601f493662f8daee6981e63300d8c2380b04e27760be3c20027874372c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65b8d5ea6d438ff463f64ef50a597ac8450dd8535724d8ee8cd63055d06029b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a811364604a38c61458e8548f482f1274cd45fc78faaeeccf42a8afad48d0a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cb4efd20224a301b5b10ede687806e2592bb2facb65130ab2c2e1f2f16539090
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a197ae9bdfedc2a8bc196fd2c8fc812dd3a91191652e7360c2eacb5b831fd246
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd892595846e443dd6641ec75efb436e600374006ce58445aa2c1d0352a1b55d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0d278207ae87050f9946d1d630d21b952bf58720ad4ade863b86788ab643d19b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2db746c9283557ba9f32047ee127b2784687fafba15d90f96c23e669f4f573e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 022f3fa94d0a5da9e99f1da16872fe96fe91f8442d20c2765bbaa35a48186c29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff71d676cc68a292ec8dd5920e216f2d48a9f47fdc3948d95e997c49419927f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6df30c18fe84d62b2ce729bd31b42df9b57051ad7c35d47a326eaf2b23bd15ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff538a3f134f6042a790de8cdcc8d1257f8dbde5f42d6f57e991df2eccd0c704
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4c47621292a5a484b7449ffa303d09c96abcaeb25fcd5f9d7c357eafa3c5c04
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 07afa8389619ae2b2a1f6ff858e09e5bfe93319749e7f87ebf68b3e35f180ee4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c518a15734506162451c7b17ff4b8528548760ea35c56b4700416a496c5abac7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c0511732735233c22c424e3fd8a17b20fb08be69524d25184064f6830e51394c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af11766e64cd0d995c6039a593048d9968df949ac09e477e2278c9cf9967a909
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 07bf6a1d7d3cabc5afd6a4d4abbfeb9375b79521245ca56c05b0718ea407cfee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7785bb98401cb43dd87b33327f8ac9c209d64df41e49f2bca7241b513c8aa7d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2958aa5ef72d28d19b6aa929c6043b1e4e8428f63a90344a96628d175aa7f76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4f7d89e32d5d5e3532a45b96613942a8f4b143384e08eeffd7667740d5db780
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8fa2456c08cf86eac2b615fbb5a91bc8e2167a75a5a0a4f6d5610cb5180b1f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e7d3ab83f8ea268613ac3a4cdf069288b94f5e32f5acb16139fa5351ebc8aea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f99731f30bfeb76779a5e2d45330c098dae327b5c2030bcdeb4df94c8d0fdf36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec294a62665527e57b3de4eb5d4f6006644291b34a02147e25478a1e1b1de820
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 173bddcff31bea7420e650e29e338e4fbd6a82f5e3bbb5eab298582a8aa012b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff9ee8f7c87bc066c63d0ad772e393f9bcda7f23384b3f5e50de8d603b8df7b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c1772d6a4dc372d475a2be7a0331720288f1005a42cda2ca43ce61a64fa6499
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b280b6cf9fbfc679799361ac4feb8562ef50706317e6faa1c7bf50e3eb92e1b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24ed84935845ee1be2414bbbb0a2e0f64aa566d42911771e23e1c960b36bea7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b615ea2373d4d512baae65c0d04d6cb1f0c153e49f27bf4fcb9cc27b5e005bf7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afa71a17016ffb96e95caf62838c8465a6c9a8d6bcc02ff05da9d8eb65fd1805
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30f3d045e3d23c03c45efad9509c55e3120dc85c1d0978a45ef9cb21d7f2ab1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48cce043db34872c3a12725b87e5a756b7148238681deb8201c7ab3878347d5f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7efe43676522082cca7b56eb3551db0ff52157646136be28dacbf88477bb6833
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2e051742471c500691602acc4793aacd0627d145e124d451a271a5e2a29d238d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 910f99bf6a61872d2372d0144fc74ea5be4ddf0977885f42e479dc1b353d2940
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea8c6adc05dc0785e424ae9d9fb4b8ff7c11d4f30fe6225c400eaf80600e9983
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 040e8574c6baf705bb89c0b11cfd7c34553d66fe693d5059b9ecaad7c9f9eeb3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ac3043212ce22ea16e111a0d2a91a2fd2547430d0829a241cb3bde481a72b37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a12d2ec61dbac6a48603828e02dbd0551183dfbecaaa9cc4093386a7b5cd3172
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfa4a6172a32387699c9b58ebbcb881bbcc2f788bc0eaf3dcd05dae387c4481a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7465031cd836437447cccc1cc168992ad96a9e48c6006a9f217ef0330588098
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5beee0a53855db3e866a81e9abbf3b2e5d55d11fe6f443c72d6bb4a55252e0e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8100058b7b0d5480607587b7c5773fcbaa62a1d85da11494d3bc2f3f18c4d033
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5b3a8f45d3f010d63a6164dffc95d0d934248db12d3690d691b2709c8933e7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b094eb44d46bd682eecc02fc8963c847d00357c9510f79afd2c990bac51e4d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 461b2e8aa43a132a9952be4a98d980e5b2d4d613bd88b590e1112058ac132e3d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08d54309ea7610529cfa8eca23872fcea9d162afd1b334694f3364658aa929fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65c2cb163f3ffffdbab653d2dd2a57d1fd6635800e63f68db81be2080b00beed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59175b8f5cb58b23442a3bf8cee8f0caaa2041d2a0af3f0bb4d08c833129677c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 973b7c50234ddc01b196031eed00a63ae4f6f1dec47495c984b95f3ae78808c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97e3064f57cd383536f6ebed6d37148fab2246a7126a5f938a86a2b58b620e80
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4e8f745347aa16753bec69bb03f25b53f12ace0e0dde5b6d9c624e6de9312f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 215c4eb072f9f31aed0364d9ed45dbef2ffbaa39ff07ea419b27b686e8c68a28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eafc888cff4e8f1629a70f06589d73203325c837fad7ede2be44017240992352
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7720f34f3a4b481399b0a4aed991198faab8ad5c8d09b4e02f3a4afe6861d53a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc814990aedd748794d2dbdae833618a9c2e25f908ceb7bdd256e2498cacbeb7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9264c68a5cee0e1e37ab6ee631d44c9fa636edc583af8955a958f9dd14db1932
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f4406ae1ae65f61beb76cde93a8bc9f0b9ce0e81a7adef99e54db14c8d38de3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c43ad1a8a03b8f391339d4fed17810135cb76b2c147bf16abf46358027fc366
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cb076196a1cb04667b8ec7b3812e25201e8ee601306938ff975ceb482f86a6db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d4742df9889f31fa3369bfda9dcda21d2d1bef9de7eb96b552fb32d168557c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1fe713274f46f8ad35720c2e7e07dfaaffc660a4f0a04895c877fcbf203d290e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f40dd00cb5408cfbad58e389f1b1908a7c48ec54f675a5ae2ee7c435da3cfb6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e3b25fd49aae1f546ca20c99717e7c0416ea2fe7afaf1dc52ca80623b3cb9f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 262983c93559930e11d8b5e0d785f0f3bed8c786f13005f3071991f296247d6d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 450e484864b547c4ed549df8ed3c063523cf27fedca16910dc324bd7693f75a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08bf8e712101ecca85d5c57336484cf488abb21462cf080d25db6c45f5df8f54
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 64db2f8469296fce76d6920e0a3f5c0642dd58466606435f0b58b423d1214f80
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6541d8177fcee58b638fcee038948a381b8417f04541441fda8d5693610efd91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5c04fba96013919564b4b829575d7ece314ab835c10d2c17379360629941e2c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16a87ede2d6a2b42fd9c770d2159d5e2ecb80f298fee266b303043c2e2f443c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57cf6d9a29611bd75fa567386c2985b17c21c10263672153bf8e0aad1fa182e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc4fbed33d6dc01ecee851c931b23d33a15c85dfcb79abf847d0770e66d5f70f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a347f2532f193a9dd644d28355afa47ddf63ab9ba5a14e217c1fb16813d64f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 770e706a17a833860a8b9b7ceebf1a0086904c565ea384cc2acc21f6103fb4ae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d65afc49fac406d1afb3a387e8c41bf83796c4c90eda9b2d0e72e9b17a38a26
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50cdaa0d6cd8b0d8c9f83a21aa754840d2b5f11d4074185e7dfad74a471ba537
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9db6cdf18be1ad927719c1ecc901e9936ea444a0e6c726b2f1709a4d93432bb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0d4790347d81dfddfe7ff0631393c512d2490edef32c32acb7040a7d9211fef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3fcc9888bf914276f90441c17a3d86550ac4c82849df93cf1f0a99b860f1fad1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fde5e8740cc0f675460527199bbbfe15dc63ccc7062d3cd321e634205011f478
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8b386fc9f75dfcd1175a4b82f169c94afc9ade2cc9dc187c80d48223b51b210
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5dd2ca72bbfefda8c9d56e733a30beb8474c38715a051598b070e893dcfe305
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 074d67b588f2bd23ce028f04add4f8ccd3a302a279a33154fb879ef412236232
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6fe02425f0428aef02b99a8ecc88af96a16a92c391f4d82d9b14d91864e15cc3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11a0e6054883c884d6ef7b2ff6b660cca55e0414abcdd170a5bbb7ba548ae6c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d32db70ca6cfe78b0eff95287bc7cffb6064c015b80b98fa1a2587d04b4b60e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01b872d5dc68636c1653a7f34121bb69c64f8544a5e87982a84e4d3f9fd3b8f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 513b9e05a39a06079047b8870cf049f197c94f4815cefaf36547d5fc3a73b2ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c757df32d4dd1d4443f1d06a36ad9efc80dcd5348b5a96b2c88481d9b8453aba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 565ed87788c1de0de4371facce1f41f49aa36ae9364c9904c07266c006ceb04a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c3a133e533e48ffb24cd6ebc50c2cebf3f125292b80c927ac52833e2c46817d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee063aa6d8b8c2e5b10da0cdc8567af8915053370038e9580b34569713a600ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5d7baf4020a7bbe5a1bab9a63e058269e862d7dff957d4d0162b14634b89786
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 96edca5a4783f87571b44b827bda9711d6707f9baab6514455c5b52f6dc23454
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 252df6c4a90b9363fd4e17e027a47fb6954e9c6a7190ba5b2857c11117a4b5ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 03fb4f553eefeac7987361c2267e46d8f3f4b4f9aabfacb27395ad5bf43fe2aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fdb0bb0e54a44a2ebc9d421dc4cde0bf6306983716ae2deb228bf1944c3b8d63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 828d0def4859db92ecaa0a2c4248846bb9cf1d4f2e85e12064d8475b38bf9271
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd48cfaee1281b0b4faccc63db82ba39acfbb2f7c75fc3b676329d4bf27c2f5b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82d9710a56ba360e0f82c3109818e3119225863065c5a11867f48c16b83fcc0a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 231c144f2fbf026086144bcb96bd3811dd4eb94963fe2255f4a2bd10f18a5dac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4975a2549fd3d37ba28066fb99e34f669edd5e98a3b7b8e708695adfbf8e2345
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 636836a0665d3ed1a628e23c5c2a86319f505912a41ca240603569bd3399598e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f284a8e30d10dbbfec29b7f2c9f71cd83f608008e69ed5fb3539b83980942afb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 419771d946113956fa5df1e0a0c558842b6a1b8621b94a1710ea6651b193d146
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d6e49a0a6d803277961a1561f250509ca82d42a1d6e8d48546a072cf8018141
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c964fa1f4370bbffb4110d48466385aa3c6dddb9300801aeb83500f3016d513e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89fd8443b80a5f91b3f0697c9e391bbdcedf24f798b25d09a097f7c241670eb5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e816e8f821cd754e42cf3e34ae4ed798be0fc64e9a022805d2fbf5c0648ea82c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf459b08483c8b10115f2b8565e5a53bbfa82ea8b660f8bf019bc2fed8f7bf25
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8df71daf3674c4891a3ce72b338262a5f6ab751db7ab6546fb3392fbf42e6ab1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 47ba11ca60519ceb4f87c44926cea8d96f7edd304a2426b544f679726ad6a1a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e19dadff4e07a80b0d6ce5d696ba6fcb09c2c9c5265312bc6d0aa67bf215c0d
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\spynet\server.exe
              • Size 318KB
              • SHA256 a5dc7dde3cfc58148718cf5251d33fe1719d75b3a4049a545f5203b70fcef320
              • MD5 SHA1 SHA512 SSDEEP

              memory/796-173-0x0000000000400000-0x00000000004A0000-memory.dmp

              memory/796-183-0x0000000000400000-0x00000000004A0000-memory.dmp

              memory/1076-150-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1076-16-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1076-9-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1076-8-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1076-7-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1076-4-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1076-13-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2464-6-0x0000000000400000-0x00000000004A0000-memory.dmp

              memory/2464-1-0x0000000000400000-0x00000000004A0000-memory.dmp

              memory/3200-18-0x00000000004F0000-0x00000000004F1000-memory.dmp

              memory/3200-17-0x0000000000430000-0x0000000000431000-memory.dmp

              memory/3200-78-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3200-392-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4652-151-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4652-1071-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4720-180-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4720-186-0x0000000000400000-0x0000000000457000-memory.dmp