Malware Analysis Report

2025-01-02 13:04

Sample ID 240702-2vn3qatgnc
Target 1dc248c9b9205018195528c6e6fec785_JaffaCakes118
SHA256 43b7866b1ac71495eafc0cc2f2d22d282b05603b0d356810baf947ca97f9919f
Tags
cybergate settings persistence stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

43b7866b1ac71495eafc0cc2f2d22d282b05603b0d356810baf947ca97f9919f

Threat Level: Known bad

The file 1dc248c9b9205018195528c6e6fec785_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

cybergate settings persistence stealer trojan upx

CyberGate, Rebhip

Adds policy Run key to start application

Boot or Logon Autostart Execution: Active Setup

UPX packed file

Uses the VBS compiler for execution

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-02 22:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-02 22:54

Reported

2024-07-02 22:56

Platform

win7-20240611-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe"

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{807EG057-T7U0-RA2C-6PQ4-D80VACAD5T1P} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{807EG057-T7U0-RA2C-6PQ4-D80VACAD5T1P}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Windows\SysWOW64\install\server.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1932 set thread context of 2292 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1932 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1932 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1932 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1932 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1932 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1932 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1932 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1932 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1932 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1932 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1932 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1932 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1932 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 1932 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2292 wrote to memory of 2004 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe

"C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe"

C:\Windows\SysWOW64\install\server.exe

"C:\Windows\system32\install\server.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/1932-0-0x000000007425E000-0x000000007425F000-memory.dmp

memory/1932-1-0x0000000000F80000-0x0000000001060000-memory.dmp

memory/1932-2-0x0000000000460000-0x00000000004C5000-memory.dmp

memory/1932-3-0x00000000002C0000-0x00000000002C8000-memory.dmp

memory/2292-4-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2292-5-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2292-6-0x0000000000400000-0x0000000000465000-memory.dmp

memory/1932-7-0x0000000074250000-0x000000007493E000-memory.dmp

memory/2292-8-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2744-28-0x0000000000360000-0x0000000000361000-memory.dmp

memory/2744-22-0x00000000001E0000-0x00000000001E1000-memory.dmp

memory/2744-16-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/2292-11-0x0000000010410000-0x0000000010475000-memory.dmp

memory/2292-15-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/2744-53-0x0000000000400000-0x000000000051E000-memory.dmp

memory/2292-309-0x0000000000400000-0x0000000000465000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 9cb706ec0615ee304f874757c4ade407
SHA1 10abe9d978be49dd58a5b92662b1161facf29313
SHA256 544fd953a25eba8bf751b9b2224ebe1314cbf54f7cef7b314a5e810b526a3644
SHA512 2fcb19816eb6727c52c994002c151a98c545f0cd83200924b7ecf93dc241b1dc0cf9d093d2e3f8c596410617445a9341a871831cdcffdece3b17cfea68100179

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Windows\SysWOW64\install\server.exe

MD5 34aa912defa18c2c129f1e09d75c1d7e
SHA1 9c3046324657505a30ecd9b1fdb46c05bde7d470
SHA256 6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512 d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe

MD5 17a3ab0f1488c59644b7de5dfd62430c
SHA1 e4d120dedbbea668a95911560224807db5e3ef93
SHA256 61c0aebb7fa9dd0f1a4c9d1f33a87ddd20233fbdd3b1d5620c905cc4eee8374c
SHA512 6ed768d2f0b7d529c486e738d479a6d27283808d5fdd7a89d8c84e3a162cfc58f6621c0514b248ce822292a294fbb4a5c813496f155c73f6d7b3a72d6302cf02

memory/2968-340-0x00000000003A0000-0x00000000003BC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 18a79366ea69263420e4af32ca16c329
SHA1 6f171d911f201a774b4baa72b777c41b0cea45d1
SHA256 065899753e8622bd4c93d5d3b231df6c5906eb014c68e130e46d549062e09d37
SHA512 a5694e4b2fd38f1a85c4ecea35f0caf3d6cc70cea9f0df28300969beb300fc233ee00fbe760acf2c6ba037217a77f559f7da73ffe05fce8867e8d0d75221b60f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0d64e6c774d9ee0de57e7006c6198a02
SHA1 a42e07e660de344bb55c8d7349205ba5cf59d52a
SHA256 5769db7c97f5d2c8df835a1f28b62548308c43fcffaa6fdcea9624a5fbf1cfe1
SHA512 623ffcbce9355e80ae106dd100a80c83739bcfea4e9657c9b4bc04e753d4699a813156e2953991d4e98bae9adf5d2b6c24f1c8f06f8c349e1181e7b424ccf713

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c3261a6862caa6e3cff467b5bc555735
SHA1 a5c0aaa80461b936183862e7c209bbe2e985b566
SHA256 b793f16c9aa8847c078fdbd18950db741ba1e0ed9fdd97f1dd0152b91d9fe7e9
SHA512 51ebe1ccd873f94b2cb690a6d530c9bfd50cc3f0a09d88129b5170e4056dd624d4f21fb6107bb707df1b97a77c0a91cd905fd3d360575c34ca5e380733fdfab9

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6fb1105f852c3ab55b225c4cff7d2408
SHA1 16b4dee288d0e707658cec983f96acb07673cf12
SHA256 691b542fe8eac4c68fec61cae86f74fc4dc4afea2b4a63b4136434526497581f
SHA512 30dd491852d82fbdb43afb386abf151fb062f718fd2ab1ff25ca9c5b6564bc82c53578477c3910ebd66ee814b23c09999971132c273f601192da5697e9d75322

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c5ff33755cfc97902c88170bf2cd17c1
SHA1 24d515f57c22e1c69a0c24989622e9401d85679e
SHA256 13b62b1420a7222e549d35caae380e6d31f29ca2aa47966a933f0505d99b4796
SHA512 30131e3495a3a71675fdd66bced60e9e22ead73d1d4ce28ec5066d89d446c67e359f3b9da54eb19af0eccd5d1ce4a9b97c38d873e31cb6d943e6a31e6e216242

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 18f26cd0719caf22f4276c4833482272
SHA1 02bdc19311636d8bb6fbb2e16194c47e4a7119bb
SHA256 ecb29477d87cc7da061689011c69ed8e6b7c588459fc4c92c2360552fc799dd6
SHA512 4741be5e166821c500bb0756d0421d8c7ec4c48c6dc6ca457d2e4b69b5a538f8481251efcff1da034edcf2d92728d1a626907b28dbebe260e6fa1c1c5b930ca7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2d630b19c7b741fbebd25e2e3ef2d907
SHA1 ed5d2d6203dbb4e32abdc889d96995dd3ca2512e
SHA256 f0ec65023c8f7fcb101785d707520cb24ec4898a9d7b914cff3dff8d0f1eb5b3
SHA512 5a3a08c58f52fbac17ae4d0d73ded85beab887b27e1ab51862a616e42ff4cea9e6c3d1cbae845fdf76ef8dd840575613d35dee9048d24a3b14d6c8ea79189e38

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b2dc3cc813a9cde48eed90696ee98c6f
SHA1 ab648b9aaef0554409e39b1c9a8cd6dbd565f3ed
SHA256 744e71e02739f0b2a8d916feeb0b36990ecda8f45e495439cdb97f33813ff442
SHA512 87a7231365b6c1ff8383341d3a9b898ec704c8348562ab079395c718551dd4329bc0d28a03951f0c83e17ac0e02f8fb7c5f4e5e801706e86a9e3bbe55ca4c354

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d441ac49a1444006c57e88771e3175b6
SHA1 a9703021d9f8e68acbe0df236923fe0cb6e059f5
SHA256 7929cd0b166b32550126b9adceff0dffe58edbe05132be6150d419245e028ded
SHA512 6105fb0bee1f40b28208788f15bf290cc1a0d7a36cb8b648d5edfbd4baadd896689a4c97ac2642d67f82877acc576fd53ad83591c64999dd6b93c094c6e5469c

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7cf5dddd48ae2ff80a1720e1060e375f
SHA1 f0186a11f829e469a1201098640e9dd010cf57f4
SHA256 29ff289024ed83eb9d83b7a37200c6d1d4fb934872872f2454c0655683cb1ea4
SHA512 2deb5ec54d2cfd9e218705b0efc86f6b1cf19d485e74f75954471317190ae9ebc9ecd90314dc74052d1c7240ee32354a4df873e0db4ce871d79c832d22946c5f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 493948bbae7f99b406f728474970821a
SHA1 9c88345959807df61665f71c64f73a2520de9e3b
SHA256 103b68c6b85ffe5b66cedecd18792e94d4a956c29142c8ce8f974fabcf464ce8
SHA512 162ac136f5d8d40126c4632536027a98c9e0be0e41b279352eeb3234f183d0b5e156491b4945dd8ebbefd7ebc315de5084f9ba1891fe74755deb99f1beaf0457

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0c788db67c4724ae516bd79a7d74a992
SHA1 40a133da5aea6d1e07402ef40a201064e8211ee3
SHA256 865040601bb07c681bd2e3321217ab46fb1ac4c8b488893cfd70b6551b625201
SHA512 1ca8ba799fea59a080c0b5b18468bf9472163b687d2169fa8b2466ff1a9db1e7250ea3bc0a9dd7146d54394db0ab50a3719403f614b650ac07810a6a019ef9bd

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 406e6bf2f5489cb74a247ba81e688dc9
SHA1 d69de61115e9a3636f913937c18dfa260e78970d
SHA256 6cf51bdc41ea448a6fbb5899db50e9bf3fd7574ffb289a1668a971bc0aef4a58
SHA512 3e35ddd12474036e722be65e7471af93201e072e61c5c5d4c4e073ee80e2a73940ed2ddc30a588323251ab316c7a6f37b81395cd46d31c7685ef84bdf95ac4ff

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 88f48aad5f83f973bed5fea381449f15
SHA1 1cc76e095630e081607ecc77b29e67ed4797182b
SHA256 241441773a27297b2a3c3cd154e6a784774bee169c6034c8972033233339a0ad
SHA512 8d6230ad49a8c99c14b9fd98a982e53a8cf8b13eebf640e24f262a53f37220520b2a9a54360ad60b354843b9520c44378be6430ecba8a08f55dfcb25d61a3def

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 5815c027acaa62bfc03418a76c7bffbf
SHA1 51e75cba922f86f9ae84fc569c00fc42feca1905
SHA256 b946176c6c981cb9b8d9adcfdc2b4f4b3925fe8fab5050618e8d46b64565abd3
SHA512 032b3f7f0c398976598ecf084fdeabb30b5136c717dc025020ef76577c54605386b8f38ba7d1d2ca97b9ff877b60f2e31ccdeea6263284b9a896892b836a54bd

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 420a49783f0a444158821c50a698caf3
SHA1 24000e36d5ed28ac3d7814a76f904dd44c3de870
SHA256 c3ac0cf1cf988584b6f7a915761e89b109ba358614d2f6a0089d651fbacd8b04
SHA512 9a3a7fc2e3e45ce906c85337dd776d25780f93c8608abbf76296f43d8d9fa122ec19a6c37d902fe485c4b98aaa4c5c329e7cb6ef757048a87eb877eec895b388

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 387f42fe7dfda2d3a612e3e60ab06f27
SHA1 64380c0f669a7cf15cc2a1e5ccfc5e10b2436de8
SHA256 5e9e29f98584a3ce4744c4b58d9a258cf80ab1d9e6f0b7198a7eb12d429fe455
SHA512 10070984fa7f19bdc808489265d480c9b0f434203d1b9358cc127462acbb9207b2e4644dbe87840f5ea15cc7f3234cce0629ec554710fda5771420ba08e7780b

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 8a8e5ccf0deda5642734be7dc63ecf4d
SHA1 1ccc959b18b8cb28eb7f02c8d0b32088d25b8569
SHA256 a77e45480ff84cd5a1f6bd8879b0d86d92d3f5103143624ad91a85087cb8c140
SHA512 b680276e8b9d852b8d2db68492b8fc65f3b9483828c14617f05046f814565eb78811673a333a9a7ba327fc73cc23b4c04830195a0aa0f6903a00db91b572070a

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-02 22:54

Reported

2024-07-02 22:56

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe"

Signatures

CyberGate, Rebhip

trojan stealer cybergate

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{807EG057-T7U0-RA2C-6PQ4-D80VACAD5T1P} C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{807EG057-T7U0-RA2C-6PQ4-D80VACAD5T1P}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Windows\SysWOW64\install\server.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe" C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
File opened for modification C:\Windows\SysWOW64\install\server.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2156 set thread context of 2736 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2156 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2156 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2156 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2156 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2156 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2156 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2156 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2156 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2156 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2156 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2156 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2156 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2156 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2736 wrote to memory of 2328 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Program Files\Internet Explorer\iexplore.exe

Processes

C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1dc248c9b9205018195528c6e6fec785_JaffaCakes118.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"

C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe

"C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe"

C:\Windows\SysWOW64\install\server.exe

"C:\Windows\system32\install\server.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
BE 88.221.83.200:443 www.bing.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 200.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 www.server.com udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
IE 52.111.236.22:443 tcp
US 52.8.126.80:80 www.server.com tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp
US 52.8.126.80:80 www.server.com tcp

Files

memory/2156-0-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

memory/2156-1-0x0000000000730000-0x0000000000810000-memory.dmp

memory/2156-2-0x00000000050B0000-0x0000000005115000-memory.dmp

memory/2156-3-0x00000000050B0000-0x00000000050B8000-memory.dmp

memory/2736-5-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2736-7-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2736-4-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2156-8-0x0000000074A80000-0x0000000075230000-memory.dmp

memory/2736-9-0x0000000000400000-0x0000000000465000-memory.dmp

memory/2736-12-0x0000000010410000-0x0000000010475000-memory.dmp

memory/2948-18-0x0000000000690000-0x0000000000691000-memory.dmp

memory/2736-16-0x0000000010480000-0x00000000104E5000-memory.dmp

memory/2948-17-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/2948-30-0x0000000000400000-0x000000000051F000-memory.dmp

memory/2736-81-0x0000000000400000-0x0000000000465000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin2.txt

MD5 9cb706ec0615ee304f874757c4ade407
SHA1 10abe9d978be49dd58a5b92662b1161facf29313
SHA256 544fd953a25eba8bf751b9b2224ebe1314cbf54f7cef7b314a5e810b526a3644
SHA512 2fcb19816eb6727c52c994002c151a98c545f0cd83200924b7ecf93dc241b1dc0cf9d093d2e3f8c596410617445a9341a871831cdcffdece3b17cfea68100179

C:\Users\Admin\AppData\Roaming\Adminlog.dat

MD5 bf3dba41023802cf6d3f8c5fd683a0c7
SHA1 466530987a347b68ef28faad238d7b50db8656a5
SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
SHA512 fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

C:\Windows\SysWOW64\install\server.exe

MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

C:\Users\Admin\AppData\Local\Temp\Unusuals Crack Version 4.0.1.7.exe

MD5 17a3ab0f1488c59644b7de5dfd62430c
SHA1 e4d120dedbbea668a95911560224807db5e3ef93
SHA256 61c0aebb7fa9dd0f1a4c9d1f33a87ddd20233fbdd3b1d5620c905cc4eee8374c
SHA512 6ed768d2f0b7d529c486e738d479a6d27283808d5fdd7a89d8c84e3a162cfc58f6621c0514b248ce822292a294fbb4a5c813496f155c73f6d7b3a72d6302cf02

memory/3404-114-0x0000000005080000-0x000000000511C000-memory.dmp

memory/3404-112-0x00000000007F0000-0x000000000080C000-memory.dmp

memory/3404-111-0x0000000072F4E000-0x0000000072F4F000-memory.dmp

memory/3404-118-0x00000000056D0000-0x0000000005C74000-memory.dmp

memory/3404-119-0x00000000051C0000-0x0000000005252000-memory.dmp

memory/3404-120-0x0000000005160000-0x000000000516A000-memory.dmp

memory/3404-121-0x00000000052C0000-0x0000000005316000-memory.dmp

memory/2156-122-0x0000000074A80000-0x0000000075230000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7f77cf43acc78c56f597c94b15add44c
SHA1 b9ec67e424c347bcd2471f9c93d9eb55b299cad1
SHA256 877f93e938ae7a0c9557b1b1b4d3f3565aa0028aac1f8b9b9a4863e0dbf84a99
SHA512 ae49cd2e7369f4d51704473e47398899698909aa386bff6bea671ad45342a6827870e49e0b5eb6e8367bf5d5d4c0620a99083bbb8cd9df14ad6ed337283048f1

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c5e5ca3a32d80f26849ab869391597c8
SHA1 80b211bf9efb2b828d8219326e4ddadcfe367f79
SHA256 3b1378b0a3392c5de58b1730b4ed3f0ff74f25dfd2bb6de51c21a80474956817
SHA512 c5a675e71b8f2d831282111a8baf3c338891115fa7509c5ec7b63546d071ec7481ef14694f319501250322178554dd1e34af1caa9288c6ffadd354005e6ac4d0

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 3c0aa7e6ed93cfb4a81c4342b5ababa7
SHA1 ae7eb32553d4d07f5447fe565401a89b721f6fbd
SHA256 18b42a868082a627fa3d7e959e2536804965d4f8ee76669fb4800ba80564a370
SHA512 bb6f857dddc9626159b0e4c93701bc204dd7605fa514709be8a0929d16afc0b63e0f568be485e34fce24fa83fbdb5ae2d8a457704ecb72c73e90eb25d3a3dfe3

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c71f9c41527fc54069917b4778790f74
SHA1 34fa8f2c16c0293051764983373f707d34f7350a
SHA256 d25bc5c29012cb6e6782e45f6ea71cf3a5f7f820ff4828be62bed5070b48b231
SHA512 cc7a6db3e6a26108d8e4893e2b4703e3bc13aa5da8979f44512366ce7c92a27e5b51a4040e54dddbe56ceadc2888f368b4105ae18d7ceacdad1a91368c400af5

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 18a79366ea69263420e4af32ca16c329
SHA1 6f171d911f201a774b4baa72b777c41b0cea45d1
SHA256 065899753e8622bd4c93d5d3b231df6c5906eb014c68e130e46d549062e09d37
SHA512 a5694e4b2fd38f1a85c4ecea35f0caf3d6cc70cea9f0df28300969beb300fc233ee00fbe760acf2c6ba037217a77f559f7da73ffe05fce8867e8d0d75221b60f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0d64e6c774d9ee0de57e7006c6198a02
SHA1 a42e07e660de344bb55c8d7349205ba5cf59d52a
SHA256 5769db7c97f5d2c8df835a1f28b62548308c43fcffaa6fdcea9624a5fbf1cfe1
SHA512 623ffcbce9355e80ae106dd100a80c83739bcfea4e9657c9b4bc04e753d4699a813156e2953991d4e98bae9adf5d2b6c24f1c8f06f8c349e1181e7b424ccf713

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c3261a6862caa6e3cff467b5bc555735
SHA1 a5c0aaa80461b936183862e7c209bbe2e985b566
SHA256 b793f16c9aa8847c078fdbd18950db741ba1e0ed9fdd97f1dd0152b91d9fe7e9
SHA512 51ebe1ccd873f94b2cb690a6d530c9bfd50cc3f0a09d88129b5170e4056dd624d4f21fb6107bb707df1b97a77c0a91cd905fd3d360575c34ca5e380733fdfab9

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 6fb1105f852c3ab55b225c4cff7d2408
SHA1 16b4dee288d0e707658cec983f96acb07673cf12
SHA256 691b542fe8eac4c68fec61cae86f74fc4dc4afea2b4a63b4136434526497581f
SHA512 30dd491852d82fbdb43afb386abf151fb062f718fd2ab1ff25ca9c5b6564bc82c53578477c3910ebd66ee814b23c09999971132c273f601192da5697e9d75322

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 c5ff33755cfc97902c88170bf2cd17c1
SHA1 24d515f57c22e1c69a0c24989622e9401d85679e
SHA256 13b62b1420a7222e549d35caae380e6d31f29ca2aa47966a933f0505d99b4796
SHA512 30131e3495a3a71675fdd66bced60e9e22ead73d1d4ce28ec5066d89d446c67e359f3b9da54eb19af0eccd5d1ce4a9b97c38d873e31cb6d943e6a31e6e216242

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 18f26cd0719caf22f4276c4833482272
SHA1 02bdc19311636d8bb6fbb2e16194c47e4a7119bb
SHA256 ecb29477d87cc7da061689011c69ed8e6b7c588459fc4c92c2360552fc799dd6
SHA512 4741be5e166821c500bb0756d0421d8c7ec4c48c6dc6ca457d2e4b69b5a538f8481251efcff1da034edcf2d92728d1a626907b28dbebe260e6fa1c1c5b930ca7

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 2d630b19c7b741fbebd25e2e3ef2d907
SHA1 ed5d2d6203dbb4e32abdc889d96995dd3ca2512e
SHA256 f0ec65023c8f7fcb101785d707520cb24ec4898a9d7b914cff3dff8d0f1eb5b3
SHA512 5a3a08c58f52fbac17ae4d0d73ded85beab887b27e1ab51862a616e42ff4cea9e6c3d1cbae845fdf76ef8dd840575613d35dee9048d24a3b14d6c8ea79189e38

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 b2dc3cc813a9cde48eed90696ee98c6f
SHA1 ab648b9aaef0554409e39b1c9a8cd6dbd565f3ed
SHA256 744e71e02739f0b2a8d916feeb0b36990ecda8f45e495439cdb97f33813ff442
SHA512 87a7231365b6c1ff8383341d3a9b898ec704c8348562ab079395c718551dd4329bc0d28a03951f0c83e17ac0e02f8fb7c5f4e5e801706e86a9e3bbe55ca4c354

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 d441ac49a1444006c57e88771e3175b6
SHA1 a9703021d9f8e68acbe0df236923fe0cb6e059f5
SHA256 7929cd0b166b32550126b9adceff0dffe58edbe05132be6150d419245e028ded
SHA512 6105fb0bee1f40b28208788f15bf290cc1a0d7a36cb8b648d5edfbd4baadd896689a4c97ac2642d67f82877acc576fd53ad83591c64999dd6b93c094c6e5469c

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 7cf5dddd48ae2ff80a1720e1060e375f
SHA1 f0186a11f829e469a1201098640e9dd010cf57f4
SHA256 29ff289024ed83eb9d83b7a37200c6d1d4fb934872872f2454c0655683cb1ea4
SHA512 2deb5ec54d2cfd9e218705b0efc86f6b1cf19d485e74f75954471317190ae9ebc9ecd90314dc74052d1c7240ee32354a4df873e0db4ce871d79c832d22946c5f

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 493948bbae7f99b406f728474970821a
SHA1 9c88345959807df61665f71c64f73a2520de9e3b
SHA256 103b68c6b85ffe5b66cedecd18792e94d4a956c29142c8ce8f974fabcf464ce8
SHA512 162ac136f5d8d40126c4632536027a98c9e0be0e41b279352eeb3234f183d0b5e156491b4945dd8ebbefd7ebc315de5084f9ba1891fe74755deb99f1beaf0457

memory/3404-1446-0x0000000072F4E000-0x0000000072F4F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 0c788db67c4724ae516bd79a7d74a992
SHA1 40a133da5aea6d1e07402ef40a201064e8211ee3
SHA256 865040601bb07c681bd2e3321217ab46fb1ac4c8b488893cfd70b6551b625201
SHA512 1ca8ba799fea59a080c0b5b18468bf9472163b687d2169fa8b2466ff1a9db1e7250ea3bc0a9dd7146d54394db0ab50a3719403f614b650ac07810a6a019ef9bd

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 406e6bf2f5489cb74a247ba81e688dc9
SHA1 d69de61115e9a3636f913937c18dfa260e78970d
SHA256 6cf51bdc41ea448a6fbb5899db50e9bf3fd7574ffb289a1668a971bc0aef4a58
SHA512 3e35ddd12474036e722be65e7471af93201e072e61c5c5d4c4e073ee80e2a73940ed2ddc30a588323251ab316c7a6f37b81395cd46d31c7685ef84bdf95ac4ff

C:\Users\Admin\AppData\Local\Temp\Admin7

MD5 88f48aad5f83f973bed5fea381449f15
SHA1 1cc76e095630e081607ecc77b29e67ed4797182b
SHA256 241441773a27297b2a3c3cd154e6a784774bee169c6034c8972033233339a0ad
SHA512 8d6230ad49a8c99c14b9fd98a982e53a8cf8b13eebf640e24f262a53f37220520b2a9a54360ad60b354843b9520c44378be6430ecba8a08f55dfcb25d61a3def