Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 03:45

General

  • Target
    332e1c9f12d4736e4b69a9addfceaf7a_JaffaCakes118.exe
  • Size 512KB
  • Sample240710-ea3daawhkc
  • SHA256 922f95f2ef11f3483eb4c4e303d131c99f2705629dc61ccbf7faa5211f08db9d
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • your_dns_here:81

  • dinhonaruto.no-ip.biz:82

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3536
      • C:\Users\Admin\AppData\Local\Temp\332e1c9f12d4736e4b69a9addfceaf7a_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\332e1c9f12d4736e4b69a9addfceaf7a_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4256
        • C:\Users\Admin\AppData\Local\Temp\332e1c9f12d4736e4b69a9addfceaf7a_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\332e1c9f12d4736e4b69a9addfceaf7a_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3700
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:552
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:1052
            • C:\Users\Admin\AppData\Local\Temp\332e1c9f12d4736e4b69a9addfceaf7a_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\332e1c9f12d4736e4b69a9addfceaf7a_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:1896
              • C:\Windows\SysWOW64\spynet\server.exe
                "C:\Windows\system32\spynet\server.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:3408
                • C:\Windows\SysWOW64\spynet\server.exe
                  "C:\Windows\SysWOW64\spynet\server.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:2276
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 576
                    7⤵
                    • Program crash
                    PID:2348
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2276 -ip 2276
        1⤵
          PID:2640

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 505d63c81438a41c59677f16af93ed7bcc9e0ca8a37235021f84a9f09e8ab7f0
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 178917fe01aacd28d12d130b59bd3cfeff1a47b53446c00b6a8cc8b181122681
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 624b93972e32694f36efd81036ef02dc065f1121d9556254ebda95930cb6e9e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44cd2c979cc47ed8cf47742da7cc4494ec8fefb90e80335c15990f8af287afac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20cea4246b0fc04b13d608182acc309fdcde4c2f7908eacbf868251b936a2ab5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83fd67b9eb119e292177975957c0693b15cccfdbd0d2a99abffcb8f56c29847c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9bb15803cc003efe3263576dc92bd8a6e50844d0ad4a830c1540b696516f3699
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50f996645e10c6428d35b9e378769535978f0d502618662f17661de36f03aec6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aea1625732faf5afdeea3f595f93a0fcf01615a9a83e1c748e459517957e58af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69d8620e95b994cc5566889c42574ea6a90469d3c008a658cc18b895d62db26a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d695a1eb4c9273a35b60cf3bfb880f6db718f18527f85d3d7efea68d610acd9d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8562316eb8abd201d24c9a1e77c8b414238ecefba728a56cb8487f2fa9ab5414
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a9475094cffe55b30a5ecc6575eaa46f95d3880b4fdac29f7aeab2919163d51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56735497a3736794133c4cf495919beb30f82991cd794bb7734a5061cefabbf1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 febb4b2ec1cb600eefa84e9be94117ef3f56c7756ed1309b906b2eff377200f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97fb2254ecbdd331819498883c9d34bf276c09ef36b6c71976aabf76b7d8add8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97e4081b0f69fee8ac5266b479ecc39203e5a76e243ce1734132f06b81e9634e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27565407ca7cd4b4bffd9c58745779b2003d3cb35bc3d86e48bd8bc8040ec233
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5897a4569d215365ff05d54f2a83e51717f47f770b55992f8051ce12254e3f4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b96606bc0c49069d29da90449966783ab5138ed7570611eed0729bc30750605
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69be12a0b0f70eb2bd4048da4cc6da0ab1313fc73a85b58b97b75412d5c81f0e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c621e3af7cf1eaa8ab89918ea0aaa5a0c59f946a494a63d744370e62ed7bd6b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83d7be389418ca65dabaa728a30e0eb6215a7d5d42c81162ee1a9e45a03744ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b8bafd1dbb8038ba0e320cc3d0082fe484b99671dee131db67e09ba2188bedb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7bd900cb54c61397656afd130bb5e6b11afb886894a244d0f68dee9465af18da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bed494757a11747157942ab26be19e1b00142f9958903cdcb8379d23cea8acff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8fb16bbde0f7756faeb595765d9f123fe5bb9b6a185946dad7c541e19b57b390
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35b71ed410a2d0136655ad2238b36259386a7bcc2003b1cc0d75f7965785ff07
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2344edfa0dabc941ec15d905ba5033e4c2ea243b89ea734c128cf7d7ca0bdaa1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f77c3cbc43aea2f46a6c35ae9b9843e2a47acb9d25061ab2c304d745a747f88
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 06d10730b39ee3faa808ac54d4fe008529b54b58e2ec509b0fcbd8865acab289
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cecd0b84df4198d65cdd856ea5ab2de89e864ff5a691074d6c3f5d5ddfbc3ed3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 663991b20d31d4453e65e5061c37b025736c8a4d0f9621ab6ab22590447b4076
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0fe0184ff75c402715d39928f8f2051b74d8468f4ead4632352bb74de96abb8a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f852bb40134c16a430589d9702ae65e8a5e8329d6106c6b230b9c6ececcecd52
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d12653879d5e347720e6df7cfb981c34c3a98969963998608f83b5fde6776752
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 196a4c06f9272d22901d0a0417091016bb980c8d3e8f82543c48e0f6df198a8e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b08e22782648412ad108f04b709015a3796d26b17bb1d665139938b720f4b94
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31674daac44378858128f7fc95801f84f501cd342c9b1e380e858ab574152519
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f70ad6e8a9b64f2fa92d9968da3fdf18f63a81f05e2d87b67be2607b9f2ce974
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ffc4a2a35f2e4a85a2dea44a78ba915da2231eeca84386d7312b85a34e3b8b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84fcd0f029d66de6cbe44fdec95008fb8cb03edd0ce88ece1deabbbec6f60614
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c7d6625f7f73ee198660e890388e62139335b7007c61bdb35e112fffed75779
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11aa57b2445a3c65ad93fb18c60138c3ba568a4b9fa3080105bd6806ba4f43b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8cb1111213ce15d870a798a346ab2f337a46df54019e08fe94446b233be49753
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b786d18cb9e7cedb68805484eb4a162a38f4e194f9e1f2f5463beaf7864886e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 467662dc6f01ae6a847cab656e9994f2760f340ee006f8f219613b7967516a59
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c6fb672f2eec5207756cb6bb0a77d59a8e67cb2f4c81dc7742e9008638cc1375
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1306bcb9ac169aaf0f7d8b376661e1820b757a63dd20e66c554dd76735d7d9e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f304e63fa3810af68535767943700b234901df4ed4ea4d5aee4a6fe78d257fe0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a9ff662bea40489f4abe098e5d26adf1b7b77901483fc443d8e4a062dc6d20f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ed0532ec4df0118e7a0530a99b918cbdaa109c35eb9357e55ba98db48d94cfa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 119b006356fe3be8424f42162313d387e2025055f6fefb8743e30545dab87d3b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 110f70d17456f025904917369c3547031b4af7e905f625ce2ac7b97894caf380
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09e091fe30eb84d4820db36616ce4d1868a3375eec8b57c17bad2f2f2d6aa337
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf7c0dfa7970547f19db1179c84be101d1fec96c3455e11bb9521654b03a72c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ca8be151d41064c9be0b431372685a4266a7967379d2435e372a0dec94fc3a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 74a341cf82adeab0dc4385044fa3e9ef179eed0a9153a0f8961f84196fb5a321
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 169aa62fcdb2726cc9500b3d2be2bd2e1f60ff5324b380e2471a1eaff4509847
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 91ff7e8778a0ec2ef9bd24c69d56ea71ee308f0758059b9436ec5ab0e3f20abc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24232107fdf48440746ce1fc338ce7ceb8b47a0b24224a71a2b237cbee09214c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e540bb77044ae4bc5b689bca5fae017ae925b059f109a0e296fc1b612c8971f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2273244c17ff4a566d39f2a378bc73564574d805a65f56e9125a67b34ae3d97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c42f7b7f591c5e309876d6345b61f16cb8ef43bbdb705c98e11819116596d41
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75d636de91ca1d4a4bcacb1736b321c5419dc25db36c94082f49a265df94b03b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 812c5cc14cc2710555ec65c1ddb4187cc76a1985e5a977e18526de743bec26ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4124fbe43b47dfc551c6abba5fe6438ae6697cff8f9b019e1d5c7e89e9a27a7b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad95e70f09c9ce031ab969272c53dcb5f63772eae77d6934d0fa5be0214ce567
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c050f237ad762a648111b8ef7d77c5fa2ad440022027efac0304d98a2db5f9f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9dd62b83a96a1c35318e3686dd956465195be2f9e913584187bc5be6d722cfda
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ed82279029c2b5e5f785d75c14e5bcf199117a57947e107268af8d5329bf2fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 634b26a5c84ac0f8f962d627185a9ad967ea2ac749bd338fabe2897773bf4852
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 215aef121d6721afcae7c261c264fabb0bfdba6bd8a93ba9ea09a1ec4723ddd7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73f774822c38649cd08625ef5c1a3777176975dd2f4e8e7ab09ca6c0f780fadf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d068d011846232b516c7e8b0378644b687c99f12ebedd0b7d520f7561ecff187
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 324375ba2c93c6aa9d41c387484450b5d20e9aa4e49664c1d19c886c2e4f5646
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 00f491b6e838b414557660e87ba68a1bb3624d29a12933743d38e160c874c84d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffbb98aa486468dbe902e8a2a172828beb9ead1fa7b6b9fe63aecaafdc34595a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aee33d62d3bf6f0126253603e2bf8f231c667ad586aa4e5441430115c81937ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7fe126357efe6662380991872560ae6913dfe1ba6057b069c8373565feb1027b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4f2b7a1552c5178d4698815a0f2822a565f886cf4ec167fae98fcf5fd9bb7c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 68b7b4231fca24226aac64ab869657d917405de2e4c09dafd42d1a48878c1ba1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a996e3338083b17478c6cdc888acbaa23da718350c9e4d554f6cdd31f72c8243
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1972f0239ac48a2bcbdc55c2681041857265dd52644d6ac024b4f8a11b41d297
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d99549e384bd06e0949b1ee5a2f5dc6930f0b39ade834911ca330ba63acd2c87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8570909265d496a617eec32f22d9f3d579c6c9f4fb77647569dd6645e355ba15
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c950d0d6b64ac0780153f28ce035accd58905ce850a0bfd76f7873bb24160cac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afb11a381b0c724d1d3423ee46a0b982dcb11397529b97237b2022d2526abb91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9f9625d76b564b59cfd2347985399fa6a181bf77728f8a06b3580cfa2c2716e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a5046315a84ed18dd45fb7a0c12bc10d1c8f35385dd3f15be7745cd89c30d1c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd6cc6ad8a13e52a23e79f6709bfe1508371891d2b5a5e863f9c99abe51f93de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb02d3507339a340d09ea5ab47477c10dd5e73e70c1200dc6364402bf3038303
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6222fbe546758808bc66803de043537c3961332d005646dd86ea70b9dc00eafe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d005dab52c1c9319967517b0b9cec87519fb1c03d0e90293c8d51fd26b50ff1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd00b0afa3f5236dbcd31c2dc7a8c1908b63fa4eb467f8757a7486060947fd0e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd88d258e4720fbd71ad69020bc9a99584ac38b87a378fef734f619ecebd3d93
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e068e1e95deb4e30413df81cfed34c7f10ba68cce4514501568bf08ff1cf7eb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98f0c1cc533247a066ea84455cb910c85a06413f1becea416f5eab4bcecef527
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c65f6d393b7a95d78978e424eda4d2945c32bf601f7e980fd01a90d8c7c927f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ebc9f078cd07b4795742fe98c883808c56f483de03b566fd1cbde40d9dac10f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 04b5cfbb4c75cf077dcad94aca0b93a176d33a343c4b9158dd5ae5edf41f266c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0d007a87b5e45ddc94bbbfdead14a2cd4d839bebf0d6cd7262da704661913bd1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ba68389ebb957703fc57163a537f81e7b8ecb44d868f486222fce24461dd8f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f61b2dfefaf2f6e89f1b2bc3b6af2608d2c5b32a00924a409b512c82b1dddfa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41ce176c7925369174b9476a2ac2bfa0057d7f2c2e4cf664679f07a57ec3eb7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c50fd63ca9bb58af9181b7718cf0794090ff731288509b695e331a7281f9608
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f91e3aba04200c28f80df011289084b291396c96d955821867281749e0767a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65a056b08a9742d2cfa83319a14f05d30b333dc7a2716a2bc3275969d456bee6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f16247f721e89c0110ed7d0428e64cfbef887c0a20a9e441be229f566f2acba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a92f89b4972e31903b462272fe4f40c4afe067662ee04bd0fc6d267e9a8b695
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f595e6ca03f04ec1a93add4795214c307c6b455af6fc5f0ea1b71b6b1c014320
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff2605c9525dbbcbc2490628551c058ba86549742e28c25a69c880b22d8528ec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba3a2e086428b75bd9cf9eeb3a8b77b376bc342f2f88dd542d27966eb668f2da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e38ec81a81cc0cecf4f47a1d997f8ffee095cd128b9a80892513dd25c617ae41
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c00372e04b9076a028b57db15fe9ee514eaa9c399d83894e5f99db4f82cebd3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c86802a859ff0546cfcaa4d06a6ca7f6c08dfe9f862bf1372ec52f53de5dae91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d7f46c8b63a202b7aa3e30820a35732024c2411f6f23a3f01910086efb6c245
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 daa1b368a9195f77ab5a9f80f2ee2324341962e399e759810ab2591e4ad97698
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9acc0667bd0fb254089de06f6b175e564acc5324cc24fbbc581ea02864ce3f4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b20197cf5186cce47c2492e3aa9142432716497b0b1adac1bf981897167fb16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d1205800b95b75b1ef95cdf6db2f39aab3b531a21267103689d0889ec0f1fa0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5784e49b3f109c1cdaafefc43aec149db71699c611c07b6310dbc8cd963c98d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42720f0139ac9155d24ce203c6632865c2da9d814be88bda69f4176bed3eb090
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 276c0fbe67b3b8dbfe8224122b0b92328f69696b41c4bf605061680d7fd40df7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dcf827e887f06439aeb59fae54e20370e6add3121daeacffdb2a9896a7337101
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e44231f8277f9ef89f280fbfe8fb6b9dba36baba1201659a84faf022f23568d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da28f1b9cdfe770e6612fca9cfdb76d164d0bf1f117daeeb96ac3f3a23c76762
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bcba7a32f7739145866a18685115ba37f71791391f1c3aa8d8f3b7cba5b7c6ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33ee79cde92f8b5d99d9e157b812e43cb0a7f5b3fcde2764eb57cb3b1b6e0816
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b6838bcd5d667df95a4af2d5dd25aabdb01383ed9b5c895cda1351f7df9aa7d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 74a0ae0b35284025a45dfbd14eada03c1f042a9d38e59e711bb9689fb1905b95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0d1b01c5b5b13835c7909cd39a3b798937b9592ac5d51f8e36ed1806e4bcd5fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d271385a6d2a3f01ebff2eec7f4040cc426ddeede87ffce01852c0811f56c036
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 706da954a448d94ec44b4b114c6f029b2398067ed989c7afd4e43023b89add6a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27cb9c3c2481999c5920d18af035024f0622b7440b7a793eccbbae640f932b84
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8244d68b37bf02386b0d3c1e6721e94936b13e158058f79dce81993525372b53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ea1783b9fe774337956f592b38a70c8a36f7b8ce8b313ad93e704836e55d3a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b19ed437ed11f467c3266ccccb9e3171608fe85ac632b2ef7eaeb2c882192c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf168173d225effee84774bd5b237ee3bb77a846b30c7612768f1ab10aed9416
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc00ba5f6bcf9753940bcee30103d23800f37e6e3cd8a541512373e72875cc4d
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\spynet\server.exe
              • Size 512KB
              • SHA256 922f95f2ef11f3483eb4c4e303d131c99f2705629dc61ccbf7faa5211f08db9d
              • MD5 SHA1 SHA512 SSDEEP

              memory/552-17-0x0000000000830000-0x0000000000831000-memory.dmp

              memory/552-52-0x0000000000070000-0x00000000004A3000-memory.dmp

              memory/552-18-0x00000000008F0000-0x00000000008F1000-memory.dmp

              memory/1896-1495-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1896-148-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3700-147-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/3700-13-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3700-3-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/3700-12-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3700-9-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/3700-7-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/3700-6-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4256-1-0x00000000754F0000-0x0000000075AA1000-memory.dmp

              memory/4256-0-0x00000000754F2000-0x00000000754F3000-memory.dmp

              memory/4256-2-0x00000000754F0000-0x0000000075AA1000-memory.dmp

              memory/4256-8-0x00000000754F0000-0x0000000075AA1000-memory.dmp