Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/07/2024, 03:53

General

  • Target
    5eee741acb7bfdf231c3fee382dcaf08_JaffaCakes118.exe
  • Size 472KB
  • Sample240720-ef13eayejg
  • SHA256 762733785510c465b3962421bd22c4f016f0f129094429e8b9628de60cf86ef0
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • kohika2010.dyndns.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3428
      • C:\Users\Admin\AppData\Local\Temp\5eee741acb7bfdf231c3fee382dcaf08_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\5eee741acb7bfdf231c3fee382dcaf08_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3472
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          PID:1176
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:728
          • C:\Users\Admin\AppData\Local\Temp\5eee741acb7bfdf231c3fee382dcaf08_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\5eee741acb7bfdf231c3fee382dcaf08_JaffaCakes118.exe"
            3⤵
            • Checks computer location settings
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:2244
            • C:\Windows\SysWOW64\spynet\server.exe
              "C:\Windows\system32\spynet\server.exe"
              4⤵
              • Executes dropped EXE
              PID:1788
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 576
                5⤵
                • Program crash
                PID:1580
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1788 -ip 1788
        1⤵
          PID:4728

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 d2a3ed8a567f4a4f57807d92ba88464abddb875176a4c90633e998a499c0fd68
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 6136df61960eaaff526efaf76f9e4ff510672aad775d2af921e7b2f5248cc829
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 617be1fe7f3a82ac392a258551861d59c2d643a7a2a0aae256800681e590e90e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7710e1f693fcb79ed1758ab89ec102c3a6d0c30ed1428414a50c373c8f4dad96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffdb42c8c34b156a8dc2ab73086cf751f793ab129022786ac6fcdc8ed58f1eab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 294b505249cb883ce9cfb86e5d4d34f459da06dab907091c4c4d5896a4f64d88
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75ab894901d6daacc559809744c74e26d6a49b05799a407ca8f55e3d52ccf34b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cbe6d7953aef1f2470479b93d1c98428311beb3e265b6adeb8072c74c900af38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d93c8aec4178975f8b81ddac48fdf693f4e096e0100dba19be0c23e87450843
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6d01000b0b7cbffe738f5c11cdf53a58beadceaa59f33b8f690b2d8b9d68704
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0c21f83aa7dcc41a7f870264284a37796ce709ac57655f5ecb4a8cf55c10459
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d33f72ccabe4f9650cff7a9c11cf25f389df7a7f8fc3ccd5efd314f404595828
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e668ee2eb401e1291b31092226e0a2a0c18c460eb29e00b6fe1d3658ef8e3b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 021c160a018c5c80bed564807e8e2cc3f7f6f5002e54aaf0014931adfb2be1f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 628de05ef82c58b6ace63812916e7b75aae722eb5c362c84f4529de7857e597c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 00321938b78dbb12fc4597e9c2d651bc78018eb34236dc0a35c42e7c24266860
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 956bb8569f39539d346602003ab91e67f5a1970d6fb2c793a29533120b73a12b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 88b70cdcb615d5dfbbcbd244fd25f2544b8ffb5c91d9c954a730dc6b7d4d4b10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98fbe8e6b33b8bbea8b0d6509ae8a108b3c2eda006512d037be4e037226c3cc8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe7c758a8929a831a6d651c1df2ec2701a19baa9fce6e52d04a7c5be56242929
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a5d0b8f1a3fa3e8c9e157f027c02c788138d81d0e2ec622da7247f398a154def
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee96be23a6c625461d3d995befbae9a9b4ae1006a19b52dad8ac5f40b6523de2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa30048b24615512a12bd902ae7a516d4af579944ed132651dc9bbf7aa6aaf0b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b054fb7c1e29b6a873d409bfa6ae0dcc5c5787ef17060d71b3712c61211da89a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38076274058e02d76552e14209b3d531f1f8e4c2ed6bfbf4b112061889bf5b81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e56587d3589603c2e62f24a2631143c4f4e8a1181cf85bff93172da769173c44
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a537b7d52b7b84713298f7439594d006a8299501edc3d4833979407f6f8ab473
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6495080d430378d8b899949a1f0a6389cb628847e38914f21a5a2cfb4d32e1ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd71abe5657074439e190997ccddda758b7cf7ed476ee518d60f5221acfeb823
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82ed16f210339a22f007a4bfbd46a1f1d277ec7b78ab7c921e7870e6b5d83519
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 038fc4bd4f2f7b58d7444a81736b40377406140c9b3a9d6fc65d81830cb9902e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83cbfa772af30ee523d5842f5bf2966efa7f38dcf5dff0f4f4e0be745b0deee1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 674c22ac88209acdb0064044e369ec7e005a5482b1ab424af9b1cb5328fda918
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65a85e11f6de942820aa2d476a343e55bce995e3ecbfc5957820d1bc851469e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f3665c9740169765971cc18e5f0e5c8316bd2008aff2ca7317944e668909416
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b20021934dc4d24b05c9e7b31a8e2ebeb38baa467287607da55bfab595f9065
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 199b8d1632fe1bd0ce881a8f04c277bc3199ee74f25f105dc603d746a1e1606f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b56f67037e161fe80f70178c1528c7580198f96ee7f3e635d676cf289d4cc9c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 363b10ebbbef45aecc85c9b9ddc9d36dc6ed3fac1501bf8add2902acc0331c95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e888a1dd0a51e843c1240c61b41060dd4cadd14a54ed2c88d7632e97ac15495
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 118ef5fa197921e7ac8eca6e27962b8524dc1ef5dca82c0f3d09c3049adf3956
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1383bf17f9a32848d36bf1c29772217c39424a94109e2afcc53a8fc0c486fe44
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7955dd1408c6f36da2b9b782c8de22a8eec3177128e4b61ed05e31efab4e7587
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 784f08b406f11e9def2ad464771f80d30123606a81f8923a7b59af42aa858eb3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ba847e9a0b206730175900a154431643205ff92d958a8771dfa7de389631107
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9d5939781373258f69da7e9f254d34c2c4ce80bf25d19e565ea00fae112e054
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30bef72d4ed3b4d32df5c5ae4a0aadfe821cc11dafaacbcacd7a6c97bef6ecb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff52073295b85e324a8f90f17f2e0fc206a98a52b68a8ebcf82954ed29ecf3fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0608e981261de79f6be3dabebaa157b3cad6d40fad1d7024fe540cf171589df6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c3b363eb50eb8ea1a04bc6a6ca5e29a0c209c71c5928c548e7a23e24d3e53d67
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2dbb8ca034a94be262b4d3c76cb106780f241013037b1376830b68bc9d56aac8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9ecccc7e3c80509d40e8f72604f38dd83f6749eea29c41a923d5c5c2bc0704b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7531ea2dbe6c3ee8be81804bf90a2e141065c70acaaf32b005444a17569eadaf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40c62a079b2f33ef70a03e704d47609fb2f7af2e220e8a5412fecba1fc3dea5c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 807682a67a3cc2bc10ec763593fc7423e034c9e0e8ca46e056419c3b023dda5c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b1a253fa66e8e9a62a7b4c73e50593c3152a7fc1aefe471d5f585ba3022d6e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db7e9c56e7801b3afeff194d7a2a5e71e970b32fc73f42133e8478b594155f9e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 03a95606f9308965a647f033404761e46b54e77f96b72f26576879a981b9f380
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2029e43aac1bac22c5ca1080e07256ffbeb9f28b48eaccfcdc316fe8153f336
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b050d39c03b9954653d4ab216287601dab0536362e6704f56e621ae371f5e0ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f73644cedf7ceaf03c3ba2b827a28ada5597080527a9b3ac1cfbe6a8a3f9afb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86cd984938ba337ecc5a9ef5520488db9c6d3d1ecb7915851a27b2317fd10e31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6dda9e2426264d79c1f0b5711407b34884b3a1ba39db6356099d7c8ce5d2c587
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 999d110ecd8335081eade08c339d93ac4b1f20924effd5ef58686120c3e48d15
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c18b6076cc08302afb9e2969ca8140275b2b064197b5f515193f61ecb0a76906
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fcf6bc2bfd306e0c81035d9f2186f005fc32cc867d107819fe150718772b1824
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef97263e34b698519f98a1ca278f8c3f5ac1f92fa4f799f6ecae3ea0dffd8614
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b621946d5e61b7a81675444a22e171cd66546c8125cf9a176b948ef24221a5b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e68a82676243e8c399a9ab7671cd1f50905f053060ca017dbc65fbb5e718e02
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5f0f8945003c77e51290e70fb8ed2f8c68e60454c9b4858a9c967f26ba5e778
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9f96f2a151614699a85e4b3bf50a9ccd4ba33614218f2b87f98c1608d1d50de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf9e01d9d4f3aff9007965316c4f747f8b7e8f1c140df7706488a3bad782c379
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7197413b49e7a673df7df6c336687898e5136df7bac6eb6c889793d74e3ed542
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57fa086c65dba94518e05cba6b6b8c4ad563d2157273f5f24ffde26f4607f82a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2ad07698b2d3c68a49e526485f8d63be75b625576a3ba6358b4ff8a5db5e237
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12a87ee547d157d1f067b95debf4c02878039906ccbc755155c1457f8a30adfc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5974dcf6b7b637236af7e40dc8a769b1771ead7549c3edafe252f72a74880461
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 378f042e25447d29aa3b4110504acc8a3304df9b43cc74ca9ee01a8dfde94e5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ec58d682e9b8e664aa27b25f1667797c8574373216267f4163c0fb4721275ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fbbac7fb611e554d78819c52ebf4a83f763e2f557b26bd2120aa4b014dc755f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70816326be555e7d16f0611a169fe9b2154bb30383b4bfe7dadba86e8fc6b780
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b35e1657df85712493739fa9feedfdb42e0f63d5f850c23bec7b84ae8fea544b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3443a3f9c61c7c05b4358e4f40f1bbde5c2927ca16bb8b80483c0177573a0ce0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c033bf63a8bc94570482a2a7d48b7cb86cb47cf5b156b3b90b2fcfad0d8190e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf5724c599212ab0f26b4cff52a4069bea73f840d05b775d138ee254db661be4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff779a6d3e76835c90bbaa6f02dd93a92ba3235625e2b982e6c020799ef5e1f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 402e6d4dfd28b910cf4e0508996a9617a90aabcd4585b82c6ce2b05365e0ffda
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9bc03da628ef0b7134b999d87de734002577225f4a6c0d252a2fa20730225061
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14d7ab31556c2274f8445a7e55751bcc69b22dec62415663ef3d82f66a5d4f09
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fbd6eb4456943c9e19d04112d983969e14b68d0798ae666692b7efa0a2fc81d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86cdbfa0ef495b2d3c40f2ce2ed3926c94088b206155e0cd4366f71f922c5719
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffdc5deca65543a8522342de0ece4d82e2d8e2cb2241f7c882665d4d37dec170
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c6a16e959a10369edfe32cbe2dfd6f8fa380892443cf4253c2ee2c7db600921
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33c93ee6f73642bd10f65721eb391bbad9c5eeaf508a109734b47b2c9558bf4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43902aaa6ce93b107f467d1a69252840631dee1107c0bc846773f975ccdd565f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c9ff004c57b33c4f81576920a7cf74b4a70dd694ae46f60d7600b1b424d7a77
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53854556a5d0ca1da4ea749db8fb5ff9b676ca304059108f30a1beff9e17f2d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c26e0a286a0ba0b675f24515e0ea671f6ce6fe575ba4d5da31d10bd0842ffe4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f835718137c8646caafc4d65d285778fbd02fcf921947448668e62685f1a1115
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 26b9662799c22e0368c0bcc26fab459eb2045ae58319ee4a7c2ff36d58d22884
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5aab8c55611579472c787cf81ed875f6263ce5d7f2a22eb46b73e48c937bb52a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afea5b7606615f66b77393c8decd73fa5e4e1e5a5e1f49fc84b69db7ecb60a1a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e8fd5a8725da52ccd096fe6df7e373553d87406c195493ea32b2c6aac00a601
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a6430b5cc45de927a6f9302d438e2a74c59efbb17bd6227f335102ce8f13e937
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f0af552118ddeca7a1f25044aebbaeb09f44ccb9a990f617417e2adcc9b9281
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 626ecd20c93629fbc3ea8345618a2c9aa5f65132ed0b883f9e8a4ed3c82421a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aefd8bd3e75e9094d2b55a9f8516b0eae86398781ddca160a4efbf45dedb76f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1859430054979240ed1abb3cf1a0146a6795bd11b0540dcbb312b6c9ef5f83b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be29c970e3027c34e28c02dc23173d650d83ba1d8d47b2b946bde419b48b986d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2be37fa23df180b4a537e4eae1c196f2b86dd2d6397e08d18cc2ebefd2345923
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6edf32b14fffa602740c2020c52fef1fc52ac5d208efbca3e52139a21af30cee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 538007e5f0a12472967b73308d11e05d80a1fece29c9259005cad329d45dbf1d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0dbe270a2080d81c3c25e2418d76e5abad07c142fbb17e5c229b8abf3e9bf080
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b90ee573c4136ef70cdbfefa3e23248627a62c133b3df2b904eb1625db1293da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7494a72debb716a6450324eaa1881b0fcd76abd265bf294f9d11053dd4ee58b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 917d2662743aa0e84d2d7e39594c823eba08294d70ce7925810e08937fbb9f0a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7bca2201cb12cea50125b7a05d58877cc570c0aeb83158f45cc8cacc3337493
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2aff53687139e0130242af40662c0644b57e9e26cc92d372060b20dd010ba828
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6bebeb9ebe8addec986e2aabfe687301c2adcf61681b13e013630630d8523643
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 546f0fd31a7b84bfddfea7d6bd943699ac590df33a9be7e3d337371d6e77959b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e136c6732cb5def0697011a34597dfea76ace98eaa492fb471ab442989ae193
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a25ebdc542f37bc6f1e6687159617776bad3ff12768ebfb705ad78dc4160f957
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d974dc44a452875a96296f205049bcacce7697d808f60d8714130524dbe3c61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ccaed95264b450d03815b743dc49ad279a0db961c70a61e38ef7ada3025a246e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a83c2fe8cef5e65a4bd96918e291e54729d39f0bcdf12cbe59b59d24e82c9eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df9f8f8318f325722bcc8de9dfb7e2fbdcc21be595b14e9278a330085bd89d27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43f3a9bc459e784fbc1a125bacc25202bdfa593647d8259582b4198f3bef7aa0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5dc4279870d3998ab1a373bac9339592c7fe40d79384b5c948360046979416ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5deae131ea435133ed98b2a607057ae247dc0b44f1b966aa133bfcde8db51e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 62f75148f971c56be64ffde7ae949811010d0ca1d2a913ef7dba27d5a44045e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 99d9783126cdc70c006f13997fcd5bbec97d9236d781cdc4edc1ae58b3ecc19b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d2fafb3eaeda1c92d5b7f8f58834b057ab69479e35ba80ed46ebdae1502f7797
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a73af86a1b5f06cfb8865c0b649e96384af5e130a88e4dbf394d18cf0d7c361a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b51a132f3e31e6423c3c518bac05477f5f9c464df6d024a2a4739cb18a4a1bb9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9355a6d35ab064c70b54e71039db955e63f99fdb0189098176b10300b31c6add
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f3e88dbc709c92ee8c4bcc189fff08fea695acedf0bfa9d267edcfaeedcc78a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b544528c3623d8a5d45008d447883a2628e990b51747c8841cced5cd6f047023
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c56afc51d23a30d52e8da4a3e9d424b148ce61052f263796a5d0eccbdccf9397
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9bfb07a7e51c93086121f74caf1be3e7ef05232bf45fd5e38b359698c12bd60a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85a16da2d3b930adc3b893078cb9a5c970a45a42ff4572a4d530bcd8b07c1666
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\spynet\server.exe
              • Size 472KB
              • SHA256 762733785510c465b3962421bd22c4f016f0f129094429e8b9628de60cf86ef0
              • MD5 SHA1 SHA512 SSDEEP

              memory/1176-8-0x0000000001200000-0x0000000001201000-memory.dmp

              memory/1176-379-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1176-9-0x00000000012C0000-0x00000000012C1000-memory.dmp

              memory/1176-67-0x0000000003DB0000-0x0000000003DB1000-memory.dmp

              memory/1176-69-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1788-164-0x0000000000400000-0x0000000000476000-memory.dmp

              memory/2244-81-0x0000000000400000-0x0000000000476000-memory.dmp

              memory/2244-140-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/2244-1287-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3472-0-0x0000000000400000-0x0000000000476000-memory.dmp

              memory/3472-3-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3472-64-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3472-141-0x0000000000400000-0x0000000000476000-memory.dmp