Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 01:40

General

  • Target
    65a679ce06dde050e321766e843749a4_JaffaCakes118.exe
  • Size 464KB
  • Sample240723-b3mxhszfra
  • SHA256 0698ba2009234f12c12d065d257a7c31288b70ff5e5d183ecf02a06be4a5f995
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3356
      • C:\Users\Admin\AppData\Local\Temp\65a679ce06dde050e321766e843749a4_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\65a679ce06dde050e321766e843749a4_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2940
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          PID:5100
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:1884
          • C:\Users\Admin\AppData\Local\Temp\65a679ce06dde050e321766e843749a4_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\65a679ce06dde050e321766e843749a4_JaffaCakes118.exe"
            3⤵
            • Checks computer location settings
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3980
            • C:\Windows\SysWOW64\spynet\server.exe
              "C:\Windows\system32\spynet\server.exe"
              4⤵
              • Executes dropped EXE
              PID:3912
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 576
                5⤵
                • Program crash
                PID:3712
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3912 -ip 3912
        1⤵
          PID:4488

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 dd3c59475c67f19fe2fcd43b385b762285191d13e963e64abeb84804cc4b55af
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 edc260d989cebb7798b02fb7a143d8138baed349588b7357144c60684f80e43d
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 68017726571e9bcc86dfd3b4a951afec3adb89844743027eff9980d0ec65bc7d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ecba9b57b6e398fde871a027bfc6e540944f629293ccfe809451122925155a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ecc9111b61bf74db929b56006f285bfb507cf5a2524e7667a377141b996aaaf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed15323189d270bbd1d32a248bee5c1e8751974110c8bd5795867e7db4183390
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7200929f71aa59b2232529685dc22d8dc58ca8cc3bc4cf0783696f229cfb1c98
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 caf29eb68bcbc2966284755c897a7e937f35e3b8301c84ab5a48c5bab7fa79c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69cd11d71f5b1995393afc88f28a0112ecc5bc6bffa4148d63bbd323a621cad7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4b14cedb4480fa719941fdcc781c997ae22b127c8e224d60ce9a04eb3d0f9f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a5940fc05812ffd940e670b1d21378048008603527c89d1e00e5331700dd4ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d064831c740c81f4c323d79d80a29f19ddd04b062c17b71a78e507eef11c93a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cca181c9291e4a48e8c05a5a4c4dae012a6aa7a2445bd3183b4eb74eb097ecb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cb6a259482f38d54ef6e003bc82907df73c07551f380f993d2eadb51195bb7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c29901439565a80fd56e22d17b9dffa81ff26ac1263ddf891225b9821eba15fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 749c824eb671be8ad13da1fdbce26c5bfd0fcdc586ab6f89d7b7b45957a0a15c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16081979e981b6a04d740a793de7f526b31adb0507cbc3168661514091635755
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 847d94b564a4cd6ac681f8babfd6269a6dbbaf9067aeaadce1d236f4a96cbc27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 322764cfaee4379f6104f848f52d7d0b69fe8414d7b4a291335aad3867e2f708
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e872aefeaea82eeb249d54b67753f28777939e2b1186f0ad6f12b875eb347476
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 96007c99638ab68cc6f05fb9ecec06d47c0e2b9730f09211341e195b813857e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe9a3da466db8b7a064695c71b664f42f94146b6699ccb7544605897c3b704ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d061ade254977e4a985d950a143d11a17212ffcf81095c1117cda219bdb2fde
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38c6ef443a7499111fa62a53fc77c434c4f9c2ea96a23ef28db3435245c84306
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 90da7a220c29512a1b550383736b74356af0c81c05781235f7c57d23b88db789
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ebf1023169a5ec2e456622982ae30788a9853645caf75795783c43a5787cab6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c17fb143c335bae0780c3a8e6fb77dfd14a05685c7d50f792ccda0d43565fc29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8dfb21721be2001cd02566ac4973f5eeccefefff7b35d48e43b12ec327e7c49d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 191101a9e76ab702bf25d068c6f4ead6124a05b28824d19dd4b1fafbdcd66fb2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 120ea189aa6512681259818b9f4dd37cbf59c643aaa305653db0df222ec5c85c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a3b37fe3dc714c130fd335c0bb7ef298b9107b49c1840d521dc84e80b1bd1fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f0bdb79acbbaf31bca887b7ef95c38582dd66b0c70073aa7c86962d4f01eae6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d0c74d0350e78584b4286c6cc925ce44b2e23b4ad351060c6d95b0097b434c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94a8d08e60473242ab25fb23829286bde26bd8cb60393c297276e473cae47bfa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe556a1b324bc01eb91d70f6c54bfef590e5af539e15c30e46b93ba4ae95ed95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c652b9c8e27667921582b46a3510b5e18694132f143a4d50867b378d4e68da4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5e3dc0f14e3744adfcf497c1e4832baf86234d79dfb40f9ad30daf2bb5cb1ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9e9935b721fdbb42971f208f741dc4a739b2cd9c3d59b840a9ddc7ecf8dbd11
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a63830c2bea2a9e82887e88961c93d67c5529a8b5451c5b7b5064c2c0e61fe4e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1069b8dd2b17062cb2e65d34fe3c73ba414b7931d0fd184a12f26ed5d4783ca5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7c73c1cffa12d39a0dc647d4e7acc20bb78f79dc74ec4f8d3bcda5b9f12cf72
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bcfa45cd265046eba89847feafd68af454016310f09c7cbd97ba1f0a5cd8e9a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a9f07a4b0b0d2fdc57ba811ce5ab2f2f55e4862004f86d5d651badbc4b1c551
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f61b0e32da7fa7f1334862d363540d42488de7ceb18239cc6785dbf0d646150
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09b74adaa5712632b6972468b351ab5d673f2888005496cf33497b962774dc91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f29a764243900ab867c76bb49e4ce24824ce63892bbb6fe32535ffa6a4f1d664
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46693773e4213b218d501ca3288fdc75a4a4550c40c7cc85019d4c2e7fd660cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e0bd0e961c30c4f9aa527acf177b97e67942dd24460ba4e17e5bec8cd265cca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17242da0a05df87f45793792cc8cbe6e51115256594f28605c57fed48aae0178
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56cfe2c3e8e8b280e6f077cb92f047dd7712be4fbe92624e0c1f63a0a78fd73d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 900eadf4082ad8863a47b011de371aa3d4634b88552f26df540f3b4c0bd8bbb5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5933097b2cad822fad783833926a1db2442701e1d028e610e905a18a409befc4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c5854e85d4f1b7261a1de6eada58f1a407ed21865de1913f9d239b44cbf2c30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be8f82d0c07fc76f6589e3f0956710c57b0ef66e41830fab2a5800fe1f2cf4bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7d78469e416f6a9f992bba8cb54ee09b438a07d2fcfc0a796fd17118b2f2dff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0480852ab2cecf448409e1b189d15ceb5a1e0e17233821117dc69f37d5c1f1ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13a20082530ee127d8507bf3a4c919ef23cd103e542fef7af5e366d7115502e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e3436049e8d6f18b30fb6605f2a8a7bc841bb734a5cc33c135e44214a213bfd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 392238dae6b62afd2064cafb9bb3f6eeb826cca09f78f7cb2dccd283dd184d24
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b13fe2bbede0262c77db7f75d58efd40f92ad33287f9121c12143a7d51b7e5d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb1649b855d3cd43e45681a8eecd7e9627d63eb6ab46f89b4ecae5334c312eb8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 690363e23e2147ac8e6d635f3c3e1148c24df0cacd9697014c9d8b0b0a73a0b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ebd3633987c99a1fb6f238ae35f3eb17e33da1b5b174f78514c8d261f880a63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 176a543a87e935cfa2b51c11391573fefd0aac421b21d72a8aa27e095c7474f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d838536a675209351c7426c3c3f1e75448805f95a2f44f22fa39fcbd37fec453
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dce9130f5c16e773b4f1a0bf1129c5ba466c5315d0d9257b7a8402c2edfdd578
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8550fb24ec1d188a0e7ec089b1902dca00d1933076e709dd29e2a2032c782dba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 132ee5747f698beec7e8e1cb6f72cba15f101df89fb1268a06537b5eb4f53e03
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2c08d1fe440066f87810e00385d4123665c3f02ce10e7ab95e09e1d555cd41a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af8c6936617cf6be00b3a2e02f7caee68fb85b986825ab631cdeba79a9fa900c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5d52f9b84309212e18424f60ee3e4b28b7d4c2ffde6e7bdff083473d446ca19
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c5c891ecd4f08e50651473ebbf4a69c3f3e6b5f4717870db04b77d0181a9acc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9fe1b268c83b517e2daec2c0d106d7b10a65ca98a511bb4c682adbbd43ea7bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f352be2af45b384e1a65180dba13055a162b2c847d8e0d88086ebcc3178181d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c0ce01e090e922f0366b177423b22f17a151a4d48ea9fc95a3ef12d1672b8a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7fcc6f7aeceb92450dd2b41b36dc231dbeafab8efcb9ff99ca6f89afd88169c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d1e7b90dd03575ea2ae9039cc2acc84f84ac186177fc2b3123e0f359ba68edd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 61da3c45e6604929338c49786b74db76afbcbd250004e7756489b0b648285bc4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cfc32aed8044166c5be216a2ae1f56c810f3be60f9fba324613ff7448762c800
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5740c156fc81fc812fdd49f7f4372c6f433f70bf5f7ce2a7cd89895a54f9d09
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 76d9543ab6ea40a9fac79a6eae6669e038753c2532ec1f75342fa2b692a88276
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 205c9ed9a1d4606ea8f48f9ce5e82c4872162b5e0cec4af2c14aa7cb02c300f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5b3d5d9b846da50329066124608ef1863017a77c79272700e2a5d0c84d3cdd0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b754d4098184cebb73412ebb0cf79df00b13fa1171ed70f007ae165fdee4b6fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78b26e2ea74b15ffd820e56cdb945c0d4674e43b5d450797eb56e11eafef4f23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 227a8847f845889aec01cb0a2946af14bc1a546d57cff086eab2633a468c453f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 15fc4edccb7d9f0eaab4b5c0e22b655f897a61b38b6e2c97f9143d27ac33de71
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e13563e8f40c5b1b627f735ac2acfd7ee4f46aa398f4b743156637e1d2e9ae6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ae055bfe19525ae9eb6f5dfbecd76a2810130208f1e0480a5a2a499a044024f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 68605ecab072f01dae53fc9a6cefa2575f16614bc2274735d06eaa31886ef907
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ef04915a9814453b634918787bdfe7115686bfdca2754a009d7523f695789ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1a7fe550a272c8e5dc9f20ec4191bc0d4faa41b0af0426fb7e4836a9145c557
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f78a283271ac0113047608eb971fff41f3ec3941f2af52ee7d570dac0fb07b8e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b9511df47d14dffc880312ffc1995d7d56644e358864373a803c988290bb5b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30cd3ddf54fd0a49b24ff4855118c874a31d8213b7b7c586d7171183e63ba464
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 18b13a912012aca6fd7f15052dfa141417645fac7b019a1be3259071ade7205d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ad2c495f21ebe3a8c93f906b3006976bcfc4cb390aec86be2c86c9c621d5fb6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d2c5458253ab1ef361230aff45cea393273c65bd286a4d214f93fdc587592344
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5774b80419c70ffe6facccce2c34e5793e465dd5a11e52a9d940efa1ece525e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86678f11826bf1c04e3d71e120afe6c75d892453e203916b74e711b21c0ef7a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 248749d936f76963cca09f7b25af81f6f0b6f91aef9ef29948dea775422a0284
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 519d823e537eef99aa23d366bdb2b808ef22c8ea6564ce9851971e4fb54e4191
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 766e9e8401d31a02c6bbfe8a18f98da37754f9150a697d2d6127b71b0ee1a984
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34ddf80a87c29ac9ce8c1474c5771b52b3813bd4e0e450ead49da33fc38b68a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8c20c602d8b1bb36f037da905da0649c3884e11aefcefecb614dbb39b01f5e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 faf0c2724ecd9fce9f01dacd809b53ace4223671b9bd767526a672b9d52fe42a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7d13963217c56838d12f9c3172dcaedfae2b235e630c84971565e590d55f9d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 45bfb21cded3b8e8f44b398991ca292cce9613bbaefe9ec8657f1377ccd62ca2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55273c50114281123350452a4738324893e7cb89cdaf9df75089928f018935ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 741c4b5ed1314f86518797661f6e836ff768205c802e74ca8f46d6aec3654c56
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2e444a947e28f7d1805262ef982c1bbe80b3d04136d22e806ee1b4d0d05f4790
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1775173a5ac0a90a38dbd25ea3ec429c2647c7c8644f00a1cde504dbdefc5964
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7aafadd55d91db0629eeafc4bb89502a6250de704bc01e3d41310acefcbd164
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eeeda6419879616e3b83b224b708330f5e3d0c2436bd874d0d2c39c714190bf3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 343d9ef295aa5255feecad772de786d5b2c44d45a79510d8c3a67dbdfc9b9ef3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd111b493f3acdeff6d038584d10c2e7e692279cee6582ffcfa0c134ae973e25
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 438fccde934c86e945a16df62572c007b668490dbd4c2a8886d0613390c1b7fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e58501f711c54dfedbcf2a07434996740f6eee0f272ee2980ce23a3d75877c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7cdfd49eb2657973d83578761502d3988608b2385511ec9e93b1e75374591957
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2da885ac442cf1d1f1a04d889d609e75f3c05075d88cfffe9d9e41ad556910b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb1b49a0fcb9cae5f083b2e245ddfe358bcb672b8aee96cef068005fa3ff3da5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f20ba9ed1add1fbf5a255af4908bc5c26d96e314b162dad0bef784c1825d3da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb182d339dde377d19fe5ee27149961caf972b4480ea681f0a26273f520bb06d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94ff4f0ec1f4c61789caa83e1789df3d0297afae104929f7c15f054c9d9b815f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 353eeeb349e8546a86177f18fc0b9e93f17e11bbd8327a3967f3a5a1839dd802
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 422f59fa39a13c3397b2182590e0fdb3ee02248b9244c2ce92371358858b2fc3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59fd52dc6510fc810a39ee6d4562ccfae3d6d9eb6b15ac5a3fe61d0c7495f947
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b40416750987430ca3d72279329eb9791896417d89a8b3aa4fda35852d4d7232
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b54961de445e211a86275314a02399c9245df5aaf67340bea0b334a27d4a93d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7f261d7713060d50b47e0a4e307bf810972e3cd58cb5edbc8c3065aff710661
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2daf8b369ba94ee5549daac51f7d5a951447db55a0f8396d295f7ca1292895a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea7b471e4a66e657364aeddcd595921babfdb1a34cad18839be7fd519c68b718
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1425e64f824863a1c6ae8d6f4cbe33d64f7b3d90381604e3b051221576b44c78
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e94df610526234225156481746c94351e3ee757ee8a4a37df28d003e32ab84e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 49f97ae8cee5cc5056d755f13097223eb406ce8e6a8deed52f62857f1138e6be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0bd80ad168db616ffc1cff4f7e0dc6b7c6e11362187e8ac1ee94d1c5462cab29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14ab9fad1da4d6754314700e6fb666e8b08d0affe4c1cbf875eb42f3bd985667
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 798593a3b3a2956dd16c1aad965067ce1c490a57c61cc7edb5eac87b819cba25
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5bae9aff8fdf6c1332580b3cb01447e2841d5f310601882834f7d13c78167b2c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 932cf8a8c9060a98c55caf29f2d3dff263c2dfff016514dfdfd8a03d2c1173f4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee69e5df1d9e86a72c9f4ea601acc69c287ea742ec79811f6fed5ac4958c8760
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\spynet\server.exe
              • Size 464KB
              • SHA256 0698ba2009234f12c12d065d257a7c31288b70ff5e5d183ecf02a06be4a5f995
              • MD5 SHA1 SHA512 SSDEEP

              memory/2940-64-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2940-7-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2940-140-0x0000000000400000-0x0000000000474000-memory.dmp

              memory/2940-5-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2940-0-0x0000000000400000-0x0000000000474000-memory.dmp

              memory/3912-164-0x0000000000400000-0x0000000000474000-memory.dmp

              memory/3980-1341-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3980-82-0x0000000000400000-0x0000000000474000-memory.dmp

              memory/3980-141-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/5100-69-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/5100-67-0x0000000003630000-0x0000000003631000-memory.dmp

              memory/5100-8-0x0000000000640000-0x0000000000641000-memory.dmp

              memory/5100-9-0x0000000000700000-0x0000000000701000-memory.dmp

              memory/5100-652-0x0000000024080000-0x00000000240E2000-memory.dmp