Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 09:09

General

  • Target
    736b9fd57799e513416c2d8091062a39_JaffaCakes118.exe
  • Size 397KB
  • Sample240726-k4tk5aycnm
  • SHA256 9b8c7daae6499566fc186efc093e7e37af3518d36235257fd3ebd8be84d9b659
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • landdjoskull.zapto.org:3460

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    plus

  • install_file

    AmxPlus.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Extracted

Family
  • latentbot

C2
  • landdjoskull.zapto.org

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\736b9fd57799e513416c2d8091062a39_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\736b9fd57799e513416c2d8091062a39_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2356
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:1464
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:2332
          • C:\Users\Admin\AppData\Local\Temp\736b9fd57799e513416c2d8091062a39_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\736b9fd57799e513416c2d8091062a39_JaffaCakes118.exe"
            3⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1220
            • C:\Windows\plus\AmxPlus.exe
              "C:\Windows\plus\AmxPlus.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1580

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 e981eadc284a9652c6fd4bf33237697a4bd6423e1309382a69c51acc16312010
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2843dd192630af6f1c7279ba929f4fd0a7f15e39c873d45462b9c9a2e67e163a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2885d7a83852546e17a5ac400ad4e94c2f8f0ff175cbd931402956b65ede254c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d73eebf9994d447a2efcad4664e1a98abdc1e35daad75fc73ba4aec4cca4630a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4357ea31a03d9915e3b4059d1ec596c9a53e63c23fb9000f72a9f240bcf7f675
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 244c917699043edf375b9256336ac9b47d04c4a96eec0e577942e572b860d84c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd49ddde2b9fe65a37c7d4d3f84717688d3e59527feb3659192a747a3ae45f0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9a9401cd70a16202303bc2e14d500e765c591fee8bfb49beb98199b8274664d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1835c4d6e0a3e38739ab24e7bcf448b55072e5a9cd7c6fa174af5b145e70c4c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81aba5ea385f860cd924616269664bb81076e113d28ade42cc099f35f786c9a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75cf249d036048c60f8ea08a7f63a366f6d412e79b0f8e55a4c3fa353d2d5a0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f82dd7cf3cdb76e11eec73476c8c6c5177ef1a8c9d43aec9ed4ac2be197006ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0eb19adfa016a9cc0558c9080c961dcb5bfa0ceeb1e643a776ed6c904e141ca5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fd973088c19265fc57adce6d8d95dd9c4274d41f2096d9c46ac72dceb03f36a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd0741e5431549fc22d785b6a7a1a3facd82374063340fd68b41a1b59a122ca9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8bb9c8f1d949ae40888dab971b8d9c6390cd1e43ca3e1eeba99085b3af584db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a09aeca834fb4b54718ba4486ff9769909ae1b98ae55c6534bf0c97b7eecb43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 447255f5029f22d015bd4dcb1768e5f601a07355da18b7cfb539ab8c7c28a972
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce47a68311bf21cb48cce61c9ed5dcc8e2a7d56b6aaf8cdc27af150f28c9bcc7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e44c9429867b1fce7a0f380f4b5eff893881a991395de14028173daccd889739
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd44d6f62177298e503c28122fcff79fd9971600814c336bec49c8b0110933db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1403b833b693cb27bd537d4bb10f0822cd5e1cd01b04fe0ec9e08562644e774a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7e6d2a61338a5822931af30509e6ce4a9c982452998fba0c91416e26d0bfec5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94e520b177ecb0478783ff68f8269c5557183290fa5bd1a999bd0810d0de71f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1232a2d7c8e0016c60eb88d41c9d7b2f404e4b03746bc5fb621913e8202bd669
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a6abd426bad3e936cfbc9b39ee8b8ebdd5426fd3078873032ee01b24692b663
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e302de5bb1feb8c91c2da15d2f39d555927d3afa17ddf297afe840ba616cd6d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9a33141aae618963d2922a07849222fe956536dff6f9ae38a21caec326f51b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39cbc341bd030f02d1ff98386c0bdbbcfb07adf3fa7d329dcb28ff79b83135cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 442ae4712ce3b92f95816038da4b1eb109668dbdf968b2c9311c409db92c9f2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af087dbc1a3b3d94d90e0b7e99d4ca3436a7ff4cf10fdd064adcf193542b6f7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0f02199cc3c04f96453bd95d11b4a65505369287542ea321855c6e3a3d4a52b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02c6868be02467f48aa3f179df916f92fd860919adfa4a0628b1c6a093c9ef0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 619e2555818d2899cffd3009011be71c90f41213e06414831f5ce217a3635852
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abd4d07d98a78115cc570d6e643066dbeedba1806e8bdd0fa41e8fe2b36257d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd0005ab6bde2c8ecec417f83192c9e238519ac822db4fbc96d8f99cbf5f1fce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f4822477a201ea9c26c15d28e30ced06ba10650f8e2f299dda025921ec434c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4dff10558f790a4c5617e163d28645a9b6149b374a9791b57271b444ae5913b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9758e1969186527aa0f83399ef1469a6f4cf4db15e01904d9330d87eb790652c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd519089a799eb49dfcb465eb41ecca26367629c2f0997ee2ce7659a098231ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c85e427195582008e3dbb02f97bf1b1c3a3fff31b87009af89acf3d8a4779fce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23fa963b46e6caeb0e1e2f93295dd3c94e1ff744a7902a2d0fcec8440ca9c2a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cfff0848606962fd1a807ebe058dff73ed45450b29906d11686f58935f6f78b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a2ea623677f69edc89df30dbcd5250e9f43de82a35f7fd46bc3c1da711dc037
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 563bb63a4c78e14c9c9aae0e4e5f5dc5336ce726853b9d33440fb2cc34925249
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1c34263043f915537f468ee53aa600bbbc1bcaa36b30a324bcd32c41ec569c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1a86e04d56bbb0c9d519e8ec704b2e300f702b54b2b55f240ec931702ccddb0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 938084a61280b2ab6634469a7bfffddee2801b008b761ec4f9a794c3a6201dc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eba323a8103619eaa4f19ac2d404a25ed3c81ea44825d982e35b5aab8e3cb5ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 767610920f3c4938d6438800e4483c711012013280e6d5ce265675544ea3ee63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b62b726b5601ad657776f2fe33f9aa582a3f1a35accfb5bcb168c4d410bbd23a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bcbb0de59651eac331576003b81b52d16966d0939d45ec7c76ddf4e220278b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29a80f05487840264240ee3edf6af22032afd2b3f717a1d18e7630c10cbe10eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c11c68e5a4c633aa2459099128928e6c194998073d8accff6fc261899e399be4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1da3701c055950b27381ccc098d72d5496f3d6225b8443edca8f4e5e61d6955c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c967cbe7467c201d6828dbd8a9e0e3c4e61eec0a6b86734ace96e45675832432
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af7d88d8b55f4893bad03b45832e33f59cd305536de1f228060df8b5c7fe68b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad7b002dbd13f53a891b14fa369ee9f9ed6de8dced631cb2733e4d67bdd0faf0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 589c64e5363472d48b71a49cfc245d0ca7d8bd2586da1c2deabdcbb5cc7cdb6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4bbd2a9232b80067b58bfd668fc58d14162735e7885d63b35908c91dcf409a87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db5c24acbe4b22b0b658bb8348fe541349ea28203fa7a0881d9e0da0d7888927
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e218bd97dd8f6bda3710f359a7012abf26f3dfab8cf95325e510884d91804e85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae7de089da955b682dc2ee96b5c816f2a291e1ade0fceba4ef8d22617bbe0de0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 094dcbca81c433aca86e116b29b5c98d4589f88449041504ed132eaba0189902
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eadcaa2f56540fa08c22003bf353a6012edb735ef02491fd5b7c9fac9e660939
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 376d3632c87667135feea131ab65723188fbcfaa2b01f4082853320dfcde9910
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f7f45852266443081f91119929bf3149e076f52aa7af02216e06ec475f073a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d14529fbe7e51823af925c7ea62bdbc2990bce1d6af69d32760bb98935a33f0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee65dad899468a51df94163660645e217e6b9ecf75bb6189a5c16f69b65f6b58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c8a43f85733e846ccde9c5d6024c946cffd15fc87e19570c9521a739efe14e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a9157c024a583ce1f3b2d421bd69e5f4fc86a5d2fb1b25205bcc17b05d26aa8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 586ad154929e02e36030dbb35da1415928d880e5af17ce0a02796a842883a328
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1df5f405e960f219a8f948f7ff32eda3de190b610c2cd29852e889a0b49c5d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a949786b41439a5e00703ac74e80f6282e9344c6be528fafcf6a9f3804455cfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3115c2b0e11c15c4e1242d1e6fa22b3e2f3dbab320ab13893755e980465b0be6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87732ea07336ded9426249c0c9fa3d6385a184e8b7bd95d71721867aa7b48a0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6e2fcd4c2b7fd68ba0fd10fd9dc51d7e859643c2dd50886becbb502541bbc48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 689206fee1929fd3ad224eeb2efbd1f324df125b11e5802fd9507430ed566d37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b3c462b5a4797d66748ce79bfcf6e2de1f215fdf36a136bf211f367f061f3e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dad8f78ca39e56f9bdabbe58801238d56d2859d8ceeff01b2e7bb0880141d704
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92955dc9e4bddaded0a1d65506a33481d7a06b9b5301d4d840d97e7074501986
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3eb2ea93e6cd87997cf91e64a69e237cf5ce6a817047cb2fce0d39ffffc7283f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf8ce7e1a0151e46e80e12e2eac9eff7707705f2d3c695e8bb4c112e461a1ac6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3731c7ebb505f8fd47022da75a3262ab5f4200584f08a4b7beb5d993ded7dbfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc5d6720b59d489a4514ba22374025536c53cc994f95562401db4d7b731fa2b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0443cdf5e34422637222e7d53258d5de6d086a73b6a0d098d3001a4f6e0328c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e6d8946b706fd081d9a241688b756de203fe5369443df9f96990d6347e809ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a2adb61569950ebcd6ef442224604805ee77f76e0aa6bbf63dfb24b8524f4f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbf2a2b3c26d1078950ac476c4037add258944289aee137f00da359a366a1d6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94ca771f67ddd09396fe125e67912fb6991258e55286bfc71daa16d8f556cf72
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5c4383ecb0881789d84790d41b12d0244263f8314e6da84a3dc4ce017a5978b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8544a115796e6288433e5ba7e3f509423dcec7c71b035a8c300c105b2e769943
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5377800d2ccd9c86eb95ba1545ac55516cb55df5a028544657ce87d125bf0b9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 624778bb6cfa4bab301b2b0ad99b75984051e8d3d09bf87ab3aab5904aa0b2a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 814c92b2cf8ec12f5be4da752cce1d284030da3ef1fd04382e7b2707e1b9cfdf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1af16ee0bcb7e6da2f37b6a2c53f056cbb7fdbb59404e6d4769c30efd1111afa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f60b7b83f2a0498170189681449b58335452f42a82d0fdcfb565288b45607cb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 013a346b63aeeff1d18c0fd5061e48fa4b03bcd17616aabe86b97baa2e21f74d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 737560a4776c458c484ec22990dfc9a6595ea41e4c9ccc7e0f00320182c3bc86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 869c2aeaf165558c006595f0a659779791be4081a6a81f3de84dd7ba9316394a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83ff2503efea2cc957da3edcf7cc6f3d9413e643ec5fbfaf7bc8df5a1b45f072
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 800db4fd23273f1511c8f3ad068b727e0197465b759fccadad022229308c9161
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa6d4fc79992bf6602a0841be0b7c999d423592068537d9e20633a507f8577e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b23fe3374afad1e77e6ea98c9fca1e35837b1e1ac3f9e316436a6e393e64054
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adb068b14f87973caa9bf298b31d716858991e8eaae5b664bcd12ec3b8516da0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48ab3e44470224408d8ba2efc5824042aabf5c43251a62e88c81a56e8441b455
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a13407a6dc83eb0d5800728a2324f7d8944e519d2dd6388571fcef67a5b7b098
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 942442c8483ed089d5c3dfac189292f3f0fa2c6d56d4034867871ac18cf90136
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5530773eb3fc7c8c714ccc8ff763b6ea0990e05f07882344926facc1e47e88aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed543d6c1ec09b29207e23f180b477a754315bb47cbcea16df20b119e7d77266
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b5ea50ef1f56d467e9f5374c60c4cbfbb06d393f04247c6c5b8aa84473859bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92bf216721ce97ad9bd00e13d430601ed2760265139f2e310e030a56eb765f92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28aab49b821f74456ca59702b269116f76020183fd74d5cce81aaa916b4a88cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 921fe04503d63c106f7da06b5b33ba7297595c42795827a32d67a7fc426912c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0677a35e94ecd3de7d00bea8e2cf2ff510f4f237bc9c53fa8334df26a881adfc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa259b379ec17f1f7ebc727149dc3268ccd25e7765f1e7cd932abb6c335b5d3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe32cc92e4134302aa6715967727215c744f4639def98fe9721729822508adb9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1cef24b2fd3de10277165aca40d01889a77b7ecebbc9a007260b874ab8cd4f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 656394ab7c1b686804497c19e56689cf1b4990b931e8c565b553392401be1896
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d47f58d414152b819a2e4d72ebdf366929d9fbf31552333a2bfbccdcb8cc28db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa8758ede656076f07d3e898161ae9bcb618e53382b7ebdc3250c69d08a872ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e73bdb442a1c92e337f1f05076dc2bc4768c73cb4b8d1de6bf3caad19a0b44d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f16fe49bc5a1cf8bc692e1a83c0a87f9f86d0e5bb696ef39d09d997126a5977
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40166405e8ef3e3c4473524bd4d28933d208aed4022950fbe5397eb8f3982ff2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1797ed256c89a3c417c0bc68f24fc2750da26d101c06faf49fd42a5b55da374
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d46c09e85d8401691aca6e610aeec5b5b9f0a4471b26923eee093f983822c398
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ffde2c8b8ed9bcfd6a6c8c1ab48a2f14a0c466a38e7bbef0d73767d3b0c89bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b3439513f9a5c75109c6d93b1887d17c0a5b071713d9cf78ff598e60077cc57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e2c3eb3983367f9ce9b1d8b270cff543c0bee4c7b273d2bbf71f27121cf2964
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f172e6d6bbd35664da9997762939fefcc4a22f142b3ae698d03ab3ed14b43df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a7c734d2f08eb32864273e0064b365a5f6903b11c2366c6b8d30ebcf20d8040
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8066c686b3b0f302e39c5cf59756716e0ac72aad8b9c0f80fa2c2773c806d86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9d09565e7b7e766d443622a20fad8bde5bb314a98e05c158b6352e299534f92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59853edbc416e1460456d90a2151ad715b100b8fcc4a1a2a88218ee97363932a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebee44071325d7f8e3988d7687e10007813d81676150e4351027d9c0f7cf954d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94de9a1ccb02864ab29c59318f84b570b4f41f1eb517815c0ffcfe107331d5e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8133d4748d1f4df99a061020f31bb5010e03803214e112927313a77f4e88b84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6aa46992cb5f4a73c10f12c58ea67fb63d870ca1bce65b8c2f056b347fa2a350
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fec5a4b8e7704bb0164e69ebc7cb65106ddc0e7a813d2e1447890dbacdeb94f
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            AmxPlus.exe

            • Path C:\Windows\plus\AmxPlus.exe
            • Size 397KB
            • SHA256 9b8c7daae6499566fc186efc093e7e37af3518d36235257fd3ebd8be84d9b659
            • MD5 SHA1 SHA512 SSDEEP

            memory/1196-11-0x00000000025A0000-0x00000000025A1000-memory.dmp

            memory/1220-921-0x00000000053F0000-0x0000000005449000-memory.dmp

            memory/1220-922-0x00000000053F0000-0x0000000005449000-memory.dmp

            memory/1220-607-0x0000000000400000-0x0000000000459000-memory.dmp

            memory/1220-1775-0x00000000053F0000-0x0000000005449000-memory.dmp

            memory/1464-563-0x0000000076560000-0x0000000076670000-memory.dmp

            memory/1464-328-0x0000000076560000-0x0000000076670000-memory.dmp

            memory/1464-329-0x0000000076560000-0x0000000076670000-memory.dmp

            memory/1464-327-0x0000000076560000-0x0000000076670000-memory.dmp

            memory/1464-326-0x0000000076560000-0x0000000076670000-memory.dmp

            memory/1464-1221-0x0000000076560000-0x0000000076670000-memory.dmp

            memory/1464-1091-0x0000000076560000-0x0000000076670000-memory.dmp

            memory/1464-930-0x0000000076560000-0x0000000076670000-memory.dmp

            memory/1464-927-0x0000000076560000-0x0000000076670000-memory.dmp

            memory/1580-925-0x0000000000400000-0x0000000000459000-memory.dmp

            memory/1580-923-0x0000000000400000-0x0000000000459000-memory.dmp

            memory/2356-7-0x0000000002050000-0x0000000002060000-memory.dmp

            memory/2356-209-0x0000000077141000-0x0000000077142000-memory.dmp

            memory/2356-562-0x0000000000400000-0x0000000000459000-memory.dmp

            memory/2356-246-0x0000000076579000-0x000000007657A000-memory.dmp

            memory/2356-896-0x0000000000400000-0x0000000000459000-memory.dmp

            memory/2356-895-0x0000000000270000-0x00000000002A9000-memory.dmp

            memory/2356-229-0x0000000001DE0000-0x0000000001DF0000-memory.dmp

            memory/2356-6-0x0000000001DE0000-0x0000000001DF0000-memory.dmp

            memory/2356-10-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2356-5-0x000000007713F000-0x0000000077140000-memory.dmp

            memory/2356-4-0x0000000077140000-0x0000000077141000-memory.dmp

            memory/2356-3-0x0000000001E00000-0x0000000001E10000-memory.dmp

            memory/2356-2-0x0000000000270000-0x00000000002A9000-memory.dmp

            memory/2356-1-0x00000000001B0000-0x00000000001B4000-memory.dmp

            memory/2356-0-0x0000000000400000-0x0000000000459000-memory.dmp