Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 04:48

General

  • Target
    a9a546ba0b01f4eb0e2746d72884defa_JaffaCakes118.exe
  • Size 332KB
  • Sample240819-ffbcesycqq
  • SHA256 5d2852456eebfbb7348305dc083000e83ffe3b2a5a22f96d23ce1f346e2dc699
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • samer77.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3376
      • C:\Users\Admin\AppData\Local\Temp\a9a546ba0b01f4eb0e2746d72884defa_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\a9a546ba0b01f4eb0e2746d72884defa_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5008
        • C:\Users\Admin\AppData\Local\Temp\a9a546ba0b01f4eb0e2746d72884defa_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\a9a546ba0b01f4eb0e2746d72884defa_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4380
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:4288
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:348
            • C:\Users\Admin\AppData\Local\Temp\a9a546ba0b01f4eb0e2746d72884defa_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\a9a546ba0b01f4eb0e2746d72884defa_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:1268
              • C:\Windows\SysWOW64\spynet\server.exe
                "C:\Windows\system32\spynet\server.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:5024
                • C:\Windows\SysWOW64\spynet\server.exe
                  "C:\Windows\SysWOW64\spynet\server.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4336
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 564
                    7⤵
                    • Program crash
                    PID:3580
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4336 -ip 4336
        1⤵
          PID:920

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 830a835cb5b24051a815463067a30933b393f50d0a15b13cbcdf78ef436a5d3d
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 8e8a11dbdfebf25e9d315c4d653a6d951ef2f382226492f7259982ade5729dcc
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7b3d6fed07e96658da62a3fc1d0194018828a1393655464c82413793874f3aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f651104f0758dc12be09f65c397aa1202f08cfea3dfe9618e14918c8fb12da2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70a43a8e9ba9db647b1fc647a9ac959164e8d810aa9a6955d60bcd3c1121422e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a84b29700177e7b88e65a8a0c7f8a3a6c572a61a63aba33bcb1007b8f6cb7c02
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb3a9e330b9107c3ef1d58cbb048b07ac61869777bab6591666a77d116a4391d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 481c538446fba1546773a44a4930015ddbfb35c50db1e6927061b5d86fc39b5c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c3ddea9fe8b863df812141a760df9a244a6cb2e42ad0f1e40925d6fb914ea13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3858429dfb24ad359adbb8593b377d4aab2b7420392ca0d3ad5b42368cc6de71
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9888a0f6acd74fa317855fd9bf5412c40167f625148efe1e50bf8c0d45c6a867
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd901a7ac5ebad3aafadac2760934936251784174960e388c11372c49957ea90
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c71ddfce0a0090a3598191d41cfa22a0710f26b01a6e8fe443542c5b76874208
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b59963d2ac1ad2bf4c253f65b929ee019f9388f8b82c4095096851d1b2f1e7e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 889aa5f43a15e1ffecfb7e43863a30db990ecf4a233276346f3c68bc40e21869
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01342296eb6a98fd7eebe4f1ff2f197a3c8231048fa0c62a854b26b3139e0a20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 15baca44810dabec2c02988bceea2315b44edc4508f0e32bc787ed6cfa0816bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a9e22c5d4e3ae88e22cf8a401801df2b1c92d960fd13ca8172f57c43a417b2a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 723c548d13206f6c6dc563b43c8560925d4a542335489d767f2d15b95ecd3819
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9a20c405c68eb7b1f61d009e17b367867fe43f8dae07e709b69f540fb027a91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 268d4ccfbae77c60067c87eef3c3b6ff4ab2bd65d43ef475ed7580b50496d5e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd82a87b81bf6e5d2160a2a200fec8f826f1555729abf0271ba8c7a9eeb0f1d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36d62e772719a3716c0ce6b699023fc3ef3bb2d6f4929cc9f6cf32a36dce1ae5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36d8ba8b46d682a16bbdb4c03dba2639a7814d1cfda287c3b205ce34d9dfbcdc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e8314f988bb4da869c5fd5816a879729b6ddc05738d59956f68733d582034bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7df0fbfc6e625423393c1d49876a03cb26560782132a423c0b125abe3c6f6af6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5dd6d2e2226e6c790d57e458fab896cd90336c5141bddf67606a95dc77720501
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bbdfb79c2310047b4de56e266f6b0d18f8ea7795fb2b4d78a73875c4534f57bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a60450cbf6964453c82d91ddf11b3f3a6cac722af784298ec1f810bb60dd3f28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c658f227b19495fe5c2d6faf82a0765ac704ff8a5c901d3641d48fb6ae37f81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 444f017cc5390648fe9bc140d294557f6d028a3df237b896a92e7d749c11d6ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1467e5fb025f5e001db4817792cfce2e783b758965d913784534191ce09be2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 599809f7ab1246c155087b772f846ad30e2fdcb8fd4a1ef406c2c71bb904e3f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8aa70b82a50040843d4c6f7740af16fb17c90950745020e7a2ddd17c343408f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67e912760dc3b9580c0387457eaf7d5c1466f89d38678fbe6837855af1f70d76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38cac504dd88d2e52aac83ad6e9e1e980084b996d9eb6486630fad60e18b986c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92b7527d8f53822f3f86c4ca0db686b730225ad4b7ef3205e492e679114686dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f72b7f0b89661bcab2fba0a856e283dccd7b399055751d45aa6e7d43533e6c65
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a18f432ac17bd6362742281f5166169250c1ca265f052945c7a42a0efd5b806c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ebc52181b44afd174cec2256c49906700f787c8a5092db32c953de3ff6af6eff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ea3cebf4cb9e7107743c080987511f368e28a2e993e393d75dbabbdfa18b157
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f76683cc08f8ef02fdecea7a7a38e0b09761da5745a4ab566bf886ddac06b04
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b885e416414fbc935a51f89db23b6eb52e4063ee69c328811c80251ba6ab2a61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66d588107e2b3fdc09107a842649a4989fcffd72043c3824940ade41b6677eab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e8d61a7dc49d02c4f6db14e019e1316ea45e6c237bfe0ce5d4d0e831337e142
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66bc453e24bccc17a8a8a47f23b8039af2b0a171a5d21129d47956b625e398f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57f7b19867a323463bc8e39afc2efcaeda39ed0b398fa3f34787317231162ff5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b48ac55188d1cafe52382045963403163beab5b2616f4483733b6cd8da70565
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af40c8b217aac335a36b44e1976b732bc5a9c579b7218a12c025635481b81de2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c2015733696d6551c163ae5e88cd9aa5bafd25b6882168881442473cc43fa24
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c0befa198990f90cdac1f15551ec381d74cdc07e3c7649cf1aa0a3eab325c824
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c2a569d9a6505eb6c13bc85e1a208a24db0e9b70a1821af9e9e90307e253afff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ff660922e1bcbb8888f8b8a3261aeda571526f7e449481a82302d915d895a83
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cb168e48a8ae4de2e4a6c514434f6c5530d13afe5de9ec201eebcb5d7ae38172
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0d760074db5b97d2302b27086d45800de04c28459a2f6e3d4c6bbfe9944f7648
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e7b219a91d62f6a6978e4c105da836de46257a3aa35cb7e0cef5dc46fdcc4bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c8511258fb8e90b9764a48128248f8273ef096c2d2a0055c0c92a3db13639e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d52dd55046c754fcea1df0aa01c90f2872b37f70187aec6e9aee9d244b2a815
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70288745d6f193fbf5c4fd5b425815f2af7bc6ab3112f2edf807c460274e6251
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c39e1ab8c1d8f5e1e879b35e7105052549b2b32b4f7ff6e94e7b3a59f0512263
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe3a77ea7c22e84e19fe88fa674fd2c79b773b8fed5b16f2d031f65c05a50b97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b98dbf342f515e32b5a5feb14a58ae14cdcec4d75346059f5b3f91906f2cf1c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b400e4a8caff7be8ffc521be7917680ee2b0b98b0947dccff7ab88fd5a2ba21
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 06c42f1d72fc0b0604514bdf4edea9199f79eb53ec0a543f7087219b2e346953
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eecccf26d4d72063837eda77cc1e33920aec87dcd98c5d3a73377a2654119fe3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9543b61b3a5211f66f0061b9d5950a030db270e90d286b7341489e263d68bef9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b6e679b79cb9a055e9575c9a6f45a19d4ea103865d3de9b9b560384eb68df61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e7bc2a8e71f1aad754009c573f5ad19a589105ffeb4f945ba11a25b91117da5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41e26b6186e46719b029ee724d086dd06dabb85a66ffddd9143770fea890a697
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 252ed8d4dc5af9664c30f3e624e2d162b4fd4e5302e17c335358e8e3c84a0ecd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 265bde5ce157daf7eae6ba824da8c4ed308f909a3607c54260262195d0d4b683
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b62d8a8764944f4caddba067908e9a9638b0e2083f8f768c65acc3bb8356efe2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13d189c794e4b063f9b68246d2f30c0968b75ac597958ba003e6c4d43ca8f031
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bded2a6e1fe6c457d07f4a0c0244f66d80a43006d4f2a8b39da7db66610a8861
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41627a867bd410d45019c81b86b8648ccd92adf887566db4c4c12fc437b87d14
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98a278c2821431c7d8dbf407f0db27b992351db6713efdec03b07c60aa8798cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c87a9d909d8c8cf272d9dc0bd290b2c58947200882982932322fade99188ef7b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8a4c47afdae41adfdb5055d1698697a14edcca63c53ed2c7a5ea7683f7439f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dca52bcefd7a6c41cac0e2586c8e367c040d167167e229bce8b0a8c1b7631865
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2a42b910eace8d15e61fd483b5e7a4438a39ad139534666d3c8f625608d51366
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d7e6249c17e1ee78991af4c6424dfd675f10f694124e41e96e7ed4ad15d022b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 256379b64eac39372d4426fca440bc15a79fc2b9936307176cff16b88e45e50f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1fad66c292da33c39075365613d0df1d9d54a71e6ad59b83934a35ceed4885e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6914c9ef636c072c47693e29ac086cd1ef09b874787219d5ba7fbb1f214ed8f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ffc6f3258810b73783555b1bbe1cba88dd77e2f1077f86ef01367bd4b86dc42
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f461cdd01b128376a3a60b891a46604be899eef3138a7619d3e2863e693d4cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e71c43e059bb21d1cef9a3f946427d4a0b101df01c654ff2ba7af50a61d4894f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7a4acc0b3d65945d093c295ff4d9d6229ac22b67548d72a8af85ee365993936
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4014e23229df56a0e12d6127c5dd8046952e35613cc1f3f12858fb2a017519dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 230069e1ba3598b750df598a335de8f707fe156a10a814776e01779a3b93ad12
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0f393504e894158c3e79c8981dec5347540bfc78e7e89f55f27efe7ed53d94c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c974f593b7fda71a1fcbe78b725f514a197a638b9a1c5ce8049bad4a327f76cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f715f8b2bc94be1beff2832e77c8a3fa09f17f7f3908fed0e346282b1415cbb1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65827a5749cbfc5284352af7220e383ac0c3511615a42b5286aea29ccd11b4bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12ed0ca22dd28c555f0765b3a6d4a95bd099a31531708cc84962ec03fd5a7f33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94a04f99c4fb5d73ce5a4b7f8e0a9f5c05a1d2f508a054c0665611aac888f4d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ac26b34c47dda7395e817dfcd527a900acd70818b417c6d5540365eacf22bf2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6a6c60642c7cb0b44c27821fba1735cd041a030a1d53f4ea8ccb0bc0b8c3af1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8d04a24bfc786ce258a4d6a6b04e53744e8b13e3243545726f717650f19ccfe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 52707682ef78e1aec84eaec8391bc9cd3ddcd603913dd402a5f4e78ce6234ea1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0fefd3120fdc96d101367414c2ca374609e64968142d7de4c0f5c3adcd223ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4440b077c3b5bf18fb21244159a819bdbfad09c45261d717d8cf4372f205f0a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f03281ffe5fa78c5b8006f5b3a0dc07c7b7e81590fb86d5f2483fe73c145b9d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 735adf619a6c04189d58d85f91ae6a7190f491b712b6d87553adeb3574f1d313
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a5f7bafe9c78b795029461a802ba3db78bf98daad420137ad80a14882852e90
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b16425f35797de1f4fd5983e209f47415e43f45db43991f9f23e8659d37f386
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4742e30220858737dae6359c137cd9300fc9ef099e11416ff43b27a7f76637d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1858ab52379b5cca0c92a6809ee48297bdd94272c6ffba63b996ed9dcea41cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 39eee87339450d11cebc56b6ccc559d982e1e49443d42adc99baa61b012b5fb6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8971000c2aefda9878d12bdcc8b18f9b7910925f2476b595a7a915b628cef64
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce4c7c676e498e300a251dd3d56f971b6f312afc3a4be9de9fc5a26d52ddb962
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e9b654dd0db07c9ea3caee61f04b8051114886707d29b37d6be7aadb01f3e9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7ce56326ca284be62b182d43ecd6d41705ded644342d88226cc63949f335c0f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd52f77a5df731c13fe038f0cdd8e9de4ef4882268312b807d3c73f30dbdec8a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d0dc7655ca7b4199fc6978be86a492bc6eed56233abf4eca0b78bbaf8e53c0c7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e77eb1823e2fa03d4aaa3263c71ed9cdaf4f7870c0ef2d8a9bbd528ff534985d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a16f5823c66740681b0b8bde9bb44253c13cd2c632581f9f85b491f39d6a1a7d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 465c69d5dc6f226bc9936543999cbd1fe87e3cda6c0d225190342a39e114f5aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd8342e29d5fc00abd5947a9ca7329263ebac6990d83a62f7155df32ae1cc832
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c094b47927ecc00e4c02fa5ac405536dc30cd799b31bfbd4daeeb2f5ec3d733
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 005b06c1dbc7c8a1bfa2712db6b0ecc8505c7e29c720d14f0e0ff41db2ff8da6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c56d91dcaecb3830c9507cc3c4ceb0419a068e9af5cc95cb3122f7fd568fc71
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4ea0b3cd6a57ef1836909703c6975fee2b59ad6fd02b85a373ae9e1dbe3322c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c0e18c340034c67782b17d43aa1f77a6ce2f06c9448442522a8f00d85cb98517
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea00ddf402acb0fe67a37ce122f55e1d446fd97af0a482606995918699249753
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b149f3188c13f9522174f3df6909b0259593b73757bc03e8e551041db2da4a42
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 866f9d484ca7d2245495e6398782a20a5cae2428bf271cbd035948145cd269a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a35493f3432da66425eeed2b8a75214659b8452b5cca98671932ac201ef3946
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 282502108dc3f8b24485346c24f2303c7525a1462088171032eabc97e6c75bb5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d94dd318abbd7c61659420d0ccf0f1b92de7adbde191405ff8641b9b4b008d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f1490b8cca6867f47f585f566161a642f50aa0898c335b4d10ea2da01cd6a900
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b8077122bb0b50398b266b5081122bb53cd7be5c47e9a61318fe058287bdf7bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c76e45b0aee1b7b6ff405edea2d4b6d087a60c09fb766c12165c91093d7358e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca1f1c69f91eceb2c15a986aba57b750ccaf6fda80b48a90ffe5c3d8c383d574
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd4a58d721a6309b8dee296c16ed8d2cd35a814aacb885695874ed88231a1e81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69277b6f9ff8076fda6469a7dcc1693a6ffafdb8588d299fb1f14fb398e08325
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 76d4933df12f8e835a7e9f5826f7a73f24977c5fa4e548b227c98dd7b8bdc52a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2eb011614c5703734de91daa819529ade18264a25e339df0c7e687812abbab7e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d693f09eb851bc19a461a3208f0f23bc405a7cc39d836200aab7edef23bf8249
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 031e1d658471a240ece29d2af08a7a0aeed87dd7df282e9f0ddb894e5a50c007
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\spynet\server.exe
              • Size 332KB
              • SHA256 5d2852456eebfbb7348305dc083000e83ffe3b2a5a22f96d23ce1f346e2dc699
              • MD5 SHA1 SHA512 SSDEEP

              memory/1268-190-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1268-6613-0x0000000000400000-0x000000000054A000-memory.dmp

              memory/1268-152-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4288-80-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4288-19-0x0000000001660000-0x0000000001661000-memory.dmp

              memory/4288-18-0x00000000013A0000-0x00000000013A1000-memory.dmp

              memory/4288-186-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4336-185-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4380-32-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4380-17-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4380-10-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4380-8-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4380-6-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4380-4-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4380-13-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/4380-151-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/5008-0-0x0000000000400000-0x000000000054A000-memory.dmp

              memory/5008-1-0x0000000000400000-0x000000000054A000-memory.dmp

              memory/5008-9-0x0000000000400000-0x000000000054A000-memory.dmp

              memory/5024-180-0x0000000000400000-0x000000000054A000-memory.dmp