Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/11/2024, 08:01

General

  • Target
    a0bf63a45ff719210d2b01cfbc6c2cdf_JaffaCakes118.exe
  • Size 425KB
  • Sample241126-jw1h2askhs
  • SHA256 1effa2a91c14a3736e42ff7ff28b84e3f1bbfc9c032d4db0fc9bb7ef43a20b69
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • latentbot

C2
  • msnpassword.zapto.org

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Cybergate family
  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Latentbot family
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3144
      • C:\Users\Admin\AppData\Local\Temp\a0bf63a45ff719210d2b01cfbc6c2cdf_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\a0bf63a45ff719210d2b01cfbc6c2cdf_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1584
        • C:\Users\Admin\AppData\Local\Temp\server2.exe
          "C:\Users\Admin\AppData\Local\Temp\server2.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1364
          • C:\Users\Admin\AppData\Local\Temp\CryptedFile.exe
            "C:\Users\Admin\AppData\Local\Temp\CryptedFile.exe"
            4⤵
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:3412
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
              • Boot or Logon Autostart Execution: Active Setup
              • System Location Discovery: System Language Discovery
              PID:2520
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
                PID:3328
              • C:\Users\Admin\AppData\Local\Temp\CryptedFile.exe
                "C:\Users\Admin\AppData\Local\Temp\CryptedFile.exe"
                5⤵
                • Checks computer location settings
                • Loads dropped DLL
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:4768
                • C:\Windows\SysWOW64\Winbooterr\Svchost.exe
                  "C:\Windows\system32\Winbooterr\Svchost.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3416
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 568
                    7⤵
                    • Program crash
                    PID:1484
          • C:\Users\Admin\AppData\Local\Temp\MSN Password Cracker.exe
            "C:\Users\Admin\AppData\Local\Temp\MSN Password Cracker.exe"
            3⤵
            • Executes dropped EXE
            PID:2532
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3416 -ip 3416
        1⤵
          PID:4792

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              CryptedFile.exe

              • Path C:\Users\Admin\AppData\Local\Temp\CryptedFile.exe
              • Size 274KB
              • SHA256 b4f130c8814214587ac8b5ed3668bd47a94d813ab4c5e79bf1f3dc3664b250fb
              • MD5 SHA1 SHA512 SSDEEP

              MSN Password Cracker.exe

              • Path C:\Users\Admin\AppData\Local\Temp\MSN Password Cracker.exe
              • Size 56KB
              • SHA256 9d8063315d29d0279712506eca4ff7a9aead72fcb6c11c7477f8813ec2ea604f
              • MD5 SHA1 SHA512 SSDEEP

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 6f494ca68e9599c03050547f5d6f8948beb88c943b699e3f7b47674c535cc62b
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 219KB
              • SHA256 57f56523c29435e247bcc362bd7e9ecd76b34389c251a92538b895985c6983e1
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a03df58c5d0b3b33cda43c2a8eb27adb35bd3810c6209334e23e1c536cc3618a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ba290c88cc7bc025384df5ef3020c45f8bad794c84a87bd9be554e8cece261d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f1877ac72b9385e10bb2d4d18ad84f21ec2891d2e7bef7fb0ee76115c27a2412
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1c7fa4f026d764006e7c51d365a1b18cdd69ffba170b6f5d5d6c9cf408b212b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b66ced738fe734ca0724d8f9f2c562dfb6fe7af9301e98de0bd3a6773585e18
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7efe1d4073c464b3f0446b837ccdbabe22534d4b6a740ba8553ce8297b5adb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ff42a25d7dc1ec9cbd77f33f20a1866f58b7b2e61592740bf888d92b0a337cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6271117c855b31b0923814acd61ed8dcc6f246ad4162ec297d4681e63a3b1c1d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b8e8252f39ef94d69038565ce52e92d5eb8bf2cd2c5e1a6318b4a0839a4b989
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c12f923949fbb70774bf67f5bc64e875978bd9891158c38877be45b03f2e215
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ae1315c726ecdb4f3dd70a096fe76bf3abf5e043a272bd5d5b41542175a7212
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75cf2664206c37691063b31e4be420aa08d5b76d1af46c058cfaa01249143cf8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9b3f7d4405a980188b3193215c9b20ddb3e5f2815fe0bf129f0761fdc5bfd6d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 319b038df6d94759fd848ddf350c001601b900f54c8545945fba7a6adaad769c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c917366f565a7cbe943dc4a0f27f9a0733c451259ef7fc0792a6dad9c4764039
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e18e370e9ce16a736192048be9e47a657f81248848eac80c46a364cc56abd8b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a5feca2846535adcde523f74cd43521031dd33edfb8f644c9f0b15c1203bd03
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f8dcf16281c723ca5e27ad238aac57ef3d4388b48f96d6c52026d78c64ff6bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b9e97dee2a0fd71edd7007a33e573086aa203efac7948f3ef0ecc03966a0362
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c8d3c01e1b9884f12232ec7dbf51b207d4a28b23dc3e061f40c5d6d06fdfddc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed87f9f083ae53309cd89645f5a8248f97577b560005ebee17bc390fdcdab439
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9af0d758b0ed75fcb76d4d3f09cd8364db8d79d10f28326fee0d6330bf1b97db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 91e1917de0435f4b67a255a39c7f8175d917a07ec699ed75be904aea8d10d688
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f075bbcbb7824549c62f1b93c7f9691f28317e2df2f79528b2d6e74b7b59f888
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b9df518504b96d0d62a9299f29bcab4af24678ac3b55f286ac9940c2a44cd96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c0f5e4f262221d2bd86f1933bca02894ec819b5048a791edc5d22364ec465e6b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d106a3d3098591b913d1af7a778b73621f43874d17ed85be47313b6dd2ec1dcc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8dd13cd3673b1bead1aa80575951456fdfa4fcb36fe3b5dff9c2dc1f4f49d111
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb94c93225eaa11564eb00cecd78c9d09ef7408fe72899e7a3d17bdea1b9d09e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2692d705d92609ae3c421c0f33f3806f152331b3bd4aa80964f3991ab0c3f98b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a04aec579c96a6c8917eb3a6fcc9397b7f233c4d5f757f89e9867d865da9a79
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85cfa0987b34ffe6dbb582399cbea117f3aef3fd48ed8ba072c6fd5c9fc2816b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1582365045b2ce4a7e0189462e26f5538613dcee07a924806cd9f6d033430d64
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf422d4a2e06d13fccf33326a66177f9f9d7da61033430f0529522da8e66a898
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3cf7f2810d86d067a0589df00dc22b2f570758f95ef2864c1ccd5af04347a6ec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57878fc6f764dfd28ec0cb12f24d521a71f95608ba16e84f11dee1283a5adfba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 496a220c7808cb97e93fee6919cecab64608feba1d4edd5f576ed09ba7a125b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 327264b44bc4b6492c28c9aef876ace3392893b80f53c4cf45b0db9249cdbfd3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e58e2534310518a7fd31773e8d148455ca4b8e4eb908c4086499af64e4ffa69
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7dd3c4bee5afcd95ecaa9e2c7efe4d0503fcf66109ea9e5e589fb14ff391b8c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f404b56270ae1630e19e3c0f86cf318506db119ed16928f99f72e1117087c63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ab6549eb28d77abad218da7943712b03ce496ce2cf016fad5cd51e38b573485
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e81d387891b9977c4d4980eb624e22459f14d7bafd66c0c693131d6a7f33e0d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d795289878c368c94431630474beeb6745fe2cf15953a6cd85b0b9ba37d4ae5b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92061269d39a6d5f71ca0103759a2a55136c05a4534c1deba89a8d2f12085133
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8d09c0120fe8366f50cec48b03a7e6012dbf3ec16970518876b27b406faec11
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16881f8c5ca42dadddfec702f0aba0669854573656ff20ee0676aea0e280192b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11521272d702aaff5200af04002a380a12b0e01578ab3194c33edaa4fe73cbd4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f3c85f63af73a89b75a6b905ebc895a9299a2178f30ec463d9b27df6cefb960
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe92fc96be6345789fcde588f63e04c8e99e6ac97238512c6904addda9544d1b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee546b8df36b807377e6bd766cb5fd6f00eda994b77c61a9a8cad90bc40ca6a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4e386489cf1456bffdc396902007dca46ee7359aadbae6f0143b32577d392f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 362d238d72df0885b84d66e2732c1a340d85600120bca27447958e7316330b10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6bf510d1d11f7b96bf9ea491ed04eddeb67c05d6cf5a37d9ee846928ab919491
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 352a459f007d650f72f18150ba246203eee033889709983a9f669db9ad36f1da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 81a2cd58043099e834cc736fca9dccc414b8ef4a0fa75b738e0d7815dc4fef44
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3215ec7078167729e711299269cff565bd7461a40e2255e4e6121c8747c5730b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b21614cea30af25b0b7473b45d5d983e2bf8a457a2ad1109689ef5337271096
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e91a3e768542eadbf57ba6be607b3874b268de45b0a174655f5fa692ff166d9b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa84af48e2e85a76319dfc0ddf933ea9ecf0f63043979d671fd00179cbd45f7a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6ee3f6123354a8c967e1768f04af7e304350a27dbeb1850b5b15ed133e51fbe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4afe433fa80dfa89e32e2455ed063e8d824517e677bb655886e2f9dcc6ef6062
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1138c27abf04dbfb8b4196f0802a1cf1d0577d7e43cfdbe3f0d94ef84aabfe3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c38bdd893673b5a15cb1c4e9d905433da5a10ada464e3e06fcf41d8a7ae37b79
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e31e7959ac1915f0bdf3da63194ff5a2b4f3231e2e0c97aececfad2e572bce72
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3bce2a2498c7073cb9b5075e334d91a1c98781c361f75cad2a1240d0d9a54e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f575956877f8c1e96c4f83ebaa74a9a8513572696d4b97fb64c69e1aeac9ead1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe6006c1e2460964ff5b3750b076a16731553c94dad69035c0abcaff8bf915b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17bea98b301dfca7caa454ebec9b32051743fa41b15023821bd044e894901303
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c52f4ca8415ab27bc5df1ff6abcf32f406f0d570624a28ffcf17272edb8da781
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b06e9a1307f0bd359674c62e78b93a525166f80812b968109c962c8751fdfeda
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 798c11c876ce55af6b7f1a753798333874b59872e5bf96bca4ddfeca93ce70f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2024967e465a93cec1ec94f70d4538173bd2c369dc7f1695346c1c51727734f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 633b3be7617459ca210c24c960a2febe5c63910826f5ee6015e6ee0ed393afb1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44f5f76a40ec0d127a0c5e367608e80c1319be94b589315b65c9bd406a4b8fc8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9408664347e541e7299253daf9713727719422242c2e89521e9d36c2d362501
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3770c64e9d0d5f4ab1b2910339b818898128d5fdb5e2c88fa95a1a6c431a0e58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2982642de0ea2ccb5748b5d351fe37342a44808efd4c35311178830533bd46c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f2f6f8c1c97a1779020f41009f389e3040295b7b94ae8b307e7889cac83f067
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55f6395e7f0b0ffe3724f4ebed6afa9627398867e20eb65f777c4a82da7c54f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ebb7fbf51d1d95a8d8f1ecdb8f22d2dd32b7623442b79ec89515eab223448e60
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc678ad0d01c121664245a6758ddb6cba2bd5905fd6885faa0c54217bee3cf0a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5def8c51aefa88372d23f1fe402f09805dad9a0e77f17d8ebb5b0616a9699a76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa442e003ee7f115734eaa23dc601813a71252d9c1f1a664b72d6beeb4130366
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d0b9844071e30dbc3e348959dc7c1e3114dcac4c2991392d4ecdc441220168c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 177b1353af32cb54af2860c9705c92e95b2b36d613f79d53878521e285961ada
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e5ccf5f64188c711207c020e76ae71ec470732e4ae1d2bc96b7e62bcfc054c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4c02c13ba6b48416c3e80e5157138d51a94e2a77ace988dc7500305368c7cf3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e24b5c5b6175a559de8c9e179a1fb2e4cd2fd9b929becacdd57d738b40dea37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ebf1c117559bdd8c538665d949d40460895532fabca3f5695202ce64c7cf6356
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 81ee4145dc7889b8f76120fdbf8555569b1a4286f60c90227eaa68783a27bb4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 895e8cf3e7d38b4e7692cebf7b62dcfd17890644c7abb17fed9e744bf8c32a48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3ef872fe735dc8bb27ec97f026d27c655612414fd443782015d7dd5c8985779
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5b8b3037d34f3d2697cdce2a5cba016ba2b675d4507fcdd6ede0cf6ebae7fcb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40d652ced927cb0b21ec98b3634dca6a3003ec2a099b18f19b55c35e43176b77
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f01330636b847be91676e402df3d555584e4526b77ef87489b9911460a3a1b1b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf1c11e9772649e4efb6ec32002da6c0a46487af7da68cadfff1fae51ccf8167
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31fdcb3c5e7494c4e9a6f9717e0f8f3b81f7f3e69cd04df7ebdad1fa26cdd778
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b4951ed7458ef5d357beba26d658d547ad5ee8abd42cd1153a9a721775e5f4e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8375d34a965b1e960c069aa4b0750c9fc1afc6e77b38fb0f711e2eaeed74b2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff4113e24aa6baf54b9e402077c6197f8d66fa86f41a2f5ba856f1474fd27c8a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f12d70add6780a838d4c1293f72d89da80b711193a0901a92b6757847eef3ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 302b3529a48bddafcf417fa3e0c974291cb8136b96b34ca2d622a413c7e91f0d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6d34de1b7075331ecffa311c8e0ff1716afea5bae337a729bdbf04ff85fe807
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6bb9006d068cb43b7e0366e7ce9d4f8a07399f62dbee164b7cd11c9da29ac26
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7ea09c78b034334505f39c4b8846c1a6e8091775b37d49bbffe31c2cc3e5844
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6211ac20284bbc9254e70e792d1a34f46bfb788b35e8228f017e3b6745b21caa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 74caa9b937c8997fbfea8fdd0b2505699763b8a0e41c0844d7c2d3037152e7b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf3c449a7064af45b519ce294cfb8707249b366678786e0d2381540c74ba8ce0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc6b8b0384b10c61dcab060a4308b12538038e11e539f5c352203f84216ecb2e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 092ce0a730eae1c80c2ac04204b11c866f8bb8750a17d7e4e032d1d37986a85a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 892bc4fef4603318c3688a04283200cf643aa78b9aec1277cdc4a9cabe8cd831
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa75cf524d77a3ba0eca6d3cb6effc009aa42ff64c2fea46893587ca9c813d2d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4e10f0b3d33865a7f5b10ef6e79629698b6cc89e7f5f69237331d08e7ed3ba8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2fe0557255e2b2ee8120d154adfb3aec5d2c335916556b3594db9b51e8912b9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0afa339332e817dfb6f1623f2936aa2751f2d60cacb79be02006eca40907f6c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 498079605289c0fdb2890603caa92bf6042d7dd76d1835d4db70299103367392
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 494a957617f5bd6b69c1a1c52266508c1cc3f1fb5e656a723cac45278b99077e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe4367b0c3c477712fc195f5a1203750c18abcc82eb590295e4c2bfbff9053e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ff4dcccfa89524430e26bc15738843c35c52ca3ca38b6d85badc6a397836da5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a06344959325a4eda0bfd083c880d4cb2fc887973fb3e020df00dd74518c3e64
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46944da313b6e25668b0af0a9acb0f381364ddb16c3e794e7b236144d46bba48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f4253356828f2c35681557f986e3ed429ffdc38d59fd1dd92e31710d7665bcd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 992ed46975c41fad862a8659b5057acd5acb086558023107b0586a6451c16b07
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4271ec820997fbf1258fd596734d4bf56c686e672f611ecbe93e616b3b16d806
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c4f7e62d130fa5ca7fdf8138360e6a53571f0c24bfce37dd925cfe219e0aeb8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a67bf1c185f235007e8a90bfc1232905d38b7751202745863dc70609de452e74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d80276dabf170572859cea6f30b69ef80289187374be53156b074825f48bfba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92506b8572e006d299f5c555484d8a37a730a8535f09ac2b0acfc8d26cfbcf16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 51b1c1890e178a7abea51a8a0010255473c5f32c28e4a0aa53e1781eaa35c000
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d83625bbf0a0890bde9c6063e5d9e83460c15c5820061dcedd17085382088e28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f7353366de9ae0ff8bdd6f1675160a75764ab310958a46239cabece19aad460
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c83bf7671d8922e8727a30d1878fd62836cef0b92fa84ba5891cc32b6cadc197
              • MD5 SHA1 SHA512

              server2.exe

              • Path C:\Users\Admin\AppData\Local\Temp\server2.exe
              • Size 415KB
              • SHA256 2b55bac68f8c20ea8254a3b49f5a0fd48f982755dcd7b30e88becc914e86b05a
              • MD5 SHA1 SHA512 SSDEEP

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              memory/1364-37-0x00007FFA14010000-0x00007FFA149B1000-memory.dmp

              memory/1364-24-0x000000001BE50000-0x000000001C31E000-memory.dmp

              memory/1364-33-0x00007FFA14010000-0x00007FFA149B1000-memory.dmp

              memory/1364-31-0x00007FFA14010000-0x00007FFA149B1000-memory.dmp

              memory/1364-38-0x00007FFA14010000-0x00007FFA149B1000-memory.dmp

              memory/1364-32-0x00007FFA14010000-0x00007FFA149B1000-memory.dmp

              memory/1364-35-0x00007FFA14010000-0x00007FFA149B1000-memory.dmp

              memory/1364-27-0x00007FFA14010000-0x00007FFA149B1000-memory.dmp

              memory/1364-34-0x000000001CB50000-0x000000001CC20000-memory.dmp

              memory/1364-25-0x00007FFA14010000-0x00007FFA149B1000-memory.dmp

              memory/1364-48-0x00007FFA14010000-0x00007FFA149B1000-memory.dmp

              memory/2520-57-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

              memory/2520-56-0x0000000000F20000-0x0000000000F21000-memory.dmp

              memory/2520-115-0x0000000003AD0000-0x0000000003AD1000-memory.dmp

              memory/2520-116-0x0000000024070000-0x00000000240CF000-memory.dmp

              memory/2532-36-0x00007FFA14010000-0x00007FFA149B1000-memory.dmp

              memory/2532-26-0x000000001BDA0000-0x000000001BE3C000-memory.dmp

              memory/2532-29-0x000000001BF00000-0x000000001BF4C000-memory.dmp

              memory/2532-28-0x0000000000C60000-0x0000000000C68000-memory.dmp

              memory/2532-30-0x00007FFA14010000-0x00007FFA149B1000-memory.dmp

              memory/2532-209-0x00007FFA14010000-0x00007FFA149B1000-memory.dmp

              memory/2532-210-0x00007FFA142C5000-0x00007FFA142C6000-memory.dmp

              memory/2532-23-0x000000001B230000-0x000000001B2D6000-memory.dmp

              memory/2532-22-0x00007FFA142C5000-0x00007FFA142C6000-memory.dmp

              memory/3412-52-0x0000000024010000-0x000000002406F000-memory.dmp

              memory/3412-112-0x0000000024070000-0x00000000240CF000-memory.dmp