Overview

overview

10

Static

static

5

JaffaCakes...80.exe

windows7-x64

10

JaffaCakes...80.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    34s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/03/2025, 16:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_47f4cfecb25fec272d69892825ffe180.exe

  • Size

    361KB

  • MD5

    47f4cfecb25fec272d69892825ffe180

  • SHA1

    eada58c5dd31a5f3d9739c3162cd52c68f5ec8e3

  • SHA256

    65eff6666a66ed5175d74f736c69d0cef843e1e0b835c52a66855099a264cb7b

  • SHA512

    950d02f9ce9920ce006f2e670e27ea52bd0e95f18a7c3231fdb422aac8a67cf421c8b31357956586e2a05cbf2aff0ababa92c68a493fbffea07e9c029256ccd5

  • SSDEEP

    6144:bk4qmgWY+OldTkKadk9oFw04FyMqULqFSwVMDf0uqD1VPijBZXOpvwwMDQgnT:g9dvT0dk70qqTnqfkDLPQezgnT

Score
10/10
cybergatesalityöííébackdoordefense_evasiondiscoverypersistencestealertrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Extracted

Family

cybergate

Version

2.6

Botnet

ÖÍíÉ

C2

10.5.50.254:200

Mutex

***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • ftp_password

    ªš÷Öº+Þ

  • ftp_port

    21

  • ftp_server

    ftp.server.com

  • ftp_username

    ftp_user

  • injected_process

    svchost.exe

  • install_file

    Win_Xp.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    Please try again later.

  • message_box_title

    Error

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate
  • Cybergate family
    cybergate
  • Modifies firewall policy service 3 TTPs 9 IoCs
    defense_evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 18 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 3 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 14 IoCs
    defense_evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 18 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 4 IoCs
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Windows\System32\smss.exe
    \SystemRoot\System32\smss.exe
    1⤵
      PID:256
    • C:\Windows\system32\csrss.exe
      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
      1⤵
        PID:332
      • C:\Windows\system32\wininit.exe
        wininit.exe
        1⤵
          PID:380
          • C:\Windows\system32\services.exe
            C:\Windows\system32\services.exe
            2⤵
              PID:480
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k DcomLaunch
                3⤵
                  PID:612
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    4⤵
                      PID:2040
                    • C:\Windows\system32\wbem\wmiprvse.exe
                      C:\Windows\system32\wbem\wmiprvse.exe
                      4⤵
                        PID:112
                      • C:\Windows\system32\DllHost.exe
                        C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                        4⤵
                          PID:10124
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k RPCSS
                        3⤵
                          PID:688
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                          3⤵
                            PID:768
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                            3⤵
                              PID:816
                              • C:\Windows\system32\Dwm.exe
                                "C:\Windows\system32\Dwm.exe"
                                4⤵
                                  PID:1072
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k netsvcs
                                3⤵
                                  PID:860
                                  • \\?\C:\Windows\system32\wbem\WMIADAP.EXE
                                    wmiadap.exe /F /T /R
                                    4⤵
                                      PID:1960
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalService
                                    3⤵
                                      PID:968
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k NetworkService
                                      3⤵
                                        PID:272
                                      • C:\Windows\system32\taskhost.exe
                                        "taskhost.exe"
                                        3⤵
                                          PID:1084
                                        • C:\Windows\System32\spoolsv.exe
                                          C:\Windows\System32\spoolsv.exe
                                          3⤵
                                            PID:1092
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                                            3⤵
                                              PID:1172
                                            • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
                                              "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
                                              3⤵
                                                PID:1516
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                                                3⤵
                                                  PID:2052
                                                • C:\Windows\system32\sppsvc.exe
                                                  C:\Windows\system32\sppsvc.exe
                                                  3⤵
                                                    PID:2188
                                                • C:\Windows\system32\lsass.exe
                                                  C:\Windows\system32\lsass.exe
                                                  2⤵
                                                    PID:488
                                                  • C:\Windows\system32\lsm.exe
                                                    C:\Windows\system32\lsm.exe
                                                    2⤵
                                                      PID:496
                                                  • C:\Windows\system32\csrss.exe
                                                    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                    1⤵
                                                      PID:396
                                                    • C:\Windows\system32\winlogon.exe
                                                      winlogon.exe
                                                      1⤵
                                                        PID:432
                                                      • C:\Windows\Explorer.EXE
                                                        C:\Windows\Explorer.EXE
                                                        1⤵
                                                          PID:1144
                                                          • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47f4cfecb25fec272d69892825ffe180.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47f4cfecb25fec272d69892825ffe180.exe"
                                                            2⤵
                                                            • Modifies firewall policy service
                                                            • UAC bypass
                                                            • Windows security bypass
                                                            • Boot or Logon Autostart Execution: Active Setup
                                                            • Disables RegEdit via registry modification
                                                            • Windows security modification
                                                            • Checks whether UAC is enabled
                                                            • Drops file in System32 directory
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of WriteProcessMemory
                                                            • System policy modification
                                                            PID:2320
                                                            • C:\Windows\SysWOW64\explorer.exe
                                                              explorer.exe
                                                              3⤵
                                                              • Modifies firewall policy service
                                                              • UAC bypass
                                                              • Windows security bypass
                                                              • Boot or Logon Autostart Execution: Active Setup
                                                              • Disables RegEdit via registry modification
                                                              • Enumerates connected drives
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2000
                                                            • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47f4cfecb25fec272d69892825ffe180.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47f4cfecb25fec272d69892825ffe180.exe"
                                                              3⤵
                                                              • Loads dropped DLL
                                                              • Drops file in System32 directory
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1316
                                                              • C:\windows\SysWOW64\microsoft\Win_Xp.exe
                                                                "C:\windows\system32\microsoft\Win_Xp.exe"
                                                                4⤵
                                                                • Modifies firewall policy service
                                                                • UAC bypass
                                                                • Windows security bypass
                                                                • Disables RegEdit via registry modification
                                                                • Executes dropped EXE
                                                                • Windows security modification
                                                                • Checks whether UAC is enabled
                                                                • Enumerates connected drives
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:5828

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Reconnaissance

                                                        Resource Development

                                                        Initial Access

                                                        Execution

                                                        Persistence

                                                        Boot or Logon Autostart Execution

                                                        1
                                                        T1547

                                                        Active Setup

                                                        1
                                                        T1547.014

                                                        Create or Modify System Process

                                                        1
                                                        T1543

                                                        Windows Service

                                                        1
                                                        T1543.003

                                                        Privilege Escalation

                                                        Abuse Elevation Control Mechanism

                                                        1
                                                        T1548

                                                        Bypass User Account Control

                                                        1
                                                        T1548.002

                                                        Boot or Logon Autostart Execution

                                                        1
                                                        T1547

                                                        Active Setup

                                                        1
                                                        T1547.014

                                                        Create or Modify System Process

                                                        1
                                                        T1543

                                                        Windows Service

                                                        1
                                                        T1543.003

                                                        Defense Evasion

                                                        Abuse Elevation Control Mechanism

                                                        1
                                                        T1548

                                                        Bypass User Account Control

                                                        1
                                                        T1548.002

                                                        Impair Defenses

                                                        4
                                                        T1562

                                                        Disable or Modify System Firewall

                                                        1
                                                        T1562.004

                                                        Disable or Modify Tools

                                                        3
                                                        T1562.001

                                                        Modify Registry

                                                        6
                                                        T1112

                                                        Credential Access

                                                        Discovery

                                                        Peripheral Device Discovery

                                                        1
                                                        T1120

                                                        Query Registry

                                                        1
                                                        T1012

                                                        System Information Discovery

                                                        3
                                                        T1082

                                                        System Location Discovery

                                                        1
                                                        T1614

                                                        System Language Discovery

                                                        1
                                                        T1614.001

                                                        Lateral Movement

                                                        Collection

                                                        Command and Control

                                                        Exfiltration

                                                        Impact

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
                                                          Filesize

                                                          240KB

                                                          MD5

                                                          ded981e3b9fb60b8a2cea3105dfa9402

                                                          SHA1

                                                          4ecea0798b4808b189d46596f4f98d0d64272dd4

                                                          SHA256

                                                          20eb73746b69336322177e7880e557d9f3b5107be8905d399bd1659755cc79de

                                                          SHA512

                                                          4f9ed8b9783507ddc9685cbf359c6f231bc4e1cce3204b3da2e4b96f4e46799a57f472d4373adb4f63a1313589afe9364ff9fe0d2b4f9a094dcf3ddfe46addb4

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          808a6f180126a51c1abc5460f2e006f1

                                                          SHA1

                                                          41c4249afdb085771e443cfc594f1e7d02a4fafd

                                                          SHA256

                                                          f2e5aa692c9405219f02e7fe989fdd895015c4638b05c92085dcdfb755829e86

                                                          SHA512

                                                          720bb9248d82a64332aab311380c22dec862659830e8b05a1e4992135b86da88f6d29aaf67060f0f7b576d37dcd75a735af4f7899fedbc2b34fc4d72ab178911

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          bc6796b9cd90321a3b853abf086227ca

                                                          SHA1

                                                          250092ef11e9abe32fbcee57dfa2e6c2a58a2f01

                                                          SHA256

                                                          12fd62390d8c654f0577319b0fc287d8961878875a8d5d0d9ebd04481527f607

                                                          SHA512

                                                          523c69c82fac9750b2429b5e90fa594d207b512e0739e457bcd1c1b1c30d85f460635bca93efcbee29e0b4484bf2667950ead242d91931e4afb9dd2ba276c354

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          a727f10c9f0c0bc21d050fc037d4a860

                                                          SHA1

                                                          724bfbae4ed8ca93f68c6cc4aa2a3a7a5b5ae7b3

                                                          SHA256

                                                          23a133612fd6a0f9c54a992f9726ec72610943c46d83c98c6dfe856a0832c30e

                                                          SHA512

                                                          516610be93901937df40e053ed9611c0278288b80a6a0f075ad0c6a17e70053543b12516e0af00d6ad8312a0a2f7577aa58b77599933fbe9c830a226588be1f4

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          65c1a73e8d24fa24ef8a7894cc8770a7

                                                          SHA1

                                                          6e24c0e0dcf933d14d9046f2a7d5f1577dcf64ce

                                                          SHA256

                                                          aeb5b4eb8f91848bde41ee871471946ac919e3e927383df2512bba46344c4bb2

                                                          SHA512

                                                          af30c678880c36c21cee34a39714a31781df84fd0aafb2af454d0ec5bb9023ae8ea3305e76d026b8de3d2de37abcee4bacdc4f27048a8f31e10234d2b8aaacdb

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          f14099ea9ce4e9b7d0f895baebc28164

                                                          SHA1

                                                          d721fc1b739f9a72eb3d0f2418c94ea081d9ca0b

                                                          SHA256

                                                          574b71d0dfddae709648eedbf8ad3c6d31bc4c58b06346e392a49154fc9f261e

                                                          SHA512

                                                          18f6d29108df5dd2b7afc191025c062c616533063741173168ac9722a3c2e2dc54ea6894604a50a3f75bb138b1dcdf1324c75a25f2eb03ba744edefc42b3376f

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          80a57dbbfd92f39bb28c41b60e92aff7

                                                          SHA1

                                                          249c8171a0deafb30c9930d0032bbf77c52fbd7c

                                                          SHA256

                                                          3dc80dcf4c48014af283aefdd3c008ca026814d826ccc62b0e24b70b5dc71455

                                                          SHA512

                                                          170338f18d676dfdc8a73939a55f1efca09fb3473e980726c399c559611b0f6d2b72a3b933e7ef9313bc7d8ae85c3632021a20d255b9192c6df46f31143dfea5

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          78fb1dce9a481830f06b95909d23e94a

                                                          SHA1

                                                          42df663b28f5278f832cde8ae7c6f3727db94c89

                                                          SHA256

                                                          0f0748f73aaf207f860a8d8c81660d0e66cc2178a4d4bed299906bf7dc618fea

                                                          SHA512

                                                          1aaa4738751ce819bbfad4c8e4869e9282fde77e2e84dd118bb659a0a9fc12d07f5ee7008e1dc7b1d982bd99a457f9d42a6472a5071e019c30f7b75140c370d4

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          d5e77c825e1279dca55e9da01e4fd3df

                                                          SHA1

                                                          1cd29fcd56b69ce598f1413723d7ae1da5ac716d

                                                          SHA256

                                                          9a0ae7fe32a7486a543e255791ae4ff0c183fb5d15cb9294d9f2c612990b1556

                                                          SHA512

                                                          4e5b92484f4349f52e0b5b178ad8e5459ee7f702ad4cb1e1746318bb8237e2d55ec7042b2b33ee6389613a32f3d7c1ba17eae46fdbaf66b6fed9be7e35b4b091

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          023015461db65dd0ee56752f659129e4

                                                          SHA1

                                                          8d661dcec9a8f849ae52a9b1c6a8f946fefc3ff2

                                                          SHA256

                                                          d13eb28d04870f638761f4f6eab07eec2cc67177bd48beff82415b754dcd1cec

                                                          SHA512

                                                          82661fe44a83487c2c6102737821c103b19f729440ece3fb386a71ee81ddf2e0a864a668078ee2fcb0f17e2a6f84dd8a43f87e372aecada2e4062c1842275b38

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          568a9486b031c7727457b928b0d82828

                                                          SHA1

                                                          2d75de07bab365f10d1ea8ad7bf3df15352bd3e7

                                                          SHA256

                                                          a33af04b929222181c5de3abacba03bfe246ee7ab05a7329c7b422108b1a6341

                                                          SHA512

                                                          58cf3bcb53ec022f05bb250cb6648b7a1055b36cd3384682b12b34b226fe212174820756e05bd4f22b0524cfff7a7a7a328dceb1230ed1eba134e040cff3f312

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          f2036fc08c863107de207a7f7b17b4a8

                                                          SHA1

                                                          18c51523f12596210db19f66f83d395f5ad52829

                                                          SHA256

                                                          850c4ee3a0b917b87d9f60551dab67d616c548ce0193c9079b224900868f7132

                                                          SHA512

                                                          7db9a99f268da752f9fa2fe4ad79b47078f543d920c7e15f0f857efa0c9ae49a61fff29ce9c384f348f646736925e1f65c7291c2a4a78bcde2c890053e9f5ab1

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          9590546ac7ca76e02248665c2963e2a0

                                                          SHA1

                                                          63c6abd3b67115a9e65fc72978ed2316dcde0a3d

                                                          SHA256

                                                          485bfd08d96e4dc9ffbdfbc706931b219958a21ae8f80cb2605fb75219c09234

                                                          SHA512

                                                          b1b36ed71bced372b6e75aa9ebead9bedaea43160fbffe9a0f7cda995d524cdc4d394280f880ae11aa08fc96b1194366dd086b9927fc83d9cfcc2e3102f22e89

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          e4b9ee55a968bcda76f0afedcbedfd17

                                                          SHA1

                                                          fffa4f83affee90d5ed8f5d9575ef463fcf6c1f0

                                                          SHA256

                                                          3c833c1bca000344c5998fb08a6981cbd084d4ec9c6ce8fad7aae598a4a3265f

                                                          SHA512

                                                          f21aa3d0dfb9f3691d64d47795c64ce723a59549ee510cab85d18e128a7ad2b096361d651d20b6c8977e7336071d00e1e528b054d2964189342d022d81f9c972

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          8f23e965696cb0b6de1a6112550cd5ba

                                                          SHA1

                                                          6e6ca311ccf1d4fb8b54a8fd68864c966ceb45c2

                                                          SHA256

                                                          1b41b3dfeff26683da428e6b0b2cab7a49cdda8f198576b65f1d41392d01fcd4

                                                          SHA512

                                                          b4003667df04d2b069efbc3cfae48a5c676e9897fa6acd2eba0a4e16e87d41e79daaf78d8d7c12b5892a37df16061e69737e9063b93e138a8a15b3c58ec867c5

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          3444b4c35ec7b7df808c7570143f7093

                                                          SHA1

                                                          53dba781b93d08b1a78435551b7f23c2ed19bee2

                                                          SHA256

                                                          9e792c62fa542222b50004428c7fe77ce234ab3a50865e75f65f4d51b132e210

                                                          SHA512

                                                          1e0bddda6a8b6079133cb359295c65fd248e0baad72c7e66b7d4f596d413ef097eb15977c5a1b7dc272bcbece73278c4d6a66a2978da245803236a7b22b4e89d

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          655720e6fad984c155e66bca82b9a521

                                                          SHA1

                                                          140887cc5d731568434a1ebb843819be016ec1af

                                                          SHA256

                                                          0da798b7aac55df67d4de5ded962527b0b129892d22992029a449569433440bc

                                                          SHA512

                                                          6f80a7a8b70e0ffa8c19869c8aa7c3fdf0bccee7969bae87db839e23e4a2fe6a0e5a552ef2e4d8ba85742a28d323a01f7bac81c404ed6a6482a8485d356c5cd8

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          6fdb12c326ceb7d24347dbf01aaa40a3

                                                          SHA1

                                                          c2d54289fa6717a39236cb6731a873a75d958d16

                                                          SHA256

                                                          bf1ebeddbb05912787cff807a5a37a99de0abb5dfc6214a0ade118f8f93a42f4

                                                          SHA512

                                                          7ffa3a5990db2fa6a9a9a8e50b9c64b4bb1e7b34aa860de349475643fb10fced71849352b270c1d44d3b3475beaa15522fa49172c277e2adc81b19c8b1eaeb7b

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          98edc5f0a2c193a544762be05ec135c9

                                                          SHA1

                                                          63485934fcc7cc0cf5ffe2b0fa4b889fd5ac164c

                                                          SHA256

                                                          f09596c55972b0e0b07b7c91d346be374512933142bdd4728b825f2a3d896d41

                                                          SHA512

                                                          536ac58bd3604b3648787b6214986043dd750b149cd22e9c08140bea429134a051f8e7c59d37c8dbb944aec3fb31ca42b186df17984a72e037df13101e312e64

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          5d6bb7c70e9e825a1b972f0e18f02303

                                                          SHA1

                                                          eb14da9a84fdde0205741133e6211f49051ebe03

                                                          SHA256

                                                          08f5ce69cd0aef0a5b488afe806e92fa9875dccf1b20d86772214980cc8abefb

                                                          SHA512

                                                          91db8614c999b47b47b63d0ef73aa4309a7b0a5abf0508f242fa8578b9b915ff2e1bc73135f76ae56d5ba8002c063304d946e451996d0b30f4754500621380ef

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          fe8e9736ab5a91199d772e2e80d7b93c

                                                          SHA1

                                                          ad469a2587660dc2e49de7791b6ff449b88520f9

                                                          SHA256

                                                          5b72f406756d42d39df89f1c75c1500992292f76a40f9d93b41ac100589e9d34

                                                          SHA512

                                                          608f13baec77235a80df70b380316f2f40ab15f980de256aea4231cf5b4e47243193b032a86ac8de5a3670a4718a0210c9965a9500922da0f424962f19cdd2bb

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          aa630bb43b174f5d31ff49188797c9a2

                                                          SHA1

                                                          625d420efd9ac44d15643bdaee46ad7e101f5d8d

                                                          SHA256

                                                          c11dc1839f40e3fea05f5867db27dc4eda01a475546ad45fcb1e654e3ecba816

                                                          SHA512

                                                          2dbf39eaf1fb4a9617b5890c54dc3872a1a77c05165fa813334700f3bf0f1b78b3389b1f9f1260f065848772e9ab21604997a95b13ecf5d1c1b97902e44865c7

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          17dcc31513832949aea101930e9e5655

                                                          SHA1

                                                          85649887a693a2e9db0a219f7bcd5cc94892222e

                                                          SHA256

                                                          1ed00692149718f33a00faa802d86213ff74e86aba279f2e473567383b88c71a

                                                          SHA512

                                                          e2ea819da5e4d76fbad9ab1ffd9c16a69b7c9e1f905d7f35a65f01d30e4f19a1e7f4782ddce50142901f9ed174be72e0cc19aad9d6d8a92113dd60fcac2ba7ac

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          84c7e19d06e4490fb5c88d01f260b224

                                                          SHA1

                                                          0b0ef3700d25be370593c48a61bf2f1d8fa74657

                                                          SHA256

                                                          8d9a4bf9448dbe3d5a40f00ed98b45d4cd2e860ca91b479766e17b80b21bfa3d

                                                          SHA512

                                                          24e1960aa5155215121b88a555cf6258b8b25ad69662f2b9544945ba2386a9b016decc353b5bb635ba0a53826fec6e14c7fd925081762d29641ffde0f7dc22c9

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          c0e1cd3427219051a27e3c9dba6269eb

                                                          SHA1

                                                          ef80b372f30832e55e6acb1e991d3fb0dfff8c8d

                                                          SHA256

                                                          74de25232367421bd17d3131457bf06d5ab4c09b5b0557d9246055eb91f030dd

                                                          SHA512

                                                          e34ee496fcd8fa390fe243163f7b08e989be1a1ef50cc1472232fdc2668a08ef1a9a855d35f68b44f7814ad4e70727a9850d49cdd37d09829353d6cf4326e561

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          cc87f698ee9f3a1cf5b9c059116178b1

                                                          SHA1

                                                          ab90e12ef472c64fa6d355ffee2b27d600abc8cd

                                                          SHA256

                                                          d0e19c9a19be5b7bb7908f06f08f402c26aabc86bbbcc87c6629a74249cce4ed

                                                          SHA512

                                                          7b3efbd23ab1f6b4f38ba72cfb41be06c79df018d13971acab759e09651aa1059fafd34d915ca16767808873906e2894c4ada75b8d99d9d3b165587f3f502268

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          d757451f3159215e71ea2fe3628bacdf

                                                          SHA1

                                                          552b43fefec9bbb691807bccd46641fe0b0a8806

                                                          SHA256

                                                          b79895bb2ab45555ef7d3c20ec775d05c74d273d80948b257f0d7b5cd0f6c4d2

                                                          SHA512

                                                          9bac49a2ae31efa40064611d884c2afe18299121ae1e8c1bd3664f52939a73da90ebafdfa014e2217aee16607f370ee8e8fd733689eb6615e14e317f819a847b

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          c8de3d3b1b95f99f92e5931ec8e3f6c6

                                                          SHA1

                                                          8bbfadbb6d364f46e99b091d597089952a27af68

                                                          SHA256

                                                          6394125f427ea4feb4513dd8755690f1205ea3e09fc65863c61596dfd0da0794

                                                          SHA512

                                                          a5afec5df57a044b77903cacb69f320fc9bcc682fedad421c760d40c86a07e7051ac80124a7474c8e6d69fd5aa23b4dd43796aecc45b86e6bd6a9217f0ed7bda

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          0fce03e0a31009e07193fa5db94432dd

                                                          SHA1

                                                          5eb9ec8a789498defe2ba1bfaa1928ea77465f04

                                                          SHA256

                                                          85500de5d03e2141de51d2e0af9480ebaab79ec33cc07df33f20d1a1be63bb50

                                                          SHA512

                                                          eeee88b6d752713df5bb41fe2f8d5e5cc6a97463d06df6da16ae6add5dcd8e7859f194d5a5d16486ba7f8ce8a6229e78d2d2f779299d1acb9991ae0d808d03c0

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          d13b56911ee1e72170282d1961488232

                                                          SHA1

                                                          0bc6b0c52104ac5c133cd42cff8ecab701b767c7

                                                          SHA256

                                                          9ccf71bdb4ffe33d74d9d9a04941208316b82e680ca2040c037fd50218693d34

                                                          SHA512

                                                          9f3c4ea91239b1a5d833005c7f6f30c2ac8ba845c8f276e631c4c6ef0d33c0747820661ff748ed3bb1405e03df86459972bcd085e1389cfbe0e48d151284c0fd

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          e094a1189e33629013b4b2a0882982e2

                                                          SHA1

                                                          4c351cb91aa538b08518648851c6e53db0871152

                                                          SHA256

                                                          c8052a84fadc54cb2f22422968323c92e94b578391c06f8fa6a5a2ea0519a33b

                                                          SHA512

                                                          1a08bc74b7a08ebaad0060bed6bb3750e9c8997b59d1282985a454ea16888951404ad0b2d9628703c9c9968d9b558e88407fad07f503b15d3ebf32ba2d5d7606

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          f6f505efc33497a14b03c26d4bc1b11b

                                                          SHA1

                                                          c2a8213ec9af0d3cc18525455ab017748ed52fe9

                                                          SHA256

                                                          b5863b90449f1d3fa0631df7108e66fb2c2d4b1188051e9f63a28906e841097b

                                                          SHA512

                                                          374cecac2dd62f527c03e12a05c2cc92a0422596478d0c8e16b1a519fcfa6f34239fc1574a0cc37e03cbb917c3476654038d5f557093b991d0777145a228b8d5

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          a01ca325435e68c301b2e5d2fe3e1493

                                                          SHA1

                                                          a340a5955b4881009da033ddcb828babc4c17a42

                                                          SHA256

                                                          acda2a4d448d7d2719898b03d103add8dc1c8e34c8cd51931a63f55decda9a18

                                                          SHA512

                                                          f22c88c33c3203c5025046d0e16fd8361a482705b39aedcda7e03e16562b9007c0a80cf13cfd462d7f094ec7d83846c86df4dc687f8f04224b2cef97555da559

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          762e9a711ef87507d32c6b9a8b283488

                                                          SHA1

                                                          e371f4911d58f751d90325169280a2fcb439eafc

                                                          SHA256

                                                          62c1f8b572c093b625868d282690dd69c35ab9888af6238aa5d35245ce575b1f

                                                          SHA512

                                                          72380656ffed77982088589af3c54a5cec3502d9d9acf33001181ecd6135ae2eac7ec41023dafd50ba3ceaf5f65703bebfc24f7fd9c75ab948d2e9bd77986d3c

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          68da95f462ea5f1aca1b125e83f193f0

                                                          SHA1

                                                          b23d3ae048960242fce4e4df67e899724f32ba72

                                                          SHA256

                                                          cd78adc10d9e2041b3bba357fe139e830f36923106850f893890f0704d17ce57

                                                          SHA512

                                                          d8b24f31291e1848a48ed9810294c0b3560d849236d90e8c609a16e38ab2de25141a5d3ebbe416b75281ed1f277d99ed0337f623cd3309b9ed70573d935df337

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          a7fee94e69f931250c09b2fa98d79c16

                                                          SHA1

                                                          96fb036ed614006e1c0cb75efb5b3c42b5bf1c17

                                                          SHA256

                                                          34331594d1c09abe6e713cfd5b10c2367f2cb56ca69d6c95cf10e528a1b5d090

                                                          SHA512

                                                          09b8ae9dd90a127ded23182adb5abd8372fb68bb0a95bf94e0d8b48df0172a96c0de1ac03af84032474b6962e2e628cc74e78182a9efce331540e5719fa00376

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          b7823613864378c7290b857721dc0641

                                                          SHA1

                                                          0aff63f103a05cbbf913ec4e94fe94543249e86b

                                                          SHA256

                                                          832b111e1fd56e747f9e40a90d7ae0f25f39144fe42b973e281c557295f7139e

                                                          SHA512

                                                          d13e9017587e9055e7b3f1da230529eb2609d2d8eec48774e73b2bdf71a11ddda7dc778a059d0b14e49c6d970dd2a7b4663bdac53b9512539821c6a2a4007989

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          4711d8360138bfcfb3c39031120b15c1

                                                          SHA1

                                                          4c272ca1a0be6e11faa264a28bc0e1e1c8f7d3a2

                                                          SHA256

                                                          44e2e12e7c5b4dbbaa4bcc6f3551d2d7c2489b5ff57f1cc5944f1e0d684d935e

                                                          SHA512

                                                          3a8fbce00a0f54be00f5fa707fa3fa1df3ea166554ecf2b0e92f8da3b10ba69705ba355f1f114524d96811e34d3fa6024054a7dad006ca44a1985766a0470b10

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          f1fbcf8e75ab86400a3a09af0e12ef0d

                                                          SHA1

                                                          2e3cff9eea4fb6ee8292a2a17b6a8ee07aed7a79

                                                          SHA256

                                                          7d39d2294166d69284ef82a3ebac3fd89986323a092265746fa2a030d3e18697

                                                          SHA512

                                                          cad7941dad3c358987eccdd86c8fdeb198d5eb739357fafe68034d8493ed85f8ebb1eb78aa624cb1a2bc3b3a4bc1640bffb1f1f8267e601931d984084dbb0f6d

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                                                          Filesize

                                                          8B

                                                          MD5

                                                          2cfc5e0d2d3db69daab3276a04cba6e4

                                                          SHA1

                                                          519684ac86956bedba0ee7824871fe6ccebf1c10

                                                          SHA256

                                                          1857e28624ada2fd790fa3e3c6bf42d167f690586c476ec1e803125bf3c8006a

                                                          SHA512

                                                          e3ee598d80eb4550f2cf1ce57aef1fb6514aeab6b41082ec9a1fb964d858040e8262aef4da84caaccf0684d0712f93adf2c8f30e59002ffdb51a01f14a608eb1

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\logs.dat
                                                          Filesize

                                                          15B

                                                          MD5

                                                          e21bd9604efe8ee9b59dc7605b927a2a

                                                          SHA1

                                                          3240ecc5ee459214344a1baac5c2a74046491104

                                                          SHA256

                                                          51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46

                                                          SHA512

                                                          42052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493

                                                          Download Submit

                                                        • C:\Windows\SYSTEM.INI
                                                          Filesize

                                                          257B

                                                          MD5

                                                          ab8766ab989737dd40c47505c80e5462

                                                          SHA1

                                                          335422c42472272a5c6974afe871a3cf4a900207

                                                          SHA256

                                                          ba4bd5c92bade8b111a58b4ca9d3db711381209a5d7d19950852d3fda756c855

                                                          SHA512

                                                          e3e3de1e73717a2a47403317c14cc1bc4d18d549bd644b3003f16d65965f3a5c7cd9cd242c5b69982da6176e84526cb4b932794fde6e9b6707b3249171062c8c

                                                          Download Submit

                                                        • C:\lmyo.exe
                                                          Filesize

                                                          100KB

                                                          MD5

                                                          b0365cbe4709b0c5abb8f7cbfe3045dd

                                                          SHA1

                                                          b37c911b9acba495283d4c71b16288dae0439a5f

                                                          SHA256

                                                          ba805314e3d98efb42d21e96d0ca92b68247d52260158d8c34668650537fc80a

                                                          SHA512

                                                          cedc1d13a38ee015224a97802d6aef2b38c1844348db9f4b5b2bc60ec9e2c461de32cae59a3851b21902209c7913e6f2897744b1a675780beec0544d0bcb34d0

                                                          Download Submit

                                                        • \??\c:\windows\SysWOW64\microsoft\Win_Xp.exe
                                                          Filesize

                                                          361KB

                                                          MD5

                                                          47f4cfecb25fec272d69892825ffe180

                                                          SHA1

                                                          eada58c5dd31a5f3d9739c3162cd52c68f5ec8e3

                                                          SHA256

                                                          65eff6666a66ed5175d74f736c69d0cef843e1e0b835c52a66855099a264cb7b

                                                          SHA512

                                                          950d02f9ce9920ce006f2e670e27ea52bd0e95f18a7c3231fdb422aac8a67cf421c8b31357956586e2a05cbf2aff0ababa92c68a493fbffea07e9c029256ccd5

                                                          Download Submit

                                                        • memory/1072-12-0x00000000001B0000-0x00000000001B2000-memory.dmp

                                                          Filesize

                                                          8KB

                                                          Download

                                                        • memory/1316-632-0x0000000000400000-0x000000000046C000-memory.dmp

                                                          Filesize

                                                          432KB

                                                          Download

                                                        • memory/1316-3627-0x00000000059D0000-0x0000000005A3C000-memory.dmp

                                                          Filesize

                                                          432KB

                                                          Download

                                                        • memory/1316-3625-0x00000000059D0000-0x0000000005A3C000-memory.dmp

                                                          Filesize

                                                          432KB

                                                          Download

                                                        • memory/1316-3917-0x00000000059D0000-0x0000000005A3C000-memory.dmp

                                                          Filesize

                                                          432KB

                                                          Download

                                                        • memory/1316-3918-0x00000000059D0000-0x0000000005A3C000-memory.dmp

                                                          Filesize

                                                          432KB

                                                          Download

                                                        • memory/2000-387-0x0000000000200000-0x0000000000481000-memory.dmp

                                                          Filesize

                                                          2.5MB

                                                          Download

                                                        • memory/2000-3891-0x0000000000200000-0x0000000000481000-memory.dmp

                                                          Filesize

                                                          2.5MB

                                                          Download

                                                        • memory/2320-20-0x00000000003E0000-0x00000000003E2000-memory.dmp

                                                          Filesize

                                                          8KB

                                                          Download

                                                        • memory/2320-935-0x0000000001E10000-0x0000000002E9E000-memory.dmp

                                                          Filesize

                                                          16.6MB

                                                          Download

                                                        • memory/2320-0-0x0000000000400000-0x000000000046C000-memory.dmp

                                                          Filesize

                                                          432KB

                                                          Download

                                                        • memory/2320-25-0x00000000003E0000-0x00000000003E2000-memory.dmp

                                                          Filesize

                                                          8KB

                                                          Download

                                                        • memory/2320-24-0x00000000003E0000-0x00000000003E2000-memory.dmp

                                                          Filesize

                                                          8KB

                                                          Download

                                                        • memory/2320-21-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                          Download

                                                        • memory/2320-23-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                          Download

                                                        • memory/2320-11-0x0000000001E10000-0x0000000002E9E000-memory.dmp

                                                          Filesize

                                                          16.6MB

                                                          Download

                                                        • memory/2320-8-0x0000000001E10000-0x0000000002E9E000-memory.dmp

                                                          Filesize

                                                          16.6MB

                                                          Download

                                                        • memory/2320-28-0x0000000024010000-0x0000000024072000-memory.dmp

                                                          Filesize

                                                          392KB

                                                          Download

                                                        • memory/2320-9-0x0000000001E10000-0x0000000002E9E000-memory.dmp

                                                          Filesize

                                                          16.6MB

                                                          Download

                                                        • memory/2320-4-0x0000000001E10000-0x0000000002E9E000-memory.dmp

                                                          Filesize

                                                          16.6MB

                                                          Download

                                                        • memory/2320-621-0x00000000043D0000-0x000000000443C000-memory.dmp

                                                          Filesize

                                                          432KB

                                                          Download

                                                        • memory/2320-6-0x0000000001E10000-0x0000000002E9E000-memory.dmp

                                                          Filesize

                                                          16.6MB

                                                          Download

                                                        • memory/2320-3-0x0000000001E10000-0x0000000002E9E000-memory.dmp

                                                          Filesize

                                                          16.6MB

                                                          Download

                                                        • memory/2320-934-0x0000000000400000-0x000000000046C000-memory.dmp

                                                          Filesize

                                                          432KB

                                                          Download

                                                        • memory/2320-5-0x0000000001E10000-0x0000000002E9E000-memory.dmp

                                                          Filesize

                                                          16.6MB

                                                          Download

                                                        • memory/2320-7-0x0000000001E10000-0x0000000002E9E000-memory.dmp

                                                          Filesize

                                                          16.6MB

                                                          Download

                                                        • memory/2320-10-0x0000000001E10000-0x0000000002E9E000-memory.dmp

                                                          Filesize

                                                          16.6MB

                                                          Download

                                                        • memory/5828-3629-0x0000000000400000-0x000000000046C000-memory.dmp

                                                          Filesize

                                                          432KB

                                                          Download

                                                        • memory/5828-3916-0x0000000000400000-0x000000000046C000-memory.dmp

                                                          Filesize

                                                          432KB

                                                          Download