Malware Analysis Report

2025-04-03 10:25

Sample ID 250316-gg788aszfx
Target JaffaCakes118_79177807ca02ab91118156ed7da95cb1
SHA256 21a8bcc1b3175e1388f76c38f9c9ca55815989f9d8cb81139ea9033b467dbbf8
Tags
darkcomet latentbot fortune bypass defense_evasion discovery persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

21a8bcc1b3175e1388f76c38f9c9ca55815989f9d8cb81139ea9033b467dbbf8

Threat Level: Known bad

The file JaffaCakes118_79177807ca02ab91118156ed7da95cb1 was found to be: Known bad.

Malicious Activity Summary

darkcomet latentbot fortune bypass defense_evasion discovery persistence rat spyware stealer trojan

Darkcomet family

LatentBot

Latentbot family

Darkcomet

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-16 05:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-16 05:47

Reported

2025-03-16 05:50

Platform

win7-20240903-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

LatentBot

trojan latentbot

Latentbot family

latentbot

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MsMpEng.exe" C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe N/A

Checks whether UAC is enabled

defense_evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2788 set thread context of 2636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2788 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2788 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2788 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2788 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 2748 wrote to memory of 2832 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2748 wrote to memory of 2832 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2748 wrote to memory of 2832 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2748 wrote to memory of 2832 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 2788 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe
PID 2788 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe
PID 2788 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe
PID 2788 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe
PID 2788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2788 wrote to memory of 2636 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2788 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 2788 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 2788 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 2788 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 2788 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 2788 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 2788 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 2724 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 2724 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 2724 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 2724 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 2724 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 2724 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 2724 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gsdh4vq0.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8BDC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8BDB.tmp"

C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe

"C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe

"C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe"

C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe

"C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_52f2c23a0"

C:\Users\Admin\AppData\LocalLow\cookieman.exe

"C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com

Network

Country Destination Domain Proto
US 8.8.8.8:53 installer.freeze.com udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 dl.installiq.com udp
US 207.244.65.58:80 dl.installiq.com tcp
US 8.8.8.8:53 ww1.installiq.com udp
US 208.91.196.145:80 ww1.installiq.com tcp

Files

memory/2788-0-0x0000000074A51000-0x0000000074A52000-memory.dmp

memory/2788-1-0x0000000074A50000-0x0000000074FFB000-memory.dmp

memory/2788-2-0x0000000074A50000-0x0000000074FFB000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\gsdh4vq0.cmdline

MD5 a434c17728d1edb929bca77786053b80
SHA1 04cf811651976458011649777e51718e441d44d5
SHA256 380822f5b30349456bfba1bfe0a92fa8c82007dd8e8395ea8ff4365280d0b504
SHA512 b78d859c09940b2a0532c9366d2d6f23753106e64fed10f7755c91c6ab4ff101f0f3d173dc6bdf66811a814d680b48339d052ec5ccd83a65bc8547be691a4646

\??\c:\Users\Admin\AppData\Local\Temp\gsdh4vq0.0.cs

MD5 aa0bbfcea85c7590ea7c15f3e9d033b1
SHA1 8022ff3f723b7372d4dd39dc6611e489466e7fd9
SHA256 5b2ee2df80bdd2999b28a576052439d18de2d47c893b21ed062b86edf03910c3
SHA512 3e3ff768d598b8ee6e09b4bc3b9d27f51b15c99b25b01fe2fdee308396010dbec1756114ba9a933aa4697c6283e582d6e140832e602dff41cf81ce4274b1a6fa

memory/2748-8-0x0000000074A50000-0x0000000074FFB000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC8BDB.tmp

MD5 27b71e0b64e514653bf6a5682ace29e2
SHA1 87104c1ead6310c7b5c94a42aeaaa970f487f509
SHA256 e9514606a14bf12a938b47e129f6d0850bd6430f11079b19d6f07ec07d5a221e
SHA512 7d867527ceb96aae747f74794bead9e9a5759b5ed2e9be78889338792ef184c9d0ad818544c339d3a5f73581c70c2703e35b4c221fcd3694e4a664463adf779d

C:\Users\Admin\AppData\Local\Temp\RES8BDC.tmp

MD5 b3605e4a00cba2e13a2a3e142bfd3e49
SHA1 716c91da5582312291f46835a799b9463190fee0
SHA256 d6d3ab250a19b73f7828a28bbd3f288be6ee4854efb40abaf7742df76341674c
SHA512 fe3f9e4356d2444b20b248b81b5cc1ec07644bf7beacb366b261add84ece46bd29a9a8c3ba10f38b41b299ec13562410e54f34a3324810d2d30a01e55bc041fe

memory/2748-15-0x0000000074A50000-0x0000000074FFB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe

MD5 482232894ceb8e4ea8020a6bbb5a63db
SHA1 d834d0b812c2a4c4c05ec97b55ef23e6d3fe7d9b
SHA256 3a530b008c461b4213a2ea3d9025180a71d9d84c2bbfc8d6ebd4805637349cef
SHA512 f8adf919be69c672d800dc059bfc372265050dfaf22edccb6cd3638231b0ded1d1db7fb3c0723ceb1e39e44918376702ad9d2a9a18d3257a5b086493024c2695

\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 ed797d8dc2c92401985d162e42ffa450
SHA1 0f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256 b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512 e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

memory/2636-39-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-45-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-42-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-41-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2636-37-0x0000000000400000-0x00000000004AF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe

MD5 8964bf8a3bd9e77e49ff8c90e3a0d14d
SHA1 461d19ef136235f23f8ffb5adc74a6e9aa59df10
SHA256 348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a
SHA512 c1dbce797cf891ff3650846c4ea1bd104bab44dddb7d07484ad00fcb06bd36c14227065229b224a681bf5d1d94fd3fbc85182ff3d2cf627cecc3cadc76f6533c

C:\Users\Admin\AppData\Local\Temp\pkg_52f2c23a0\wrapper.xml

MD5 5c292748257ad5905629464778294451
SHA1 60881f97bf759d87c42fe388d35aca0f8d2164f4
SHA256 ef43feb50e5bb1775195ca8c44f2af90661a6c06703c0a70c8e191bf9931c1a8
SHA512 b1769d551421f119f92b62e5717565bb72e41f0288a0cc6f81621fd3a540dfc5370c7944c106499a0b474f50eeb6be8dbee5d3dc2618a8802ac90b73fde7aaca

C:\Users\Admin\AppData\Local\Temp\pkg_52f2c23a0\autorun.txt

MD5 c819368178ce1e40fd55c813340a597a
SHA1 81aef3fd883c52de4fe211f3e43f70137cbccdf6
SHA256 1334449583ff7823df9ba97e57bed51eaaba21eed4551e25b07794f1d48c3e31
SHA512 753ce58ed7b76de63f8d68bf95949dfd772e805d0ab514f2706d72b2d504fb53e9beadaed0d34d933fee4f98d3ea13172c8b3a0e391bcab639c3d70003ec71a7

memory/2636-52-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2788-51-0x0000000074A50000-0x0000000074FFB000-memory.dmp

memory/2636-35-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-33-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-31-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-29-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-27-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-25-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-105-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-104-0x0000000000400000-0x00000000004AF000-memory.dmp

C:\Users\Admin\AppData\LocalLow\cookieman.exe

MD5 a454a73e220aaff19b302365e2ffc566
SHA1 19821874dce5c11e5963fdb5a2a990694ef474dd
SHA256 89285bd50134b0b1844c6e1bdf541cd104639de1b170d492e76562fc2f80763d
SHA512 645988bde2e0a75e16c0fa5b12ee6fd7e632443be7c4df5ae0842230398b81d2e6fe04707f2413bb98e901a606a3a6a8d1e74a7fef6e89935afa944e561b4bcf

C:\Users\Admin\AppData\LocalLow\cookie.ini

MD5 3f4519b56cb1e006dfe4341e72112913
SHA1 0ff5675d359c898b6a6bdc1dff10f71097bc9927
SHA256 125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2
SHA512 78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

memory/2636-125-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-126-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-127-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-128-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-129-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-130-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-131-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-132-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-133-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-134-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-135-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-136-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-137-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2636-138-0x0000000000400000-0x00000000004AF000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-16 05:47

Reported

2025-03-16 05:50

Platform

win10v2004-20250314-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

LatentBot

trojan latentbot

Latentbot family

latentbot

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MsMpEng.exe" C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3592 set thread context of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3592 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 3592 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 3592 wrote to memory of 3140 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
PID 3140 wrote to memory of 1452 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3140 wrote to memory of 1452 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3140 wrote to memory of 1452 N/A C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
PID 3592 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe
PID 3592 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe
PID 3592 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe
PID 3592 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3592 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3592 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3592 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3592 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3592 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3592 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3592 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3592 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3592 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3592 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3592 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3592 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3592 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 3592 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 3592 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 3592 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 1088 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 1088 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe
PID 1088 wrote to memory of 4432 N/A C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79177807ca02ab91118156ed7da95cb1.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r0pze3xm.cmdline"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES48D1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC48D0.tmp"

C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe

"C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\svchost.exe

C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe

"C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe"

C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe

"C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_52f303810"

Network

Country Destination Domain Proto
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 installer.freeze.com udp
US 8.8.8.8:53 dl.installiq.com udp
NL 82.192.82.228:80 dl.installiq.com tcp
US 8.8.8.8:53 ww1.installiq.com udp
US 208.91.196.145:80 ww1.installiq.com tcp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.200.35:80 c.pki.goog tcp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp
US 8.8.8.8:53 duckling232.zapto.org udp

Files

memory/3592-0-0x00000000753F2000-0x00000000753F3000-memory.dmp

memory/3592-1-0x00000000753F0000-0x00000000759A1000-memory.dmp

memory/3592-2-0x00000000753F0000-0x00000000759A1000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\r0pze3xm.cmdline

MD5 fa0d42e1b35bd2b338d47567b618d34d
SHA1 22117b08c08e501387f2f32887725de6d76171e9
SHA256 503188fa5e7a1dfa3d30927dcc09af2a81e633078a1220278c78856d0063cc90
SHA512 54c4222644b05a58f6cb3acc30d521b4ce798fe1ba27f469176a9b6fc02f8b9b2d558e855dc90815e9cfd451c5c02833d5a7ceb805930eaa7e815655d1744800

\??\c:\Users\Admin\AppData\Local\Temp\r0pze3xm.0.cs

MD5 aa0bbfcea85c7590ea7c15f3e9d033b1
SHA1 8022ff3f723b7372d4dd39dc6611e489466e7fd9
SHA256 5b2ee2df80bdd2999b28a576052439d18de2d47c893b21ed062b86edf03910c3
SHA512 3e3ff768d598b8ee6e09b4bc3b9d27f51b15c99b25b01fe2fdee308396010dbec1756114ba9a933aa4697c6283e582d6e140832e602dff41cf81ce4274b1a6fa

memory/3140-8-0x00000000753F0000-0x00000000759A1000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\CSC48D0.tmp

MD5 27b71e0b64e514653bf6a5682ace29e2
SHA1 87104c1ead6310c7b5c94a42aeaaa970f487f509
SHA256 e9514606a14bf12a938b47e129f6d0850bd6430f11079b19d6f07ec07d5a221e
SHA512 7d867527ceb96aae747f74794bead9e9a5759b5ed2e9be78889338792ef184c9d0ad818544c339d3a5f73581c70c2703e35b4c221fcd3694e4a664463adf779d

C:\Users\Admin\AppData\Local\Temp\RES48D1.tmp

MD5 49c6c337076ec38e4f3265da775e2c53
SHA1 5e0e09bd00286df63aa423f2fb4b565c326f8c60
SHA256 21ab12e54a86dc1cf3884b5e23c743673682511504ff4a06cc7b73f8a5972b63
SHA512 44e9c8a7c3b1ec1bb17df1a5a919cf4a3b0cee76483624faf4722f34510866158b6f5af6972476d08100ed5b612e48c5630c60c7fbfd0564adf4fddbd5b58a74

memory/3140-15-0x00000000753F0000-0x00000000759A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ƳǣպƱƒ.exe

MD5 260d145f42960915eaf80b75e4353b39
SHA1 8539fa7927788a0780a077368c05a2fabdf17397
SHA256 6fb6a7143b5fefed2c72a44847754f400bc35af742c8cfa5eea5cea48cfe3e45
SHA512 13d5375a7fff532c938fac79d624f0979f00e03a2636caf56825c3d04354ed7761eda66d5e3ccc2c5c21ebf2c11e798d2d9affa81ecd5a9090590742d557e6c4

memory/1332-21-0x00000000753F0000-0x00000000759A1000-memory.dmp

memory/2800-25-0x0000000000400000-0x00000000004AF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 e118330b4629b12368d91b9df6488be0
SHA1 ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA256 3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512 ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

memory/2800-22-0x0000000000400000-0x00000000004AF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EpicBotCracked 520.exe

MD5 8964bf8a3bd9e77e49ff8c90e3a0d14d
SHA1 461d19ef136235f23f8ffb5adc74a6e9aa59df10
SHA256 348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a
SHA512 c1dbce797cf891ff3650846c4ea1bd104bab44dddb7d07484ad00fcb06bd36c14227065229b224a681bf5d1d94fd3fbc85182ff3d2cf627cecc3cadc76f6533c

memory/2800-36-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-27-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-39-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-38-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-37-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/3592-44-0x00000000753F0000-0x00000000759A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\pkg_52f303810\autorun.txt

MD5 c819368178ce1e40fd55c813340a597a
SHA1 81aef3fd883c52de4fe211f3e43f70137cbccdf6
SHA256 1334449583ff7823df9ba97e57bed51eaaba21eed4551e25b07794f1d48c3e31
SHA512 753ce58ed7b76de63f8d68bf95949dfd772e805d0ab514f2706d72b2d504fb53e9beadaed0d34d933fee4f98d3ea13172c8b3a0e391bcab639c3d70003ec71a7

C:\Users\Admin\AppData\Local\Temp\pkg_52f303810\wrapper.xml

MD5 5c292748257ad5905629464778294451
SHA1 60881f97bf759d87c42fe388d35aca0f8d2164f4
SHA256 ef43feb50e5bb1775195ca8c44f2af90661a6c06703c0a70c8e191bf9931c1a8
SHA512 b1769d551421f119f92b62e5717565bb72e41f0288a0cc6f81621fd3a540dfc5370c7944c106499a0b474f50eeb6be8dbee5d3dc2618a8802ac90b73fde7aaca

memory/1332-94-0x00000000753F0000-0x00000000759A1000-memory.dmp

memory/2800-108-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-109-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-110-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-111-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-112-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-113-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-114-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-115-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-116-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-117-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-118-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-119-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-120-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-121-0x0000000000400000-0x00000000004AF000-memory.dmp

memory/2800-122-0x0000000000400000-0x00000000004AF000-memory.dmp