Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/09/2026, 23:10

General

  • Target
    jaffacakes118__29f4b4394a26a17fe91365abdb16c994.exe
  • Size 276KB
  • Sample260920-257mtafn21
  • SHA256 1a660609e95609b1d85adc489fa7268059f50a1dde61e4d7288476fe2df35d2d
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • apoel

C2
  • 87.228.229.186:6881

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    spynet

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    1571986

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:2140
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118__29f4b4394a26a17fe91365abdb16c994.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__29f4b4394a26a17fe91365abdb16c994.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:996
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:1620
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
          3⤵
            PID:868
          • C:\Users\Admin\AppData\Local\Temp\jaffacakes118__29f4b4394a26a17fe91365abdb16c994.exe
            "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__29f4b4394a26a17fe91365abdb16c994.exe"
            3⤵
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3248
            • C:\Windows\SysWOW64\spynet\server.exe
              "C:\Windows\system32\spynet\server.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5664
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5664 -s 636
                5⤵
                • Program crash
                PID:2644
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5664 -ip 5664
        1⤵
          PID:4692

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 774a77ef1eb5f92ee66352e2d6dbe9307bb05bf529c55ee671e0b3e74b8b5bce
              • MD5 SHA1 SHA512 SSDEEP TLSH

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea0d035a34dbbcfa43c2f544832b4de46c19c7bac93a89c763798b24de77f447
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8951390a179ed5739b0af8828b9d541469ac162a82545428cb74f87e84fc0be4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5278d644f53fa20cac5692b385c01301021611cf6081058d5c1e9ddafc91a891
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b471f417f22c99aea9b06e5a9890e04ee5e9949b94e0ededd1a00d3239c42615
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2a01f2714508e4543eccbb8108e1ca879a5a8bfc71fa2722a7aa07772dd6330
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf1da509030ba98bb433de749fbc0c9c8097f64e8c27f8671cd9bbefd4c56c6b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ab1f8559d8ff3f2d50940abdba70746267c53678aed3ece5e7fdb36649717af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd8d43a916028dd5c885ae732a250a4f8fc26889285916f41f8fec833ac84b73
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b7f16a4a2b6e84b2b63b4ca5263a0797916953ddd50377d50b89b7a9d0e2479
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e752af4520118e3c70522f2ea753f6ff813e94c830e82bc21d360a0511def70e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0aa029cfdfa4b3f0eb11ca098b762d806daf26ce28427be057b30adbca95ffba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e88ce18b54f0a32b75a4da2c737bab14917392941249bf15a5f29dccf579b2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f78d5c510c28815d62153c2d269031cb107e813ff89160e44b204ac7b45195e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3505f826fe387b43a4bcc2f08d766423898dc13d043d0083eae198504cbbdb6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2ee3d95953f846b2becbb536f7e4dc8742fced031337b29752d1840dd5dafd1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 912de777c227878840073929dc1415b3a69a2cf3c850c12cd8e1c43ade42ed62
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2bdfa27e6219bc54111d4d33a52b59bbeb01478932117002fbbeeb346766ce4d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12fb87c5c8f6c87855890b1d6283ef078f951fde171ddc77ba121967b810beb6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bcd0390423dd684d46047d5e65a2feb0762c6bf6239d5f10b570c2946dc7811c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9415fa0e3a1f4d48d121778c3b830382bf494ba46450c65d37f895c521b866d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6af839b3beb8f85c771d55e486d2bcfcbe8ac60d07049b0c9f5e43bc50bce0ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6daedfbf00520a8ce8f262782cfc84dd07781547abfb6ad759883ebc44c9f0c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ab29ca17a644b3363b12e34572fdbe85f05df941d1023615cdac87451f2af7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98e74e38a8f085d67b67e3294e174557f25ddfb9616aeab4724442c74d2e8231
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9ff601a517029b0161f7e2ada025ed73c489b5b05e14f0adab072deface5f1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65a1ebe7da1f1a4eec31d01cdb27caf90c781ee8f449faa0bfd93ad4ab360f3e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73bb1b7a417e684a265469e0997fa32d5a1a3b9666b7278ce67f0bc0182cafca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1a8eee37a12ae5c3f160d32d07ac791a266c4be6b2d565b8e17aec6637f39d91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40b58835da7e33c4114b107c7d43e1f2bb31ae94369d3bd090e3d447fafdc4cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6213aba2a7dc5afe3f85a74d8c281b0eb6ea16d180d0b84d9b7d39a91ec598f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2416d621c5050d66ae1419152a8a2a7d7772262fc565a2b7b94cdcb531afe214
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 655500f05f60aeef365dc1a5f96784aa644fb72076633f929cda6332c6b298c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad716e34da62611f60feabfc320a459068047dab36b43d9c76a43b488a0442de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 51688ff11d2b97840ab7bf7f2639da1cfc3c5bbffa187417253ffa66a8247fec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b013eb3e188f4915eae3d6cfc60af822acbaf981b74da502afa733be378e84cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5117a26a24a03c43be0c78fd54ac4b2c54d69ce0ebfadc6c07d5bdc0bb9dcb30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd2978f4cc22716a1dc66ee75c8d67f013d2a6993369f3cb90b7f4bf98d394d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ae78f9f484845fb5391c7049e1d5644d93602bbea446217311e33a74fa1da63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a3b28ab488100dfeff42f97c6375c53ebdd2dc863d5d9beff10820fa0df8616
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a30c0d298fe4e78a0d76ff068910d664b4d5bf3c98b953425644cd349e6c0b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 61b3a80b1294afa87680ab68cd58c821ccf6ef6513d0f0ccb87c66791cc9a312
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b38dd6a64a96f2c74857faa2bb1abad541ad8c91f14396e4ad2317d8caf8651
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd0d486f66d606c9cdfb57750b2fa148b64d7e01e3258361c90fa9acd02286b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cae200bdfd2ac1acdc6def3b0a2eed8ead17209844c5b6ab63a426dcf49c437
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c449fe8676a2bec77b2d1ad70d7ace736376a0bea0910b00f3a258c7ea34938d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc38d4d55e713cc4e3996b1ab186b336add6c42dbaef09068f2ff0fd30805035
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9dffd54a2bf3a8a80a59a14a4272dd92fc2af7e839ba7e4f90ca83b1805f7750
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72bcac5ffa8a99175429fcab7999ceac3c2f9b3435ea480838692cf6c5cf9da6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a82eec09e65f1048c4771ae10ec381c8293aa19a42fc8c0a1ee56389df7f2c43
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50ba4fc79771a0ff7dd0087c01ab6e9fe80b48e68ca8430b8d009c76127f0c79
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 637f8fdfcd027869094303d63fe788b21db4fcd84c38ba76b88d1eb5f184da1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7872ab290170aee7fe7e2e6b63af6f6c3d14bac529579995c4eeb315ae50c2d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec05e80b87ecac37efb6db98932b13cd24ff02e92141766f9ea7ee7aebe3ccb3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77b9c923786a0a58a214ed1e38dca1641a0eeb4053b88af41d8c3715ec8b338d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ccbadf0a4ea76af1ec759aefd7aa329a60e20acf49c9804ccc0aaf522c84a357
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a833a57c3ad38d62bb6009f86a0f7e9652909d8aac2027e6bb8c55c6cf61127
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e344604d075fb9bd4d3366072278929396a2d30aea16ea2ce7183551b3cc0b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55aed45cb694480f9766df658f661c0434adace65a505f983fe2426d89191b7d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c58e024e66ea1e0ba2a70aead186d403a11e04374e3dbeea0c6e3ffecb3e026c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f98e861e376a2d40fd03bb97f097773b8f3963c71cd3f0d1baa88af03d9b77b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4de4536fa8d3749371d7a5f0360e86f3e30148e68fafac9391c13bafe599f548
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1de9b5515e942c4539f9b1768bbec621efdb7e9acccc294791c092c7837662bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c45a29ff58394fca7e3bbd8b1af6f40110e436c34bab5180db6b7b0f44185715
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f73ecd681ea89882a538263eb710a912610df0d906a43848c1c01c4b98442f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9ef160c82b78a63cfc3158f9e0b25c897275956b54f4b6275c1e40129eda9cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 601b0b20132152cea511f509435500c6f6deb009d139555cd45b2dd40bcafb54
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e6189f495f97b67e83ea1a2c0f9c3528144a6702ac363016de99813c0fb293d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b206b50a8859c6026864202b275fad4e1a2cc6cdfac3e603d7cc9a31097ba2e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8bf9f4e79f47c8d80c6449509505013825a6fe9bc4ad9e3d45b3cd411526d147
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d75b1025f699e285c317a6ba38ba20dae2d9b43884cddd03010f6aaf8d10349
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f07c7eb5e49caac9e875add72d9986b39afe17472b422cb5959af62ed5fa4bac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73599b2b13f3934513aa97b7f3d876e9439e15bb77a3d42b07237fa37470d708
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4dfb3f7fb4c8f1715ab33ef79b34b3a5ffed8b9cc8f080589b4c611c49b13b80
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35d790b1992e48f95a3d0a99f4739e6caa903bd66f4b31fbfd59b716911394d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a6cc651f0e2c4fef5c172af1fdac6a8f17ff1d27d9e32c8a33539b2659e3b06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d45b1083c61cedefc33956860bc9d4e92e9eda984c5f5bd41620b86c7a79926
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1087053a3a9a53b373b587247e4bfb76bf472ca1091945dc2edd65f242ff79d2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa9f0735173bc57e032e1816aec58c1dc0d1f50718a873e604c5f269be4d2197
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2cdd6a878fea653350aa87f2f6513446532b8f19ccb962c7fb98e106a46fbeaf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70e752f648a728555de9299876143d112a5b3ec5eb090ef7a88d41bee9d7fd26
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25e79496fcbffe0917f4ee92fafb80ac266719738cf9cb773254bbe5bf2cf922
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b698b67920777cff0ec53ca68b40f6f25fb338499433614747f20edbdf285832
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cff1b19090652bc32ddd4cc94db5de85aa0f03104d72c0fa043df96e41ff6d6c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 704ba7ca85dce8fb931fe73eb7795180b93f2890c930436b7c51b485737f18a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 378423ce454ad779a439c9d148adbd26c43dfed246ae5f845207301487f7c9d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 edf51772fe5a80bc67fea4fbbf74f4f64997fba413e53b6eb96839871644518f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a79f6b2dd9599b521d3bafbbf21e2855c7491bbc06d5157e0c5de886350a17c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c1f9a3d091d25590cda757904852ffd56787ed114d5bde45dae6608212d5dd1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66b561b55bfd96797455612a7501c2bb440f10d45040ba67666d1c1109c5c57d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 823feb111b00b33f154a223ba6653366ab103e1c18821a165d36c6a1f254c91b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32f4208bc859546b1e1da302677fb9679e624af8720218266b72d26c27c4704b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4180e24c8beec87d034be89d6c8d5840a0d88c00e8fb7fbebb855813f301c8b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4233d4f345ebe7e6a9eec1bb0d45ef75076c486d71a599e566c10b5404fa3f1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82fcfd8d1e0fb191c7e38739aca812901291e4d6e1eece76512184d363817282
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 641d7de2f563f15264150790e8927514b98dd5a69f2a352de2604e96821f6264
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aab99a9b2c27195623ca0dfce4bdb1b10247e676d09033928a3009177e1a4207
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60436d1c7307ff0367ed966ce88bebc43876076135dadbfa1143b7a53bfd2c0d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffc1c9a0625c7d1395e6387e176a9ad516d919f60d1a29a1d3c588e96a55e23b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8387dcd4a47734c00b100809134e7865bb0d6438311391953e68d0a5c0d61b4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71f57ecf1c0e5eca22ece6303899b698603b630dbd94d1e3863e742638ead52c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a8bf5bcc35162f646425cf73472842aa1ee165d3a8f39b90b0547453b56af72
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33614699554121887ae875c0c6877231e8be41ee6720404c39e3f50b2b42694f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bcaa3e13110450d52a6afe97ed028122cfbc71f9b286353fe8c85dc54672611a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b6454007f43de714684a043a16ceba823a1aa01a7ca3d6507e43484bdf8acc7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4bb590d961ec640508cf19a07cec970c213c7f7fd8b94c73542ccd779b82729
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c49581be2a1dc14c0030be9d487398c11513959d720c75ff35234b4f92af44a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fbd25e53f059d5698e4ab79fd4af1bee046613f866136e4c3bc45f004f4f59e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e944ae4df26e5879cb2a09ea939b91f56ddb8c426bf437d3c3ad8966bc3a536c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 496a7bc1007765361beeb201882408d50777ae4ce3c7f5e57a6bc26a1635ceb9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3d4e7bf51adba599e0f22c0d23253da14638c4545cd807a75c102e6864806aef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 593da1c3113896b70b9aea58df1c153c8e06382c6ebd529ee44d9244ddbd22ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fdab1362a824efad9fa2ea8cc8f3c59f3abac10d90f66a968d45b122fb0e5337
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf7c700b331e0ad8cdf838ebb74eba62bf06f76cac41c53bdf87ac3899459096
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c717bbc6a7ba9785dc5097653c90d23aa4aa971834b86a93606578aacf8cff79
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 791da725655ca1404523e706b54714e0d628e68c89ef38627aa23353d2164408
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7170300b3091cfb97292eb2195510c597903b64ada47b4e6abb2c69a417fd9e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f1d73092a1435cd4363e6533ed8d788f39e78a8a4c2cd0cd351c05da73e70c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a781c5b94ae4b2e2c4e47d71cf6aaf1245f850f3e22ad89c6b29a09df9a94a8a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f63b034f62f79d5c09d96e2747b273c95ea00512476f953dbc8f7a6efccdb809
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c57d533dd8262c1b67bb4e4777fa30969d5afa5c443c91acf253350640bbb58d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3065c2141316c73b64d83040220ef83850780bfc93e7fb440e75d52cdbf2699e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2972dd6f12e72bb65197904a2a46cc9f259eef9b1187dfc0513028f696e0c01f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1eccb770b0f1d4ade491611333cfa7fcd1c3e506ab6b49eccde98097a4edd2ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08dea5023ea36f3f0ec1647978d6a47cf4eeae717d64f68a1faaa07a37a820e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9b2350e0ee39448360291ce54f9d6195877e2a753609ea5b1b74eb994e8f5f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1620831ea53412f95a2e83c9a22b3de3177b9f1f71ce2f907ffb51e44b78b6a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a3744e0d362b88e4fe3629cd5e09fc8294edb0e4bbab3737a0ae6497271028a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ebbb7ea515fcce1d41f2777c3c4d19d75d41c5a03e888e581faf29794540570
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf0a5b01768c11ddff6c6d5eee603ccdfe451022e9625db2860ed20ada367dcd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85c01ca89c11ffb67e05aee817ca6a6c7627b70b5666441a56b41318b99c971a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b30a58ca747d1498f6446527040c386f5e334a8162e5aed8ac038cb3706c230e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 115a9f3dad18231e2b9c4640947567405273fe0c10218a67423e625e4eaed76a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf130f1ff1255d011a240f8919bdd62a19334013a7070fbab5756fe2a4c92df1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f860cf3b7acee3b28012cd791bb5d75dbc88e5e80ce5af0d4192d449fa25c51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8be7a7ac84f5d83b8c0be60e9b8871610873f934ceab26545d0bc0fb35aae31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b749ca0da49d4d6edde09bd31eec535b9b37d0b50cee7ea836ed1fc652fd054a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f78dd219e846f6e718589bc43fbf2e81c8cff5351572b66bd92d97438a0ce47f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2497d67041c416748d44b5d68c33353ffdab53fec9aaddd6e63a673732a1179c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b96c9e9148b08924a64c4c70a594bb23b0cb0942e0477a977c4139df0cfbca94
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\spynet\server.exe
              • Size 276KB
              • SHA256 1a660609e95609b1d85adc489fa7268059f50a1dde61e4d7288476fe2df35d2d
              • MD5 SHA1 SHA512 SSDEEP TLSH

              memory/996-0-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/996-138-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/996-71-0x00000000240F0000-0x0000000024152000-memory.dmp

              memory/996-75-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/996-3-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/996-6-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/996-23-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/996-2-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/996-65-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/996-132-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1620-8-0x00000000012F0000-0x00000000012F1000-memory.dmp

              memory/1620-68-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1620-69-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1620-67-0x0000000004730000-0x0000000004731000-memory.dmp

              memory/1620-7-0x0000000001230000-0x0000000001231000-memory.dmp

              memory/1620-162-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3248-163-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/3248-136-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3248-165-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3248-141-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3248-140-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3248-139-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3248-149-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3248-150-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3248-155-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/5664-161-0x0000000000400000-0x0000000000457000-memory.dmp