Overview

overview

10

Static

static

10

jaffacakes...fk.exe

windows10-2004-x64

10

jaffacakes...fk.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/10/2026, 17:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_Trojan.Win32.Llac.kzfk.exe
  • Size 600KB
  • Sample261006-v7mxvsd18k
  • SHA256 d97c658697ce83927372a93393219eb03938063a10655d5020ffc5f1e038451c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
vítimadiscoverycybergatepersistencestealertrojanupx

Malware Config

Extracted

Family

  • cybergate

Version

  • 2.7 Final

Botnet

  • vítima

C2

  • hacker768.noip.me:81

Mutex

  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    sever.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Error

  • message_box_title

    título da mensagem

  • password

    1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • Family: CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate
  • Adds policy Run key to start application 2 TTPs 4 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 3 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:1060
      • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Llac.kzfk.exe
        "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Llac.kzfk.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2564
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:6128
        • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Llac.kzfk.exe
          "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Llac.kzfk.exe"
          3⤵
          • Drops file in System32 directory
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2188
          • C:\Windows\SysWOW64\install\sever.exe
            "C:\Windows\system32\install\sever.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6772
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 6772 -s 620
              5⤵
              • Program crash
              PID:7064
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6772 -ip 6772
      1⤵
        PID:7000

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            XX--XX--XX.txt
            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 588KB
            • SHA256 f25e5c21f4fe74ac1ccb85d4da2775b9354918f8ed6cabdb1873198a36516c7a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35939343c1a265c219742f1c52b5da16a046c1ee63aae1ccd1c30a9fdaf75afe
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a76b4793d2cd47b3e4cbcd0dbcc9d2196c9eb93c538d63a14ebcd7e2da5b7b2
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9250aa3225605711f13042cde29b3ea83fcf44106d5775d436a757be2a5e9335
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64f32b5a95609aecfb5523dd029db979bc5b8212999f7cc127d912814cc22758
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 163c07e22290199b6cd2eaf657d071bed182424ddb49b768efb8434e3b2aab78
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d917dccef7c3b49ae21ce24faf82793d3f08199be21063be2671bc213324f1f6
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 967ea339d90d41cd366bd1ec46e12cc972911c73dc2bf8749f361127b9c8b3f1
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d5d4302f3e2ba639e00f6428d230fb2bdf01404d846e54d822805c49239a913
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 037febb21df2c1c2692d1d8cf0d8790bc5794b90f6989bf7380873dd711c7f81
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 475a4815a26dad3ae00d485a8014dda1be5a248a2456d96f1d67c097563594f7
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 691b8e6ff7fe29afe439a70892e2ce8fc5d5eef1027b7c00d8e8659a3695c8aa
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b491891083d72cb3e731f8c7afc1317830569b34afb3b99fdda265cf29eae910
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05e79f83e4bb72a475b3f98b84e139cc26c0d7f46ebee90b03cbfc1f45d50a15
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 382f5cec0bff12dd7cd362dd7142c0dc9bde72907647fb46e10116e33fe761f9
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35452cfe3d91f0eeb452fbcb26a98cd201912eb77e82fcd06de6d59b1a7b886f
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cb1a2b7d84e16f0eaff671a47dda1e14d20e2e6cc7f703c33c032e8453e6f16
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42e4226a6abd939dfe7f149199c1e2b843d52e06e3226cfe6b09b0e5763891c1
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d235b07fffbd280fe991bbc631ecc3ff3cff11e8400dec5e5bb6a8e63fc05d31
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d908b136e7e1696472aaf2230bcfcb0ba433abc8ee0bc0f1598761c6f02d8467
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81275eafd47dc4342bcd9db12475cefc53b1a4b9e9bc67ea54e77b7644820786
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ed5cfca5366f6d7285017e030a30e79d5f25a3c28cf69ac6242f0432e563ad6
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1e1413991760b09f860fcfbe03bb809a91b955b3db00ef99588beeb5781da5e
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27f480c996fe492c66bca5c76cb26e59a9b7c6ec0201ebd1a49da1362bfaa063
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fcceb1c89a0a922deff4f975251253f1e6d0e17e051faadfe794128bc194ccd
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1be34270b09708ca4850c29c9854cba27cacc99c4aebb4330444b236f02129de
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 167098ffa5ea6f47c08e1fec1e89f10afb48b29291e35d669f6e987120fa5b19
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e7259a0e3263c7915e21f03781cba1af4501b9798121ac8692448279baa0ff4
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53d8d0a96c7347edd6ebc64442ef4bb23cfe3580d8128198b4be140095e20b15
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c55642586159ed203b83b1ecc097445114bb387dda8f45df3b47c1316662fda
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 300f3254452d6b6cad9f06c1460e8e2d31b63109008891332afae7b09086f58e
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7d4c67cf46b40e6de4bbaa2deb0bd531e55e4e50cb68eaa5c078ed7256a6cff
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16955e095daaf23f43b74da4946894599f7c860ec626c05cae26f62b28c16c2b
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a32e2a4e39c5d427f1af2fee06de14500cae6d1dd86b29ff3b40e3941703fb11
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b188ba2aaf2bf90c97576ecb7fee9303902e811235af8d3fa0ec655f654cacbe
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f28f88071e82bc2c9af56aa9a04b7ff15d38e9b42f3261589ed69953505cedc
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d088ad5e7b275772456765ed669edbb6f3fa0030973fa9c305849ef84dedf751
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 faef6c6236dc575d1144d0a5c7658a7f0ab9626046cb5eb8a8451ff5eb92c22c
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74cdb89c7b7fd0ea50916857f47aec11dfef0c2f7c6b278bf87df2e18fdefda1
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 307c70e80a54945beb7223c437dea6a41889e0fff2473b6ced4b21870f7d2f13
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e65c7b42a85bc92dac424e44efeb9887c53380916322597b0019a7380ab6892b
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b02020329c8de123c23314c7f5fa0930c6ab3450922f9a87982e57465ff2075
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b399b419d7e0fe1dc35c90b2435b0a6d4133a527a8000300f8d867a9e88bceb
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59678503a7358ba9eb3a73171fe01a487353ca4b3e1d0810a5d6671782ae7983
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 687192d71ecdf7a67ffacf3b66c8a72e60388945e79ec6b12d0b3abd2156fda8
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4459e7dade8da70a142d4d5d0ba991a2eaf0372998f3b110ec450f9e6422e291
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a74506df6d9d907652822a4da7d459b6e88218083f5c971ccbafbe045d31203
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f1e7669ded6123a0ca1061bc66983d5c38cbd928b9a705871efb3608efe7312
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab155195d07bd0b7858c8ff49a9d20c5111b7598f850578942b49215f9e89e2a
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a0059b7e6666766f92282c939baf50e58f120a8ffdd8958782e4af152d32354
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5faa88a0fd110799d109fe78db4e793130edb3f36d217d6c8aaf22f0e6f99b55
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8b0b65b3e718ff0dd659a23f556d975e6fea3d7f5be82e90f15ec5f1b246520
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a30014563878c1b8da1e4fca62a7e20d41c4269394ad09a06d4a4587825f2c14
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0b7c6030f27ef9ad646f5bce18136399e3bb3630da6075696b127219fd4d9ef
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df3c6c96f7e3e5a286e6fd88b9ec31b7163baffd17feb904b3423af732824d75
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 039f92e2e392ba3207837d24ef2a8997f9731ff7a4c38e0a7a478911605d3451
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35e2d54083a4c07c24431c549f501462c3f9fba0c85b79359c59578f17e9d10a
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e39c3edf8eb145066604b7b9ef75dafb1539e6b9d0295e807456e5cc142e7a8e
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85c7808015c27c19e03fd89e7454fcc962707589dbf32deeba5b926dc3d653c2
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4444a65cf14388a567eb63f434354abad4b17a700381637741eee9c60728451
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f914da84a822b65e851d059e14b43946126b300d806724ed34658fb42b098631
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0226e93f969a268ab673f97f40589c7359ba1905226add686aa2642080703401
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93101193e2482026afc3efe04d46d625ad256faccc9dab9a6905d1d09ec0058c
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ecfd3ae8b59a3863f3ccce5796390eaa88194f1b4ca887adc3353396a5dae91
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46c339c6fdb02865124ffcedd7cab6e476b9119e1c00a077214c3879599e6452
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7676bf5a3a76f82e7c3435e58f2d5fa84fd7b1893274731ffe91667a68efb0fd
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c832b43dce0806c55ae7b84311487b2abbaf779e01ceaec983ee56f6e493160
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33646f640f49dcf90913198c3acdc44fffc4326b72cfc47a9d9733567e47ef46
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 622ff0da88d92f35705fcc89879d7f6a38648921ad96230cc84f76c0f0b0bdfd
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a73bbe4fea0798e8c2d601a914d1f50b60a0bcf4df8cc777458aa8c7b24db03
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b6c32a4eb761ae6165edb1188e0247e0a23894627124e6014ee1fcff61a974c
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6ec8c22e6a29a06a765878673726686e58c0cd5248b39ec8104708ce15b2812
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6be699f562cfa967c40aa55387a592e2bc48815fdcff1b4ca81f55a1851ccf3
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49c73aa3c5baa32b91a5a91febf26006b488fb1645477e1a7232d0c00fd83e22
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 959a342a6b1671acb21c09d1ae75c8adfa58aaf627b6faa963a319d9909b0a76
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e17c1a9512c71756db9e8fd08795b2eb7b1bb594f902b25e632a2f5ac5b533c7
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 280cba1cce1e83b07ad55a63f45ca5b113d07227622d32b84b36cbd32262f4df
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ba600c40e3e225bc5d01cf60fd82421698d091742d73a880c988ee6865a4d82
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edfd59efc3a21d8315c2cd72a005e8e0e7234ffdb97e0d9671a952ef03ac95e6
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73041f4f809b4739fb48ef4e6703fc55d8c4991d4bd12083411275435171cce5
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a154ec1d97edf4a9e24ef9f2a4e36f5852e997b2b59aa3c04042de448c32112
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6127ff2235c10fd38ab7a1affecb7e13ecadcae1414920ff0e262853dd74fb41
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 242d339c29bb24c234030c844fc27960f9f1265b4053be099c1d9ccf11ca796e
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68d4bd7c02512ff5d45ea7bf80f267b6e96297992fc79b771d4a9cd6fc85931a
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 610aa6700979bbeae7fe19108df33cf81bd8db51a769d2f1fc6b3312c9b15d04
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7bca40449c54dacbad578570e0b7d366882c61cfd92d8a5719a09ff2ab2aae8
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3302dd5f37f1d0dbc1ffcffc12ba288a5d0c4dbe6e8c8bfca4ecdb3c078aebbb
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 303bc933b295fa88963c70c808677edd64de491068b9ad37c61a146bfeefe765
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f99a8125c007bc881e1b346646ca71917ca8548401f6a9123e566fceadbcb3b6
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ca99e22ebe909fbf3202bbcbba381d0b84f2fc44c277a6c791abefdc36b0efc
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fbb822b79d15f13555a3cc0649b66fb4420c120133739f61ee2f87f765c49545
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24be19935a14e87c7a3aae4428f967853fa27368516106e67086040f9d5b0270
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 981718fdbef0a994f4b083266a13ad16e55fe0ece0025e0a9184e847e29ee44b
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30174bed145115787e252c00558eaa2c63ee02339a31aea6da7ba7f92c1a1203
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f6e432d59b32e7132d6c82ffb1e5293a579b2a41be99f59ea865ec39ce0e878
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de502fdfbb2426df6c47c9a0bdec7eeac9a54fbad41cce3cca69d9bea7014413
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63e4c46558c85fd11d6b9e9814809b9b89db5bc6ef6e2f43867d92409684bc21
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ededa902cd19a30cc13bb796c91d898553b085fad33f2c2d33b6b37cf253c87
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e38068301fb9c43a54de0e0d19fe3b49c8feb10942e24c84f0b07ee9201fd31
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e517ef88a552260965a7f69195e7b9bfc58d3ce55991c6779745e41485fe146
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e5e4f5aaf6a8862c6bde8a7252bf9c5e1adbe2badf601e3cc61dc538fe76276
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ba9491c775f219fceed1a1143de4428fb3e40941a9c7f6fe9bc00e21af2e31a
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0f9827e53d06c703c253ba5a2000531ee813fd89ca4d33891457841c99ab6c9
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 278256008d3797b4b97b452874807edbdaf64fe6d5586954d7cb4435780dc344
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d6924e79aa92f6af4a883ea1a305e886a950b96167e0c5560623a290cc3c613
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6957b27287bf7409d73fee1447a24cbfead33235ba11fefb481f732ac455877f
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92b66272457ed281fba30c78765bb378e9e08f2a30627da70cfd05637f937299
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4246b61dbce322ce1f02f772c01501f7e96ea843d47dd1a9ceb7e3ea779777a4
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 996496a828b56c00484232fdd404d9bff69e9600cea9ad8db40bddd22106d7a4
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc89b2d6e3aca357902fa3e7b651607885bc1ba8e76adc17f389a5fe4f9db156
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f5b7e2ada864a308eb642fd8f3c84a63d7105e1ade1431970ece727554a0a48
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff35d9f964bafa3ef5f6d9836ba709b30fd1dd819a1f87abe9f95c73660d6328
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18745f09ac01cdbd419fcfbeba9b27caa89c7d88b6f85966b404a8a9ff41252f
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a2cd100d7dd8274048eaa6faccf8e8c62dd3127890c360ed81620b696fe1ed7
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee8d5f0d9dabd5c93067476a15da5101e7405a14dfdd1c3f86927cd27b23c6f9
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54944e9ecdfb9defa1910d4020e3ddef589364a72c57628dd2a5af8ca4ba55f5
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95997497f04531c8ecb4dfbaa95c74621112171f5d5a7583988b71cc3d9c8b5c
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a36cb7bf58cd96ab63c2d2dead0a35a133921d2fb328539d4a13102b21518286
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d01ac8ebfd6c5fcaf03ffef01b7a42cfe3878c8266a94a7ff2437d1435c1741f
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e84db527e23bb39161f6747ad0ef9898aee9961e8851d9c655214fd4da65c7fd
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce105758d0b47ee9428f47f18d3ef356730c356c2ae93cd46525e4858f445288
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6db45817b1c3d4bd35a6d3167e7cf9664d6f4ecf91bb28c0e53dbcbc01d5948
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ef3f782de48c1d31e08774f8a24324866097421102fec1cd3e92248217cb23c
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72bc3c80f8a6f337752f24a18a9a9747fdfeb14801b2a1754b32bc0128a8fb35
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bad6351d88aad10fc120371df73b6b2ac17e9ac6b7b9698bd66e60ac0db81eb
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 164e654e2566b7b8dc923d8123df199b445bde12b7830a9b3aa77af8c9bed21d
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17485445ab7a3535446287c68006310d7399b2d863301b505523660b1944afd6
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e2ce159b9237c6d5cd14d2100abab59cc112bcaca4a0814bf3adda5935d425a
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e10ce930859a47bef58da539ff313bde4a23caed8d7d9253e3031ab43aad6916
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e0200f20014c4b64c7c6f8911221f205279812b62a6293874af4a62c78e0a4c
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fe17a789c053d9892ebe4b43fdeec165bc6cfaaef836043aef1d62e7ca18333
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2b1acedaa48fa1a30055ef901e2ac9adf560aa2d72b880106baf0785d8ef6e4
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42ae5b70fdb3e61d7a1edd7acf65d28337fd977b026733fb79dcf9e08af6180b
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 644d911a8b784323eef7bf0bebf8cdd09be4cce19cdec498f10847af7fe981c1
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16ddb373b052903eac4824a579f0603e2c75f0e22084c3b66cd36edac4984c67
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1943accddda674017cc572850d0e67bcb08887e9c67bea70e134c1f4906e269b
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3363d35aafcc9a5212583108c917c653ce8d631d994b958262901de6ac73035c
            • MD5 SHA1 SHA512
            Submit Download

            XxX.xXx
            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9a5bb41ac4e949c6e118af35df364edbbbda163431ca909784b7706abd1faa4
            • MD5 SHA1 SHA512
            Submit Download

            logs.dat
            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512
            Submit Download

            sever.exe
            • Path C:\Windows\SysWOW64\install\sever.exe
            • Size 600KB
            • SHA256 d97c658697ce83927372a93393219eb03938063a10655d5020ffc5f1e038451c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2188-1349-0x0000000010470000-0x00000000104CC000-memory.dmp
            Download

            memory/2188-1359-0x0000000010470000-0x00000000104CC000-memory.dmp
            Download

            memory/2188-1375-0x0000000000400000-0x00000000004F4000-memory.dmp
            Download

            memory/2188-1351-0x0000000010470000-0x00000000104CC000-memory.dmp
            Download

            memory/2188-1366-0x0000000010470000-0x00000000104CC000-memory.dmp
            Download

            memory/2188-1372-0x0000000010470000-0x00000000104CC000-memory.dmp
            Download

            memory/2188-1350-0x0000000010470000-0x00000000104CC000-memory.dmp
            Download

            memory/2188-1361-0x0000000010470000-0x00000000104CC000-memory.dmp
            Download

            memory/2188-1364-0x0000000010470000-0x00000000104CC000-memory.dmp
            Download

            memory/2188-1360-0x0000000010470000-0x00000000104CC000-memory.dmp
            Download

            memory/2564-1341-0x0000000010470000-0x00000000104CC000-memory.dmp
            Download

            memory/2564-1348-0x0000000000400000-0x00000000004F4000-memory.dmp
            Download

            memory/2564-671-0x0000000010410000-0x000000001046C000-memory.dmp
            Download

            memory/2564-679-0x0000000010470000-0x00000000104CC000-memory.dmp
            Download

            memory/2564-9-0x0000000010410000-0x000000001046C000-memory.dmp
            Download

            memory/2564-3-0x0000000011280000-0x00000000112DC000-memory.dmp
            Download

            memory/2564-2-0x0000000011280000-0x00000000112DC000-memory.dmp
            Download

            memory/2564-0-0x0000000000400000-0x00000000004F4000-memory.dmp
            Download

            memory/6128-10-0x0000000000BF0000-0x0000000000BF1000-memory.dmp
            Download

            memory/6128-11-0x0000000000EB0000-0x0000000000EB1000-memory.dmp
            Download

            memory/6128-677-0x00000000092A0000-0x00000000092A1000-memory.dmp
            Download

            memory/6772-1371-0x0000000000400000-0x00000000004F4000-memory.dmp
            Download