Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/01/2024, 01:47

General

  • Target
    616cd6b4de9881cb0b5997ac5dd105e2.exe
  • Size 276KB
  • Sample240117-b7tkvseefq
  • SHA256 fc0bc3dd4e080cb2aad9afb2d9efdb19bdd9637a196219c3ceed96a6b65ea33a
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\616cd6b4de9881cb0b5997ac5dd105e2.exe
    "C:\Users\Admin\AppData\Local\Temp\616cd6b4de9881cb0b5997ac5dd105e2.exe"
    1⤵
    • Adds policy Run key to start application
    • Modifies Installed Components in the registry
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5036
    • C:\Users\Admin\AppData\Local\Temp\616cd6b4de9881cb0b5997ac5dd105e2.exe
      "C:\Users\Admin\AppData\Local\Temp\616cd6b4de9881cb0b5997ac5dd105e2.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:432
      • C:\Windows\SysWOW64\install\server.exe
        "C:\Windows\system32\install\server.exe"
        3⤵
        • Executes dropped EXE
        PID:4164
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 564
          4⤵
          • Program crash
          PID:1376
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:376
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4164 -ip 4164
      1⤵
        PID:1104

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 6d855139cc305d90a682d00b18ad91bdf98178d6a70c38dd1cd7a24f3ec25403
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 f9ba3c5c1a574bcacfd7c855d7692a0d81bc6e93479a64a35ef8c8c5aff65b6e
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f509f5cc9e39176857aee5823942d3208c5d3cc55b59d66c140975d54e0185e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2186cbfe5c4baa420cb1c9d4dddad2b029742f959c126861cac1708790336fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 445261da8e39e2008fcbeba0f7e650c711be518b6f366db55dcce6d1377bf336
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 936be1f3c4e904ed7b76204282c5009ff84af378b71e740c37dd92e0b3daa02e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8dc8556cb5b64f7d8c63e7183de28d6eda33eb31c61167b4d919913b623ce9cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b740ad588dd53b26549eeb228a50ec78fdf63f69ed6271e2f5be7f413edd55f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a08ee0e6346aadb579d1e1c473a9a82c5fc29aa9fd57415531fa376c113a7fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e38956ba185ee87c2c70f1b9929b0073e161f08d92558f381c8cfd0ccfde686
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d77c5e0678a7940138cee6a9910c388d5d4b34f66eaf21f477d7e8fb7c7d43e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b6e20dbe238d662573b3a98f39a8b7078e639f1c532a1e2c38dcd6f5d2e109b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 880fdd352f4d1751cf0af833afd651001c6589b2c506585e7998fd82d1626125
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34b8a34c280210b49c708952f3eda984106570027fce59ba6c45453e43a7d370
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 662822433f89d57cf37f7983f6bfa74bc84250b4e54523b66fe890dedd3a8d5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5aaebe0233f5beb4cce5624d967cd22d9fd275893e3429571695a888612578f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c956e6099097d4fad7417c9837100dda68b4f52396031a34262dd484bfd7342
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d3d6dc99f3299ebb427d477a327267877cdf3099918d33ba06b2a2e117f50bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f615a911d9ffffe9f27519de6fea4099edfab19b31f8a8f6fe10fe77a394708e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d56ac8b79502cfc6d87f0a8ab473209514aa5ef1605bbcc18d2dff8b5df80e39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c970f91642a343a9dec72f4ad70fb2c75adb1d6c7867fcb8eb8a03c0b90d9021
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38cb2d90a19c8064cb73fed6e583aa5ca4585066f89f042fa5ea11d592c4491a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f257af17fe28ce36eda90e40c58112b57183bd4827c82230277476209baa2ca1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db8e9782ebf8f4b4180d97311afc341619d553ce85282102370cbffd32df801f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eea16f4f27264e39c13f078109741814eddc2b72b3d1a4a9577c023af2c17dc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24197a28e34068b86202c1a3adcd2da205a388a551722fa652aad03ed680efcc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4365befbfe58864b84ab12bf9cec76e8afc8363e47db59e72655a6079c9161d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8546e5e43cada58cd233684de5995947797a0896000d37a9e6d6da9e87dca447
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b9f7ddbc47a78ae4b23ab7a7f86a8100806d04cf0d54d445bc196479d3b5cfd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62f4b4f56626f8c07650359109ee357239796714a60060af82318b05c7ba4e02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9148072e3de64f89fa9277f921e1a9026351d14fa913039e7279666ec03041bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b869b61abcd6e3e8b1796de4576d3f2cbf662fcbf5a91e79392e2bfa4830ee2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7157550134c5054ab6934932204553f2d44b310ba523b454fb070421c0b63713
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 017bea6d7162f475c90cae76d4fb9255ec5c69bbff3fd906489f5bd3cdaee615
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd8dcdc4bf490450b284411753d930246ce15b570b44235d9c22f947da54e453
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 308ccacd15d028ecbf51360496298d90c1a4597eb33a204b5bc47cc5bd9e66ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03713e40ab671d432dd3eb1deb13f57886f619ba3cc6a7dbb05c457a879f44e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75da6a8e24040936640390f342cf870d9f67614448adc4993ede37be6af34a5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd6f28a02e7bc16303e22f6750f4ac9cadb477e5ed1c62a0b0c397c660ecae32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49a8dd2fb1660dc5f10acd479f241a2b8c932f51f34311d083859ab062347c3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6fe9fff1f69e6d0f4fac6409e7ca2620f1de0efc73dbf0567f3e4ec8b389b47c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f18d9e00a405cbcdf80ec716c5d111871bbd6aba52b4e5a6ea6ba62af71c295e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcd3d2b27b67f0891ce73613d4839445241b230a4246242fcf7fc95a58b10689
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0350821fc97411fafb8a39c8815db0b143f649aa1c916265dec20a39adf44d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3399375ce2fd90d7b10cb7f6325468c5fbcbfcd34c14d964ea93e350c697471
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85b077e7de07e3b0f226cdd5c3e6adbc5ec8fc55e2648d85e16b92de841139df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1873348b1384d007586ceef8ef3dbd7004239cc03771cab979bb9369eb80220b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4305c1d80008bbe3c2c77463e00229fc18392124c249d870232dfd85639b03b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 141fd1d60afcda97af5b05ee85f03c63a17fb82d47931aa2ce777d59cb8d953b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b2a437ef7d7d236689d36b9b0d7ad747b6daccc7ea9d403ee6c08441973309c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19feca541e3e1023b8b027a4631026c088bfb28d845477cee06d6d1f92d54a44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87fc381e9b42790f25f7bce99bc967d3b34fc08c19af3b4901acc71923d2c9ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c176211a689537379eb2e7c56c3afbe35b62fd80d5387179a178d3c562e94a4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15764528b2c84faafed96a61487c190e6be42ad3289b78bf1ed9283687f40878
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7dff804d7ad8124dc85d446c90c9991aad6dfedb5702fd2c14d440839beb1eed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebd2df412267bf7657f44dcc0472ed691e6243e89e924ee174cd2d3a7fdddcaa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9afd5a7629bf4911bf6d5e8c760a04afc29f181fa369d75a56dc67debd6ae821
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c609ed912886d5a4951e2c10072ea66fddcc759170fc5a75403e5362c5e86f95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a51d5b978bc4e00f34793f4b398ef5b2c6ce66110d6d53b5ccc52b52da448b92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a6eb61d828baca53d1559de72dc823d608dbbe225a679322ab8f16899727925
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aea64de1875b1c889657abf11119467e5da6a031c757131ef2f1d7d693d28c47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ab7b3df2bb621ce5eb432b8ba5779ddec88a41f3cddddecec78542970c22b2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 097fbc35962c25be5596d8d599d3c5da3cfbcbd08a28c68d91d53ade79b921b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d857ebb56138ff709cb620ed8940137666edeb124b9b8c2419bb3728e6445ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3b2ab70a5adec0739fe3692cd064ab8edec756e4bda37574acb00d8eb060504
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c57a7c69b28e09b4021456f49a3c06335db2b2aca19ee69e233c1e5bdda0ccff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e18efe860796216eeb878cbd5e6f7fc8bca71143bf330c4ef490126da3136bc6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb16bef1394e89c4bc2ea479acf6d7afe2bf278f40d5c4fc26533d156bdafb5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd310c413301a6e8cbb743d23acf9177f8f5e68501b875ca08200ab6044d26e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4c3e9eac38a195dec7a7bbc1618b393aa16f2efc08218281cf7062ebbd145cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4362f51a9c9272d0bd610c506d845826f260faaefe612c578a7fcd3f0b222c8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 395e62439935c21a3437c6b864f45d02da1117a8cadd1b73cf3eed8c46633f78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d99261236dc271206ee6da1dae5005dc16526f6972b7b7e0ee713b89801b4751
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab473fb31429ab26213e6e9d54fc52015428b6c217b4780dffc4ea2e640803f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 539b9c31c3a78336db3bd4f1d802c7feb880c23fab69b27146e860d02e99e1a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 435a5f82fa19ca52967940035f2ef0a0e593ce98907897cec3624179bb5465bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c3639646b6d61458d6f1f51b2e8be3a1501dead8e62cbaa5a50b9d4085b305c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77bb1e4a9b5a69a2af26ce78a980eca65317f92c33b4eedfd610511d38700294
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1340a275dd04eb7cab1d5b6606f709e9202098371e99ac9c5980a19bb6a94f34
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 093905019871b6482124a0a34662e8f91e9cde6e1f6df1be069ff4c742bd58f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b51fcb84ddbd42e72771dd0b9109883b05ac2b359ed008b622676df5f9de283e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9529b4c4ebb28f239c51730eefb1300c42cb70cdf6f20529e3ffb336a8f3ab0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db40e24523107620dd5fe9dc413c49da40e2e60a9fbe4ecd139b53d2699865e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0b331cc0c1338269f65c4179e66d8a6464c7fb116cacfa9bdd905c68fd8805a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b0ac1a0ad492093503475c06d2631254b2293de7c2b7120d004ccd7af36dc52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d93b30fa6ef616a059ae27322b6e61e8dc2a319adf5ae7c3c98e5db49439d34b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cf0cdb4fa118f6df84e61f341cb87dd914c291348e1f44b59b0046313077cf9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15f7986ca6f687d3421940a5155438205c7869a7e25a893a5e7caec8b538d65d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd4e569718c9a55f06a0657dade47d167ee93e180d9b25560f42ab055a547d20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc1328368b45cab32d636c338b342f5efc32e50910990a5bf585852a136aec58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c8f5974d110af59b687ea051ac015ad07ccd90cab76058eecaacba07d716568
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36a71d55ab13ad72ba7c9e3ab2f94f3ebd547efe883cc5a441ed91e12df2604b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1dacac417034a9a9173dae5c35b98c045acfcd4319cbf6ccb72e66e4a595a18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 149399caad517d0f16eae8bb201d10cb4d2ad14e0aa198e932aea42e35922ad0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49cbc9abb374ee841f1f10426f549755d536e6a7fc2fa96c6867fb312ec9c186
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8942fdbab91a02883e76ebf59748031caaafc434e06bc4af8a9d5ec3579e8dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d71676899e1920853b88ce72dcfe76253dba336f7f6185cd9604a13a22e5bf8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c46eb6a4690337002d91556de65b6167ff8fc4a03b439c6ab7ebefef10673fac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf58024df93d94e94820104dbc4beee007d50b042cebac8da8753dbb81aae791
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00489163185b760945bfce89e340f5a3f81d4f5e1d35b931f9a781ea35e189b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc3800836ee52ce436d86a71fc74fddeadd55e4f1c240851ce608c4298684441
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbbabf96b895e225ce7291427c478ebee07ee49ee69cf8b36778521653d088aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44cb730051302282f3b293f070c6151880551fcdb2bbe617105a15369b07e08e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7525c7c3b9a004d2bc5ce105954609e72451e400e4d11076b16a629bb942602c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3279525a86e54bd0cddcd9e312f2fec5fc3f987796c77d61be14e93baf92a2c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecf35b797ad3211f78fce5d71f8bbd251a297fd410e50803993342ee1c195d40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 beb42989306768316d3b4fd72ab199119f3345003302fd439ef095fd3355e44e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bf3727d0a40b2724ce26db83f0b42c5cd2a67b69f0ab6526da1264cf742a537
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a13c7046f4f746278232190375c8a8f228f1e19ad591f2f73343cfcf5589c09c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d2ee37558790e556c56dd82e55b47d6536d55f08c599cc92274124906597485
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a87b6c7292b868411e3779806428e571be368376586f3ea8b76e6be16fdbb690
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5865805af227e053f165abe0e768006326cddefe56847fb80f781475dad02d62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20a76d88e51fb35af19b641c5ff0634d708b8294209d00d85154362ac1f4aff3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 865584c7b7f1efc802e7fb6aa231803caf86d3114a7a91baba28cf43ce73d30c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b12cd20b280f7a5e1aab684aa91f11c5ecdbf4fb575fc89bdd0c70754147dc38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f91d7c9c735f3aff0e07b74afba398a724b10f999885903a57b11a5017183ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86226fd80d629195cfa3342c7f073a4df2615c5acad725537660a5a27e42748b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c9ea3cf994bad7361681c6bea0250fbea578c905894b5870bae80724799b767
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fe094355ba64b495929bf81916f2ffd09d70090a4ae0ad5434dbc0be2355f49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15f68677b18088d47877d72ef7ff1acbd1527581611c5123cbf2fa54a7aa206d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9a308c7ba7e7cfa16fc1b76268a5b83e330836f19d612555d44c002e7e3decc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d71c396feb091c09270763b6cd53b7df1683a772aaec4feb82c8e59d0cd33c5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a27115c7b461cd7abcc52a4e2e9e19c98d4563a986c61d43b658620542d67a28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ce63931af250cff456593199f299f7a6d85ed23d18e48731e440d934eafe445
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d15973f78e45ec2b17fd0388c93a9ddaa104718c9c4b2e59592efe70cc055bd4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50429265622dc735cbb57f222173af465d4da8ca86d4a3663b12b545882e8166
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adec4fdd8d68d3fd996f246f81a04df7ed82ff4646cf13a0cfd8645909c03130
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6088fe9451e368ff0924b5b6ef3ea8d450e3fa39c6916d44a337b9d61989f368
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59f2d8ba8807ebddeb97094991a956e6a79ede75f87be48a3ba541dde4921325
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef0feb4eb09656a1fc004ae4db81e478bee1120292817eb9a0e0f37ce53d0811
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8efa5f069bee4f3fddaafc98f0cb9f34398eb404e17bc7cd2fda0b97b5a6ee4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c0265ee55e9dc67c001d480d1dae712fe044c278abb004236753dbc4c5262b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac50412cf1f5d3fc702c9801d8684b3ba28d0d74f7393dfed3fd6b5f62bbe022
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad9314f664455fe1b2c39bedcc902c957bd3dcf0e9426a3e5c5f2d6fd221f185
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c891f6c22d30d4d43d790e53b138df5887601d708dac122ba782662115a742e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68c4d8ec9f072c65d5d2c98ba5e546352eb8b800139645e50ad5d20230ad5eaf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebd6c805d3b7450e1c13b833ddde3015f03e9b55b15452585477ba550bc55160
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c358017c44c591430103a63584bd6e54cac901709e6be32e675bc83889fc428c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5f8769ff6337b9d8bf759e4e2a2520e88c6abb916cd7ab0aa2178f20983ab2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b235efd54acd402e48afc2fdccdceb7054734cd73553c0732c36534e896f3a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a889415e3dfcd5e993e8c324b7446f6c0538cf88658a169499ad60c4fcf5d2f
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 276KB
            • SHA256 fc0bc3dd4e080cb2aad9afb2d9efdb19bdd9637a196219c3ceed96a6b65ea33a
            • MD5 SHA1 SHA512 SSDEEP

            memory/432-11-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/432-9-0x00000000005C0000-0x00000000005C1000-memory.dmp

            memory/432-1192-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/432-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/432-68-0x0000000003CB0000-0x0000000003CB1000-memory.dmp

            memory/432-69-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/432-71-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4164-97-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/5036-4-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/5036-0-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/5036-72-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/5036-65-0x0000000024080000-0x00000000240E2000-memory.dmp