Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/01/2024, 16:27

General

  • Target
    63114c4dd5fea3a134776cc22cd41b8d.exe
  • Size 403KB
  • Sample240117-tybmssafel
  • SHA256 629b430660af5d42848906e35fe6f4ae7139a32debb94ec2f9503d59de7ad347
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • eragonspy.no-ip.org:80

  • eragonspy.no-ip.org:81

  • eragonspy.no-ip.org:82

  • eragonspy.no-ip.org:1338

  • eragonspy.no-ip.org:2000

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3428
      • C:\Users\Admin\AppData\Local\Temp\63114c4dd5fea3a134776cc22cd41b8d.exe
        "C:\Users\Admin\AppData\Local\Temp\63114c4dd5fea3a134776cc22cd41b8d.exe"
        2⤵
        • Adds policy Run key to start application
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3984
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Modifies Installed Components in the registry
          PID:920
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:4328
          • C:\Users\Admin\AppData\Local\Temp\63114c4dd5fea3a134776cc22cd41b8d.exe
            "C:\Users\Admin\AppData\Local\Temp\63114c4dd5fea3a134776cc22cd41b8d.exe"
            3⤵
            • Checks computer location settings
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:2812
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\system32\install\server.exe"
              4⤵
              • Executes dropped EXE
              • Modifies registry class
              PID:4912
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 624
                5⤵
                • Program crash
                PID:4684
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4912 -ip 4912
        1⤵
          PID:1556

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 bf0c805100b4cda6f53bdc0ff3e505ff5ab166340b02311780336a76742b0aa2
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 230KB
              • SHA256 f5aef8a123530a6a066868bf90009c8acc5d56f05b66d97efed6c254bbf3ed02
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 04a4f515d6c5b4bd32594984bd13733104a8d2285787254b7e57336d2b258050
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb35aec4380196de1c41f8d267827be52a88efb0c8cd6d238af0d78f75f8482e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 603629f6bbc1c7ba8931e3da71f1f382d38934164392376ccce70eeae6366351
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e43737cfe1bc4d4566abc7379803df3043588b957342448067ed9784aef239c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a2e250c37eddf8615d39799916bcc050781a3eab01fef39a8f4b527758ac23e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 19500d9e3571de82fa15e621d347d408e7d20e6b257c528014c46ac31bac0e30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77377e56719a21e57c516064f151c54d213497e7422e84183e7742618424a70b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 90c81d58d6c6dd52321b615673033c488f5c7864d291533c59050b73f6cfea7e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f282c3ed6e6f511f49427e6a3b3e18b8f51f709bc93769a64825c43e0a088afb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 232a0bde12347ae5102362e31808c54229c4f041fec44c9f480e98e6a897f00d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f09da14dbfc2a79ea998daf2ba123c616e3f80a82a9d5e9eb96445a047c7b70c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a5334f2b3e4eacae93afdee5e82b9b7c19e3c2c8b25b4e75a72804a604d3336a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b3654b11155d2b1fce4c98bb67073fd432d32662de65aa9da8aa5a0379b7d64
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afaa5d33e961d2b76bf6cb90efc491cf006f51ef25d4b4d55331bf2398f9ca5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e29adab2b5d62488afef4ccbcab0b0337a5c9465ef775947e7c7767b536eae50
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25f8e7de20851a88328e32cd67f110a8585836ed3764619be59c6dc6c8846673
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ef20119b515a764eb087c8342c18bd812d9c54a003282ea1420409702c8bd67
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9617fcac8269af2df8221c2a66e2f489a6525de3922fb88831a6d4baa0209fa3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1bf5ec89404ee83724cc42bc9127db8992a144207435047fd606d47400399b58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9193a515080d3223d8c7245a016705d451c6a9780d4e2be217c121d56b7ee398
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30ce6c6ab4b5264824311004c3ac92fa5ac4d905410483ded909310c50598fb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4eb71fca2aed64589628fc71f3dec2e1220c3baa405cf88ecb7742e50ba729f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0073979655161f69c47391e7b1bc68240442d8922dd50a9f72c83aed80040ea5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 90859e3db5639be4bf7aa362310851078459409cda537597a9cc9c1d6ee6f08a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2bb8853c43a8f5f3fb48d472359834cb7611eff20c515dbb3b5deef278104ec6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3457e9381df25db18f54240508178350ecc9de9c8f561e005ec6414d651ad750
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9ff5133a8b4f647dcb6126b9ec80bf8289fca64fadad7daa0d2e87f389c7a8e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d1fb280fd676f36c5169bef66d9c923a0b7d3a91d3e237be7688963c181e376
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 39fc7d723f11338e51dbe6e7382c0d25686b3203e965ddc37571359b9eddccc2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b868515f60e12d1d8d733e1456014916370f2567caf81a1dfeadaff7f46e608
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c2e8907e44b5e35bdb87fa1797827b6f20cf5ca9b89b12caf196a2f2ee2e314
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce91ca1b232e9d315f3d3666e6a217119bc918f04716d410c4438e87f7160665
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b133be9cad9818afdb6768444ad417005823b65fc47ecba70ef3faa522e98c4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33888a29b624cf04fba03d70ca0d531cd28041d692b69411e24abaa75fa6d45b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 720780bef9dcfe0870200cce9b5a158f6144dd3eed00bdeb292ce17a235591a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40396194a9e5bcbc68a24f04b9b46623c6efabe59ab529bc745ca0ffb73b09ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6cd10781ee237316f53e2f2694d4bb70d07694be76b5a6214a93524c263ca5c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48e938d8a4cf6acd7d8a92b4c62a556eec9d2f14cbf405732ba774a30455cf88
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ae66a967d8bb2ecdb4450a2ea8259ad28651c2d2cdcefe95eda6d15e4b765d31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4bc28856702b1a7c02c32af510707fdfb3675b79675b0a566f67fd88e6cf033d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0550bc0ca3d308610d7b3a9cf8283d039f2aaf53e0937541d81dfa952dec35c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e451bd5f9dbf2e23b15eb8a36d5f83e21745946a42dadfe51bbbee06805b4377
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 23441cc2a0361adb3dbc65fb6e4d1e6f36d70cadc5e59f3eba877a407328661d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8f27174c69e3e6f304c49057d69dfb3a99c4b7b802ff4dd6f572e36b952379e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 79dbe0ca7cd4c4bff032e15045abb5a6a5edeeedd94a0906d5e822cc08b4f988
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 220174d84e1fc2259141af09178eba9c61ec6f94774bbc63d9a49207e46326d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d59139e1d3d68413acc73e2b2574d4fba1cc2fbffcdef48e032a6ed6a1ae0ba3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a8ef422fec45c9814c4e030adfec6f066d4a2a5bfeffb93e48fc3fe4672a466
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f70541e9e7cd4a0e5d6b76158f2bf1f5850bbf682e0926e5252fdcc6b6ef4ef8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f23af23e2016148f9aea7774727db3ba8259f5a8c876720e3927ae4da2e66f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee527e1e1fe3fc4ef68b8c3d8a6b088a5cfbcd7997495686d40746269244239f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 735c9ce41870f9d7f8afeb859b19b46f6cac67d9ab4f56259d3bcf79d1edd485
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14ca215e1f00cc6647fc2fdb581b5d0171148d1c3c88b3aa0ccf19a0479d3215
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 181ba35f5a59995b39b5a6b695827d2f7daa8e0bc2f5c635fc7e363000e30a30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 43fc3817054008dfff4c956b704c25b8efc7dcf657f1e9c2100e5fd84b285ee1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 95cf354371e9de36a1811afb8992b35e972dc7d7797b829685eb10581a3c64f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dac165627e457d44e6491eb19e63c2cda1b6d418ee58dfbda660ae561b6b2b35
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a467b170dd3fb90828e4ecf2d3589fca2ec4927c1d661c5368de4c8d399695eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9950ddbf9c7d9463fe201abe88be7c3662d6a6dcc860d56256d0a19fbe9b3a4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 735169a40a019a7a4d786b3ecdc87b4d1503f3f969e6b64213546e6b164ce867
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f0fd823ed0b7c43206b1abc22e99df3f2b81920a03c0e4420f25f97d3665e94
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d48c4511956c92bc812672263f583cce6c2e455f72a2b1f6581ba94749deb500
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50bfc1c95f37bd645528a148ad31839b34c55dd7765d8f5c48dde9585f2c1e79
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 054baf75258eb9e8f77dde0af5f4ae8f15447c680a6b3ba26dc9bdecbd6911fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b215a9f9224ab8dea94a15fd7aba7f6a7668cb90b54cdc70bcecfebedf2403c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 333f07ba1890fd843084010c5067fe972c3a079d9ad0ecda2ff008022984166a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acab8a98488535abbc443110f2533993feb9495633ef22f09424820985b6d6e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78e46224e00a3607ff735098fef40fbbb91242a9dd850602ac759570f0861c60
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f1be2c1232935427b33311e7e6ea5d1bec82f76edee0a6755dafbb8783f34afa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69355fb8fb0ebedece0e55637f18083079fee784781caf5d380f94b3022a819f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9cc3fa06322b7c7f55ee99d28055450c71ebb676a6aef25c9b5b9fd429938d14
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d98942a1a3156f0c36d09767b5e3a5b8724e18edd03c89b27e9ca7dd97a693b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48771e89c0ad3d141eaedce5342f6c1fd72240b295d10e443e94de34f429b895
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e18b0d351878792ae25d01478443fac6dd268d51c433317d9b018846fbdd1dc0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b4989dfa5f84976401a468b2e1a20ebc482d2b59351f272b80ed4913c181a48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10aa183cc3b5401e61c90808e2686aefd56c1bfaa571160c0a34a488655c3ad5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b2cb15bb0455a7956a61b410da064b971fed0d4e1d9eaece1e9dbfd709c0a2c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d816ea753a1e66def2720067936fa5e00ad0650cd78b4e2b0f751934a499833
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ca4a55511f08db4906ded0e05bd25cac13d036593332c9ce48320bc2df7adef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f767894c165a2804e7257c4d0d3478d965e0059cb03e4d28a0a13f4dc529014e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11ecc98131ff559a07a88406f1ab7db733543997963991f285e863b2cdb9af58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f18ca0cd76d0e999a9b266833608a91b8d9e865f2131e27dec60823a7c690f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3eda2115487a896bcc6190017c7f7a2862472e11de1fa9c394a2612709983f81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d57b12342b5b1c3bc23e0cda0709690ea7c6c3de02ea2fa540c4222d22e3370
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c0cc14f9610d9bc0922c343bfee4537d42d3c50f5ca8930a966be8b6a2d69e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 082ac0a82206a096ee80bb07b065169cc60018eeb75580254c8e619d5e8d44eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6fd8688cbed2309f66610182efc77c8a9066b11e3852f5dce61c38bf7fdca2e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b96cfe9e5c878077bab02b456b19a7c5bedb69a5cd519153714dc5c448907e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 18b92b23320e11b42b76619685be55c5509812cfd2434f4f8d0e23faea952c33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f7184037b805623f4b89e347fe5fc14a76990b17d90966d17b9365fd857414f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 68484216780f5bfb1ba52740143a99655ac95a9fdbc460ea59b5b4901c507017
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c4058ab38b2bbc541bd89b9e00c7fe9284cf676896ac7d22fc827f987cff3155
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36ed802b2ee20c9de1ca127309b96faac19e1cdd08ee2236385959ac7d99c9ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5357affe6b13695f79fcaf18099afc6ac14c7b8cd828927094ef61e896faf05e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d389d6aa73455e23a91d3535fee3c7a90cf25ee854bfcc301205834289f7356
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02f8c0876da39a599df682da1d465b4f0d011ec7f787575ec16f8816764c5811
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16743e4fa0445973fa937c27ba1155144e4ecb41db744fb95f332be7f013341a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da625222cb205bd6cbc942f85606f5773a7dec5a715ade2804c1d58cca1f1531
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32091f6eb41dccc44aabea60b01a00ac8df018055ef879af101f7e1a0bc05190
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34e07593310e150aa6f5c00f307203222b08a4960e5354e285d3524715ba9674
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7c20131a9bb385e3b6942099eb1c14a2f922d011ebc152b38e7771b2ef032d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b8d7e11745667a1be5d902e5adcbf7638faf968427651267bca13afe9473db4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d8382cbf31f8c79617bc318779c7634701e51d601d51c72627e2c03aa35116c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2e69dee1cf05a47fb68b79c614f9ba9f25b4e6408456f9c4cb2404d23d10a662
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 698e5809d2cdacf8ec4dfd0aeb86171d5c657ef119b7271bed76f75fa0e56a96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25c9dbe238e0a9f4d704c9d505058a12e1b7a09745c1bae31d818b901ac0ac13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 788fb1e0fb44d78bfb849893ef965fe964ae5d4312cd0513c3195fb475f4354a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09aa66b9ab35a77e5c3242a189a1f7a3e3c8e290df29d5aa2a4fd0c687a078a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6114401118b0f61dcfd1e2f2a1f3e3c1c81c54fb2251b01c430cc439b9232b9e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 80758d79c3bf3d91d463eb07055bda7d4b24df7f89b0c75e6ad70171a65f71c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b77ce32fdd931fab8a5212e76e7482ee596add064e69f18bc95d89a53f3b175c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cdadeac95447a9aadc82eefc81d9ac4b9af8a1e3c6e99d5f20bf84c9c42ddaf2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 264c1e1339be6a6663292405ae326d6988dd97a1f32681357a6efde53f0ef1b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1e5d12ff016df4090a812ab16eee64933c17331c404a499d11c17f2c00aaf98
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 145513d96f2011b7b4ed28030bd17b11db24eb336a24a8d2c7a6b5b4ebbd3bcc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 495bfff8e12221ac7b7b42701963fe15c5c0bdb92b8be6bd2b8a5b8ea9c76398
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb70174f65ed4a30c72b1a140009f3316b8db7be89307bfdcc7255bc8e24dcc3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30c27c1811adbdc94fa399ac4e4581d8303195644dda1bb1deae39edbe1a2640
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f9a6bdbf910cd6adf12555d9d86418b987a85b9dac1562e3ffd6a046cd51efc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dd74503e2e8b88db37c7feaceafdeb0377f8a34aba8314ad8b9818672e1c07a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db642156a981b6040a02f1dae6224c7f1a2fb6a92c887d6a7281df80f45eb0aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d7dedc14e459edffd85a4c87df3782cc1cf815a07c7eeffc244913391f5c731
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3457c449cc4e0b37ce48a63f0ad139a1abedc4961901a147b6dbc4e3eb23f1e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 04f2734764d0842827075a6f8d0bf41d497d683e144e891fd91a8769dae4a364
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d3ac2a9b6b9ea1f980c209dec08a0f06ded629fa866efec66d2f10382c58bcc4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a110e3b5ef5d4d936dd30068f4e879cb214ab622105ccabbd2dfa0341ab3f63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f22d5844f49f170aaa85c41099999a21916f2915ee5caf6e9ef31c4faae806d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22f3ef2eac62e7b7472e8bc2536038b50bfef6c56bd24dc05579718ba68c8ab8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f50aee9b273e6d160e234793bb55aab30ab2f481f8331a302fc1d0642b2879d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29393d7215a90fb5b968f4ccb07dddd31eb947de63e671566d1ade2d1f534dbf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b816b02628e304408694a3b3ff439203f9dd2564482559258b24bc90925bea17
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\install\server.exe
              • Size 403KB
              • SHA256 629b430660af5d42848906e35fe6f4ae7139a32debb94ec2f9503d59de7ad347
              • MD5 SHA1 SHA512 SSDEEP

              memory/920-95-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/920-94-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/920-93-0x00000000037E0000-0x00000000037E1000-memory.dmp

              memory/920-35-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

              memory/920-34-0x0000000000C30000-0x0000000000C31000-memory.dmp

              memory/920-227-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2812-106-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/2812-182-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/2812-1154-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3984-129-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-17-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-1-0x0000000002430000-0x0000000002432000-memory.dmp

              memory/3984-2-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-3-0x00000000024A0000-0x00000000024A1000-memory.dmp

              memory/3984-4-0x00000000024A0000-0x00000000024A1000-memory.dmp

              memory/3984-5-0x00000000024A0000-0x00000000024A1000-memory.dmp

              memory/3984-6-0x00000000024A0000-0x00000000024A1000-memory.dmp

              memory/3984-7-0x00000000024A0000-0x00000000024A1000-memory.dmp

              memory/3984-0-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/3984-8-0x00000000024A0000-0x00000000024A1000-memory.dmp

              memory/3984-9-0x00000000024A0000-0x00000000024A1000-memory.dmp

              memory/3984-180-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/3984-139-0x0000000000670000-0x0000000000671000-memory.dmp

              memory/3984-136-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-138-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-135-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-131-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-133-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-10-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-126-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-128-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-124-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-122-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-114-0x00000000024A0000-0x00000000024A1000-memory.dmp

              memory/3984-11-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-107-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/3984-12-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-19-0x0000000000670000-0x0000000000671000-memory.dmp

              memory/3984-18-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-16-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-90-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3984-15-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-14-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/3984-30-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3984-26-0x0000000002450000-0x0000000002451000-memory.dmp

              memory/3984-25-0x0000000002460000-0x0000000002461000-memory.dmp

              memory/3984-24-0x0000000002470000-0x0000000002471000-memory.dmp

              memory/3984-23-0x0000000000660000-0x0000000000661000-memory.dmp

              memory/3984-22-0x0000000000530000-0x0000000000531000-memory.dmp

              memory/3984-20-0x0000000002420000-0x0000000002421000-memory.dmp

              memory/3984-21-0x0000000002440000-0x0000000002441000-memory.dmp

              memory/3984-13-0x0000000002480000-0x0000000002481000-memory.dmp

              memory/4912-214-0x0000000002340000-0x0000000002341000-memory.dmp

              memory/4912-213-0x0000000002340000-0x0000000002341000-memory.dmp

              memory/4912-220-0x0000000002320000-0x0000000002321000-memory.dmp

              memory/4912-210-0x0000000002340000-0x0000000002341000-memory.dmp

              memory/4912-219-0x0000000002330000-0x0000000002331000-memory.dmp

              memory/4912-217-0x0000000000770000-0x0000000000771000-memory.dmp

              memory/4912-218-0x0000000002300000-0x0000000002301000-memory.dmp

              memory/4912-216-0x0000000002340000-0x0000000002341000-memory.dmp

              memory/4912-221-0x0000000002310000-0x0000000002311000-memory.dmp

              memory/4912-223-0x0000000000400000-0x00000000004AE000-memory.dmp

              memory/4912-215-0x0000000002340000-0x0000000002341000-memory.dmp

              memory/4912-211-0x0000000002340000-0x0000000002341000-memory.dmp

              memory/4912-212-0x0000000002340000-0x0000000002341000-memory.dmp

              memory/4912-205-0x0000000002350000-0x0000000002351000-memory.dmp

              memory/4912-206-0x0000000002350000-0x0000000002351000-memory.dmp

              memory/4912-207-0x0000000002350000-0x0000000002351000-memory.dmp

              memory/4912-208-0x0000000002350000-0x0000000002351000-memory.dmp

              memory/4912-209-0x0000000002340000-0x0000000002341000-memory.dmp