Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2024, 23:33

General

  • Target
    6bc6080027745ff667dea0100b4c1a40.exe
  • Size 1.3MB
  • Sample240120-3j2ecabaa2
  • SHA256 7c99c3ba63e62169c9604b3673aad85223c452b42a2b5eabe8e66211568466f0
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • younesstop1.zapto.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Extracted

Family
  • latentbot

C2
  • younesstop1.zapto.org

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6bc6080027745ff667dea0100b4c1a40.exe
    "C:\Users\Admin\AppData\Local\Temp\6bc6080027745ff667dea0100b4c1a40.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3280
    • C:\Users\Admin\AppData\Local\Temp\6bc6080027745ff667dea0100b4c1a40.exe
      "C:\Users\Admin\AppData\Local\Temp\6bc6080027745ff667dea0100b4c1a40.exe"
      2⤵
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4984
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:3164
        • C:\Users\Admin\AppData\Local\Temp\6bc6080027745ff667dea0100b4c1a40.exe
          "C:\Users\Admin\AppData\Local\Temp\6bc6080027745ff667dea0100b4c1a40.exe"
          3⤵
          • Checks computer location settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:3232
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            PID:648
            • C:\dir\install\install\server.exe
              "C:\dir\install\install\server.exe"
              5⤵
              • Executes dropped EXE
              PID:792
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 540
                6⤵
                • Program crash
                PID:4384
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 792 -ip 792
      1⤵
        PID:3012

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 87f9ab98a575edc37c4cd62bceeb15a0227d4301cee6eff8d6ca9a00800c4f82
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 609f431e271eb20cf665bc16ccea7f003a28d1031b65ddb92f9151a08f8bd0d8
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06aaa971c8511f4a38f03bb23d9c884442990130174c527f579dcb36991687a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8ed261f197c252d488776e387b9db79795a7c7fd744d295854e8955c3462b27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6f1da5717e845e2a1a56e9938b7edd4c6fb9eee7729d015e0b29d4213896428
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e984629e2a6041799d5f09951671a42a381092f3c553e5a8f3ca24f8d9bea1b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 697e10b004518eb5c45376ec1308ff316dabced6ea25501bb4349eef1f63362b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e14f5e174e7bb6539c7bf1d59216b58a9b35fbc55627c5d610b90e5ab6c06c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bccd9158dbd92b584f66caf7ce30fe5dbeb447d820e7cb489458ad465315951a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e18625cc6cfb480f43fe7c3d21ab051f4b9da1fa9ab3f712e62c4ee29cfd326
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 006cd464cebbb02fc5b18b24f7c7b1b7d614f15141fb678a401839b8a55e27da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59796b6ceb65238d60ca292ca0950f8033bee75fa78b93b6ccbe18a1e8e2b46b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5203741a76c05fccc9ecca5aeb791b744572bc365b2418212ba910dbdc1ab50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 637b8d20ab7ae2ca7c6ded0871c2f4f55611255c70b004b5efe437ab5f1a4409
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1645698805006c906b4ca4ed4a669d2458f7d56456032095d3de9a81d61a4f77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85ce7c38d5ea7e5c615fe83b8ac8e659c1ba03ea6055d5a630a707166fc672ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60430b498d02cd857cb639ec0dd6b424a502b725add893722aa7532d9e2f2f29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89008e6df4240d96d2a0a629612a123f9580478da9fc724d40b7dcb7b5f2212a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28d7607312563b376ccc0d5fd91010122ed3177a3f9cf2fd5784c057fcf6c6e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 efdd3da195cf5772ee64dcc5e7b15e59713a56b6199ff7a1068b008a541f2df0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f98b457e4c1869d37241771d151bb4b4b11b0da974dca886b1f99b31f1e9c171
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9fde317883a798c574f60a7a5557f19e52be69ce05957796dcd93ab2e46d398e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c404c9ae73e3572b33b79f78669a4d2159890ab39c47d213745f6161fae45667
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5615b74486b4c1c942afb02c031d27942f663ef27a61599f9e270f68cedfe28e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59a03791d18f4f75a714c781fa9401d7775e3756f449dc591abc85349d2e0ad0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd9fed879fe6b212b35559add24636e0608bc2c8f941d81e28a4dbf855100808
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f37ad7ea276302c531f214a3d7f3e9ffe205af997980553992fa9f40e4695872
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30409ed086dd2363c5a5185822ed57e8f2cd63420300c30706fb27a18beccaf3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c5e02211eab86c7701588444beb05e07685d26db5b1a313074a6932fdb563ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 feecc76b90a0ea969a3c24990b5d0e9e2aaeff8f22980095aa906c916a2bd8ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3333ee5ac5ae21f3ad238ee8ed633d44f7be137ddf5d90b6e9e964bd1e40ec3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45d37ec92f98a9e19d12ad9b556ae9b80fab96f020aeab1b55e60dd67f21ab6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29ed7b5106acf5b6e6b295e49cdd2fb0b792382bf812fe70503cc33e82fd6745
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84390a90baaaa71c7bafed6554a9c60c3590a7ac7b7ff2a7de6542c213221560
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0df7949c668daedfd7ee39649e05cd61e81445e7cebdbc9eb6b67365f7f91af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9fc3c25ae61096c05e763701e4d6be7274f210683d390f12ef72522c2d65531
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 470af05a4b35943689191ed9cfe8ed1a423a74358f2132bdb675a93ce8bb7c76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dabb7e1324a15b21016241a8e24437e31e7cb57dc278fc00058d377209a0505f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c6a87d4e717085d75e52631750ce0ec1e20a297ef7bd503ea45b7ab2f956cf6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df9f05f3882c0b1d43609ae96724629142758e0573d10c60d7b4b3301c681d15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eacb735430c3e1315ce0f7db3f3a6d4feb55878bd6792cf04f7e8557d635384f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78ff95ecc850ea401a09a1aa4a78aa260f9471b7c4e03904c18307077538d354
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2b755c43682c4a4e21ab011efaf1dbfbf2a9d340266253c1a4376903da5d298
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aabe19877d453077e7dc504729ecd61e7340a884cce5fc5c63777593bed868b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d38f8943d5ea1a30d2c9ebd7928a05238df451af03f9a094a0d994445a5790c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db2ed554796a638f918d2f14a04e9d83a8a9e014dc02c8e298ffbe1b5704f36f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d45227376a7fe651d00db5ce49b6ad45bd5a550289547f4d6a81db09e0408d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc5c7e4ef4e5fa81a27300e05f7daac6d4e5cf32541e10da7207397e5986c5df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f303b7b02d097508a2a812320ecba69885bfffc400e866a63f861ff53f2a47cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b87ba672a4be4316ee3392c63ed0c2a117db1bd4ec8e6924fdda40741836579
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0bb754f7f6c41d743464b20beea649c85cf230ce9dd10c2fe8b47d934bbe111
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df554aa0f24a205f70c8c02576e8d75211a49912e72d0737798f63c07b6cbcfc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 663f2f07fbae2ddd2637847183b40d98d0c8a49b2a53e3550d45e40af2b92af9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62c93b6f6c144417ee1213c81eab6688e8a1bd3d6fef1e2d8d757a4456e31b2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 594967b44ad9686df86b29ee57f7da10ae7dee3e5340aed9668840d28f0a5ea4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8eeab14f27397b16a4ef3544ca563cd3e03d6346e3615e7e9172f2283a57595f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f09c5b0326b1865732379d379ab87f1be26c01410a06eb7b8d1fca93d1ad85b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7c588d28848dccf7c386973e16224cc248ddcbc6c06d0ecfd223a3c804d5a2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9176e04aca68bf32d5f4bc56630cc83c183fcd804fdf3fcb6999bcb11e6c170b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d13084b50125dc56268032aa0feb969a1a3225e5f7269fa6b957397a53932db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ea64897922f6d415ceb70cf19a12d533fe6cc4eda91328d902ce7b158341773
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 370b40aea1271565786973c294cf75a8587927b373ea0338a947eaded1cc04e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 475620262fb20d26f58f26799ec3ef67d88f603d3cf0e91fe931658400037ada
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af7fe57ea2c419441608a1b7bb8323830ce78c9f7c30f138afda46acbf300111
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7bea244f48bd1c7b60d3ae1b4e74c2189d51f7df0c639d3f227354359e1560f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6c46b199d981d5d3f931df33bd00bf77744f1f1c6e4dec80af6d31d54b96d8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36f7f7315a97951b1780b0fba234b9d312034fbb4c6ef216fada72458e5e3b94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1fa4388959749a47394e8d548f422aed56f2661e1361e6034b54185df1ddb411
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b33163a62d0aef8d60abfd5fbdb00d527dc5005cfc1ce88d164ea061f9c744b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61399e97b578f343c15d4929bda84b7c557d275f39dd669f0f8804a323230c83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4f3da48b1f2d7284fb017d660cfbcf6c78698ba03d85b63acc23fc2fa6bc62a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 298274c5e75a63426394dac9d23b8886b718f1713d40634446a7ea309dcaab16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d68959c6ba84c1aaa2700f1e73f99f465c685ec4ed637de744832fa3711f1b67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbd22009d57d6579539d4801a09818b13c84bf331e019a277677fea344b12a48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38414e26d0fc1dd89cf827920ea9383c587f05f5fbf67bbcaa9a5ed4575e493f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35fe8f8c02a219f91955c5917c1715ded824dcce79c48596a4fe8f46e9bee4d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cd70efca80e7c58c8fdddf3c1423e13f4a7d408b7c5aeec98b6e1732cc02501
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd5159e1df0a65bc81602928ce6eca45870dc614b27c2e98b204b1cb0ce7a025
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0fb4560958faee01eba13be38e8f2c93aae062d0071ecabb5c42aa8333f9aba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ee2ed218ca6aad16e5fbade54b850b68fb606940342847c918f48ae63bd8f15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 487b8e41848b5d4784896e399a4dbf90320bf4b80543d3b6e32e15276c3fbe6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49d5696d879ba6edc1789a78309b4526bde19c0dcda8ce3040a3183840f9698d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5ccc8a52161a59eadca3d103dbf7cfc87000fd46c9c4c85099fccd1be43cd6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edf8cf04523be265cf374c8db331e57ba055b3001230b91f0009786818cd3b0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9156e21a09f8655b060f031273862422ff9824a4fcc25c24b1a0f1c599273ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12097a3bd7b599a214f61fe3dfc61c90a58b7bffbc2e671bb6d560c5e2963f0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7745b7b32484b0e2a1d8f8307c28b72d3b364c839dc6271dec2b754c3e2c2d01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7bb15fa39c28f474229fde7090a13300810614b91fe054667fa22f2be462f24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf5801698f74da826ba91e277d260c748a51b80a69b3e6802418c9320f2fa8fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3411a6ac059fa80d45a79d75aa0ddd3dd16352acc55e0724147cb6bb7df81c8e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae45b078f6174757606e1cbb2cfa99f88db41c65831f98307a14e3ddc3433e71
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 caf3c567c81055cd4aa593fcb0363b43519240c803fbaa9eb26129cab542a413
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06d9392e5df558b2410504ad9fde7ffffc1ba356afda0b03286ecc0418708f77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aea49466068cf97069cd48f20d70c1de262acbe169bb5681eaf38be2bff98f6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed3da4df4944b65e9a40bf4213da65bb59a39ef7f818533b0e594842a8d384fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c767374fc6ea2b49b1081a85cc392709faa7f0e987bc608443a559b5ca4afe56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 879a78723974ecf4def6e91ff8a28427d9a6b6fc5b6dec20f7e4acafdb0f17bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b79516c7b054031108f5aef54dfc13cccb391ff9613eb241ec20c2687923f72
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 752874c96c71ca8cf81d717b81e06bd9118f30133c65dc0ccb40131e971d5972
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13bfb99146a3e1e0d7aa86281d70146808b1a8642a0fb9ffa57e70b7357c6b2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fc4f17f17d59fb147532d126f5e49bab00d8a931e7f9bb9c30f67862a92da83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2c58347a5efa2ca5a77e5dc1dbb0ea58ba67ed61002d37bf713c03f3b12a5ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6806182e43831916652e4a27e0c27c6c292a44ee4accd532e7d3e66e457a46b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 580f187be01ec943e14c3f30c94ab3c312369aa0641abb3c492397fec8ae96cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90b602ee38c45d7d08847821c16137ab3256819d8ac08ca3cafc2560edb35673
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 356001536314895e6c2531c5d35d68a962beca0860f57a88d04ee7bb68cf3796
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9d92611d864071a6716c037c0654064b815eb2421fa9b7f4d69b127145a03c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fe9d396ec7d931fa6c7762cfb6c538b65ae3ef5d880262fc62498942de7904b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c4140990b0378a982924e3c014257aa2f6cf3ff759a5138e306f64f32a0af3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f01d3c97afa0cef98ef00f2f196873394adabf63d15d40bc15ab37b792717b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b170acba068fbab8943a2b8c8474bc1cfa12e1931314d4d6ee78965cb67abd4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcc771a2f12cfa648e373d6b1af30882cc3fb62fbea57c03397a1ae9f712c68e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce02ead0f9824be2f3ad8cde29a4ddfacfc8551eafc2f1823d7a9bf06d036ea7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 092438796b2065765fb53a320692ded06843f3c0e40fa8f063763c80b460f0a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3442eb680218a4af46e26fc4df3901768461b4ed110d8558e88900b80a5f4ee1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6970dc3f497fa6d312634eebeec59a30b7f1c87e25455d102bb8b5c462827a32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa14cb39ac865ee6403869ddb43aae764b4ee6b4e7fd61bbdd4f95a5b94ec273
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ee16412fa72d5c1d35b5b4e1c5191496a1323c14099d630f75c4de30adfbd1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2568d01963aae354e619fe77712068faa3e4d97a97ff970d440a7a6bdbe9e965
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7337e4aadbff2b329e0258769a89723c7f0848524470818927d908afc583099b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ab45a8e8fc956af55fe54208dcfdc81e4668922141a7cb5b7709f2dafa3ebe0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d68a4bfa06b5a8cffc57fd37b5a55a1d3783e6c1f3ff97e2f3538ae2164fecd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39122fc4e6f45b2e19d553b2eeb120aaf0c07dbd60188cc64f8a6846327e2766
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2eb8625350946a101f73639fb5ed9f8cc93ff569f685f1afa2ef59996c710f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d0eb1c1a1f3aa5a17ca887f527eff66cce0dbf01a09ce8d13d06d12ba483447
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96649a13d26b28db52ae515f13dfb1a6c94eb9c11a83883377a39298bf51b5d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80d6779b9d22901797005a294db276476b92f9c1e1dd611d292474594108e0f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fff388dfbeca40339cf6af0e88e466e06f45c8243892d1d71791cf23b8e08d62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 700a9bf7c1ebabae826861219dff09c6314799d116800e0f08f2ff077b84ccd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44f8655a78a1890bda03e8b12c1738cf20623cda2072d4622dc2cfc05a249510
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9bca828e0d4c5ddf4f4319a075057b44123adf42fd267ac38ef35a8cecbd483
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 381cf222bae45a3de6c3fed4c8e3781478f72168ee9848952f019a388ef23d84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa693e48f61141b8b3a2d47123c7ac3b60ae8ea0ba7bcdd570474f8fa8b4520f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70be4f24923c03ea86f87c250600160209ccc9a448dec5906ca0074a6f5c360b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 410af954df57e31f6354f667a246f445760857b261a8b63a8abeb178d4e1604e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86646881393f6fcf754d498ece9dc2dfeff39f8c1249bb6d004ea7ddcfeac79e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f09a36648d66b18aed71fdd0dafeb791654419ef32c04be8b68142e7086f520
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a60ccc7be9eab95b77977c847717c4d01e878844bfa6747097416439b4d496b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d367701aa896c3873e01434ae80436297e9c9258ff01d7f4d64926e3ddb23753
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 1.3MB
            • SHA256 7c99c3ba63e62169c9604b3673aad85223c452b42a2b5eabe8e66211568466f0
            • MD5 SHA1 SHA512 SSDEEP

            memory/792-111-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3232-78-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3232-14-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/3232-16-0x0000000000400000-0x000000000054B000-memory.dmp

            memory/3232-15-0x00000000006B0000-0x00000000006B1000-memory.dmp

            memory/3232-1341-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3280-0-0x0000000000400000-0x000000000054B000-memory.dmp

            memory/4984-10-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4984-6-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4984-5-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4984-79-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4984-4-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4984-3-0x0000000000400000-0x000000000044E000-memory.dmp