Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/01/2024, 01:41

General

  • Target
    6e0906c35340cffd5134d0bfb1ba026e.exe
  • Size 277KB
  • Sample240123-b4k5bafdg2
  • SHA256 acc04b3b3df54d366125ed58b5686485e752f1f3b47e8b7ca94ec6962dd08165
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • sameerhacker.no-ip.biz:288

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e0906c35340cffd5134d0bfb1ba026e.exe
    "C:\Users\Admin\AppData\Local\Temp\6e0906c35340cffd5134d0bfb1ba026e.exe"
    1⤵
    • Adds policy Run key to start application
    • Modifies Installed Components in the registry
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:4464
      • C:\Users\Admin\AppData\Local\Temp\6e0906c35340cffd5134d0bfb1ba026e.exe
        "C:\Users\Admin\AppData\Local\Temp\6e0906c35340cffd5134d0bfb1ba026e.exe"
        2⤵
        • Checks computer location settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:1748
        • C:\Windows\SysWOW64\install\server.exe
          "C:\Windows\system32\install\server.exe"
          3⤵
          • Executes dropped EXE
          PID:3676
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 468
            4⤵
            • Program crash
            PID:540
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3676 -ip 3676
      1⤵
        PID:5068

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 bb50ab582cdbd27b46584eb9739f6c45833039f1418a5cc86d6b5ec2a888d46d
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 230KB
            • SHA256 719444b7dd4168e52595aa1b5e77118ec76cc11215cfe1bd36e7644f91d55e1e
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 965dea512fd47febc19e92f69ccb1ca886d2ded69ae53eb0b7aabb57b9cb3352
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dfe779ba8c1db73874b8129b3e6cd6afa7c5f63cf12bfb5cc3584ae5456d105a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb0827cacb8f05829ffc8e4af1a6a0a6d94672e7580e350f5da2390c7adcbab2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9c6c22264aba042999c4b090961e2021dbb2fd002d4438c3cb14b75e1f61d7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1c32f78128952950ec8113f5f5730910dabf95b9d68ab55f5d4146307e4ceb5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50f29b0970a6147d7cb4047a110ab63d3c100d375816a9655f12f2001ad79a8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af1c2f10538f14c37cffb556e4bfa7c13bf7aa6b4e24afc059ff00197d990fe6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 138f564b42cd1838f014083cbb2f92e986f996a45dd9f8c60b37c4d58afef583
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cce44c20095e7127a430b4875bc64f544b4e6eb6fdedf2953ead44cd02423739
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ef74e6a56b2f1184d94952e0e94d28d60b4eece8aae9ee4c5af2bb08a56bbd7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9cb8577b0908bbde738da43645b547217db4b37ccf52b5ffa577e5afd8333e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fc7cb3e340d0c46272bf031beba173173c9a779c812f9d857529575d43f7ee8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59b3875f37b7130acf9c1128e7993e516019afd31ec9fb4bc9c5f03642c8d731
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebfe688df6a6619a9389a0b287957985710ae36b6a2a2427a9c91b963bd35aa2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 265db1d223d183114d52d54cfb16119d3e517b837714fec2be1dcd7a4d332813
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6bf31ee76f2dae9e1be6ece930961b859daf9f6e7fbf364359f7739ece49f98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81c4b0c964e8359503ff29315308c1f4943dfa06f15f46830138dc6f406433b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73858e40fc24cf90210ca965852fb5adc8ae53fe4c7086477d4cc71b60bbadb5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c50812c49669effab72ce2422d54a96f11b5bacaa98182bbb264086dc0c78b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 637c274048e7f4a0f797aac4e90a96db12856cbb04eddc98ddb3c3a6feb38d06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10c215991102b9a985eb839bda52fbdc65bae179219c40d5b8116c4e85ca2943
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 327de10bc77589efa2c03d4aae90fdfd26583ade00dc59c1d4661c1b82d6fea2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f5cf3d709edd4dafa9a4b61e2e330643691c0d3003cc22bd1f784889e5d2284
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8730359d8a9a1b6f4c63a06405084cfbf0df3d74a4b1e665e4971f423ce5536a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01f695e72b0b49a0328aa7cf55e66ef2004dfb252c9c6de83e0f4d3c31afcedc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53266b1e71d8f6077d67a2b27ad56859448de5716195419e9e10ebaf4902bc48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 824c46290388134d5163c860f9a11d00587bba6f9b3ee32824abe249456ebfd8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c452e7a9f3a433435833cab322ad8ef27b7e7fd3a78f5f6b32b3ed7154fd0d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59826b750cea79361ad163b2a8b3f1fee376b3ad5bd9694831cae2955b05028f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 226fd92399c8dbdd447690883e311438f4d80f386434d6a98138b7b8562fa31b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7e899173dd6a0a687034be4abdeaeb7388a456e407d3bf8625d77c44d7445b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d386dbab7f3c0f8da4e6e3777f397364971a68be8577f34023a40144f133acb4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c928e535d7f14bd8a0d1783c22d72154030b0da38dd7ef1c03c37bd2fcb7f091
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f0bbeb7896cea5756372d5ed3837f9cd95872adb1fbefe92d0e6bcc010941d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1386e3cf268d0561a20a30772f326f42164a34a25b5e1f78ec72ccfe20d4e5bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9276e6fe1113c23618250b250571282248e98682337d983d42d9c199c574d32a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e09c3dfbab0184d3d71b4654a9aaa3cb43f613ab9c5c7cb15d53e6471cc907ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 880f41ad830dad7125f0bb2e7fd035135277840710bd61b88cef2e6f894ada3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e237a3af6f0fa7b86689f0ff16c196d1dec0625c8eaf35377c53d210bd653d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50f7699e75d8d481e736fb36a897712c0067fd36d5862327269163d993cf1c16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a182888cb09c9de0f035c0b671a796cb4579fa489e997caa071946436f240795
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5e12d05d7aa65c1bdb10ba5d6526ad1edcec6752d77792f6f9f04c6d0ce976b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96f6b9fbc9e692ab0c9276a9a72df99df6bd9f2e2b688d9484364ea5ed518be0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afd8c085c2a0f39248bd773019470a7a8840d73981ac76863425ba1697f0ccc6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5779618c6c12a3ee8ed9051aa77d171686c33fe70d044986492f32fdddbdeaee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c824e2fc569d11d476592739b5e4bc34b901d49789bdba9b8d8a143ffa0ee7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e4726e4a43fe8b7c57eb2df6c8570537862c18178bc8be33e63bda68611ff8c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a88b6e89619fd54bd478a3fb2ad96a101e0b2256c1de1d48e972f51f71209bfc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9670dd5524bd30932c41103ee0cd4dc2c1f9bd45f437f37820e9f0c81ef4fe31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 082cc599f2efa40235873293bfe204ee1082b2aa0d492866d2fa51478e28d79a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbdf56bc301b011af43a5f94929cac650f1adeb3d37e5d4a04480d03518a9612
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 988247996248e259aa4e9697172ed40db0674760cbd6bd57b9b851a188ddbfea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 167c452fbb1643f3b2716fc058c58cffd62d94640e5c76c1c3753a0a67b78150
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd0efc6ff45f20dd17e25301c039c1ba61747472f0ecd1113539dad145566e49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a636a0a30814a79f4d88005878f8f8610e625542e9b76dfd876833ca5a8d46e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10304deb174a77d44a858ebcd31337ee4947e7ef41f4fcdf9ec1c83fbd6102f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ba92fe7955217679b102a87980e85277bb416a5876c7206468cd5d1b239710a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12750fe0e5a4bfe48575f044f7c1edc8893389a9221838943a429c26bb9ade95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 907c51e2adfff18577de1852b776d60e58d154c2637c4f5d63495785da8c5016
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b10f9964275e3041294f62ebaa57e243d0e481fbff57a99de67b193940ff0cb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61fe9e711a944245bd9504efb0eef0d244724d95eb4d5039769818020a715772
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ea81f644d491722b36f1eb601f935c6a52ed05c67918b8ae750a7f64664f45c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b8e5d6dab1fe3dca1fc84c5a6bcac4706867ea619cbf5a4ba808953a051c36d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 182e618087adfa5ff357290abb5f14b1b68b21cc2dee72e8c44edddbe42bf630
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d410e08b8047824c696b324a877671ff7a1af25df43b3261de1bac0206849ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11d168d77a146f15e9b2074eff8bccffe3e18c70a39752a9b606dd4e813898d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef2a9a4f0d8a9f9140641fdec7fc244903235f19c142c3fa72c0426d1c29be20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd69b4e5a8ae4e9218d4ed402bfcc35ded165814ce7c5ab5f7ff32673cd42c37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec23433623f3eb26c8e35d332e8cfe769a9385011753a18453fe61f50c3fcf8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15e873b77ab17a25cd5e4d9531fe9deefed05074bff329cbab124dd7a9808c0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d19440718d7cb1b10594d7565d5130c8309c33f587a47592316c9da75760fa04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf902e226a3dafcd6565d4d355a531c04904fcc9d87dee2f15fdb63bae5f689f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa050207b59cb26de52653f45bc41630ec3e5d32e9100fb4b3544104dc237a32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d773ada84de31a3883ca71a57f4f92924b30ade3d19171ca2f39b41569472482
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57ae149b9a8a1247d9a7eabc63d3d2d888a52bd24217a0d6addb3bcb9982c073
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 201ad4daee9bb13dddf91c1aaeea45e040ad8153d2dbabe485f6c93c1c305aed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d3263071d8bf3ed3d1aea70a861c043b55468444008b08ce9bfaf3e0499e5a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71117cb9a804b1231d5d2b3562e4cee49226d914ecba5a6a770c98995046d06a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d45d72550451f3c999108c0a913c1d1e218b5d01c7510cd197e8f7537c1eedf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e7fc828a983d498bb3e47f95bfcbc3f600ddcaf921110d7160f4ed43c65c0ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a49845a9ba6c4c8de49b4ac50e1b0809a7653413026f13caf887d3414643d816
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 075f6692cfac88d3595a24c761f0ef875abc4cc950d98845d8c23d2fd920a4ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd39e2d08cc3c8b16c37bb25d6e12be8582b5c77cc4d150d13c71114412216c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e508a70dc715b68f91753e1431fc58540e63a1e93de428f0abcf7a8624fac28f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 357c9f2d464377909a1e3a72da87a20f87b5d6df76b4c6b4b0d56ac0ab7e58ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13e6eeb233f394246d6c3bc064bca04940a75948c7c48cd1041a34b054df3863
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d2531a50f88c93196e9ba73cbec1ff6d6fa46e3857f8a840c0491a4f0ed3920
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d6be4393f0871f095805afffcc74e79e8bfe66abca1b95aeaad99311ddff833
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 780af72aa299917ef717d5655e49616981d7ada357ffc806c5ef329772f10b0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad2bc68ed0f79e7c936e600216e465a3133a1ac0b40cbce45f401e6a3072928e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9310efefa792c85a926011667c38ed60e0d49363bc8e14b049c62b4ab8b0e754
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90354c52f742a11246940af7309518b84142f98e316039574153b855c2ccf374
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77b91d9d833570413d91d84074005c12a5008539cd33e503ec1a673c4913f1f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c5f015411eb10f11bac8b311a3c44d837da97322f0406e2e8b0e33e98cbaff5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 275c9af5d9089f74f5cbc0c63031ff9b2f0a8910ea79b4e76423c119d5583a22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9b0d9c6514d7b4caefe7371c5e49bb2ee3614319181a1f69c9753c20a12acda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bb3c5300199f06db18a34aafcd3191a6722cea38ea23a8dd7c0134e620ec928
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d170a63b38eba68af63bacaed75f06db7a959f164bdabc56fc3b9b1f689b8ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68222048f3627ac161787cbe3e9e44c4a256f55100ca42003b5e1922f9372b7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb944020ebfb6b3dd9aef0b37c21bf033f3fce58f682180a2d1974102d0ded06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d23fb2d13c2d54b78a316f8e270bd8e5235b90783065121b9395cc843e4bed5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0083b9ce09d910f6e4f4136509f582dab54854924f37162635e652760f95817a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 973cdbd1e299d1d24856b6e84ff835078f134068337b153228ceae3823662096
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c2faf88a03dd593ce09b9e31ed0371e205e95609fba522c3a41a1f033c380d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cabef5b0039520c9f83fef388f56d091db4c0dc9df500ddaee9a3da929e51c60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a778b8ad5031b262ac5a3f24c5685e819351881d0c6ad363fc0a762d0c159aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6de5691424e7413ca35a13ecbed53af640f92b13ed9fd577fe36e27dd4684ef9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c290944374ab2da72d3bb84404a66d341c6b6a8bd9e9da53deb018b29177d423
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d43ec45b7a3596d9f13f472f26e5d7562b77f65492c30b341d2f46b752dcbf0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1ad9181383fce520f4b9bb1f0a6ea89bff040080b1ef37b1e0520cb81528c68
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7af93f2b36b471bb26d8d63bde45be4d8f546fa2f9dd57d065c45bfc2148f98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76ad93d088e034b96d21446e8ccafa0cdeb99cd765ff0e19dd301f9f67e478f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba6811db3500f196144b986f85ac7d4d71665e3fd4463803799480610dc09158
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4de7bcbd46f53ec20a62c52ad6bf28b4e49f6bc20f618d76765bcdcbb9afaeb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3c5613cddf691631dc8d3035e0a0f8c2323315c2b742372b94105cd9600c2d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c88636cce632805f2cfe527192fd4a37da16769ae11f79fd0e947168984c108
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cfa92c471f351461dc2ac4817c7f536d324cae44329f1d34d0df144b322b893
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce0c23ac7b0fb0475d1280c2bde7f814bebbdc1b25bcdeb94f01e4701d4d0890
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 413163cd9a0ff56a8ab63663a00faf08eceb5ca73d543e8e4a6c762966249b2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 583635a2488f0696a80b73f4a2b4567bfa88104d8f0448af6c637b5a71148644
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bdadcc7a6581146faf60d30b0517a48a50d6b45373143e621fa0fff455a54c63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 571f977aa264c4e0b95553d72170a31dce3b2fa1f23b0d5fc9f51137ab2c091d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4669d479b6cd081eef6248b971acb09d125e8c6baffb790600b7133af6c7b648
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b155dfa0cae1af08cdb21dcb5b97c428122ba7701fb2e58203509461ab4cfb51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71f51eb80acaec456e1b46ca40cd16e8579bda473c0599bf8d393e5f28b261b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04172bc3c73fe9bb7d9124ad80e575d4a2479bc91c7ef8b84104424c5e5e7b3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27bd4eff09aa090c15204f88db4f6e21b96a86dbb02be6c4ba20f18284185db1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25e2b86d16300a49d25278131c72b9912743acc1b42afd231383cb3e7fe00a46
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84533db93481990092499974390b36fe9450556ee2aaedc6e103839a197798bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c829f2efbaa707429cf28be72582389839643c816bf2884f6465419863559d3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24c917a48192608884749c1f110d56e38849fdb9d87b54c50bbc078077014390
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff697b118cd13118f1e7433232871b66bf4a0709202f71d529b13821b392cbd9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1feda5b43c06c1d5e27e8be3cf5ac3b58f0ebd3907751d85976da34d4d3bd9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da0f86ebe8916e3c1840487656a6644843c68d139b6c08280bb8d9a38fd09a1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3203363913c6ed4aafc31205764fcea730075e273feba1a95d4c1d155a2b20d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a277887f3d05e4254f8afeb1b9db8f1f9a5e2a3d524e62967146617167455c18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8683c1be0fe87b5c27cda14ee26d6024e6523e955e34a43254ebaf72de44e885
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5f63a0cb1652bf1918c8f4f996e09c3a0cde7b19276b08530ea90402e444b83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f4492c08a77df499daf8dd8af850cd736f993a3be35217f6bf72696c37fc0b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be207cc7637a240fd850f27993c055a191d28bc48cf46214f833cbb345d980c6
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 277KB
            • SHA256 acc04b3b3df54d366125ed58b5686485e752f1f3b47e8b7ca94ec6962dd08165
            • MD5 SHA1 SHA512 SSDEEP

            memory/1568-65-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1568-0-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/1568-72-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/1568-4-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1748-69-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1748-1189-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1748-71-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1748-68-0x0000000003DF0000-0x0000000003DF1000-memory.dmp

            memory/1748-9-0x00000000005C0000-0x00000000005C1000-memory.dmp

            memory/1748-10-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/1748-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/3676-97-0x0000000000400000-0x0000000000458000-memory.dmp