Analysis

  • max time kernel
    153s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/01/2024, 16:48

General

  • Target
    77e1155622c12de1a2425923a8f16056.exe
  • Size 359KB
  • Sample240126-vbhy2abefp
  • SHA256 d330111edcd3a8adf1be6e4cb95aecbe6a0a9ee72a44146e8ae8c8bddd62cbf3
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • qiqi.no-ip.info:85

  • 127.0.0.1:85

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3408
      • C:\Users\Admin\AppData\Local\Temp\77e1155622c12de1a2425923a8f16056.exe
        "C:\Users\Admin\AppData\Local\Temp\77e1155622c12de1a2425923a8f16056.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3992
        • C:\Users\Admin\AppData\Local\Temp\77e1155622c12de1a2425923a8f16056.exe
          C:\Users\Admin\AppData\Local\Temp\77e1155622c12de1a2425923a8f16056.exe
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4764
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:3440
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:4956
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\system32\install\server.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:3672
              • C:\Windows\SysWOW64\install\server.exe
                C:\Windows\SysWOW64\install\server.exe
                6⤵
                • Executes dropped EXE
                PID:4776
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 576
                  7⤵
                  • Program crash
                  PID:4900
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4776 -ip 4776
      1⤵
        PID:1936

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 3d20f96897244be3482331d0ec1aa10af600d6ed84ba52d9adea1bc9d41d4b0b
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 dc7633f3814fdba85125df79708edac0ddaa59b7e6f394e046b7070f428c16b3
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b8180ae5ff64c5a8e41d835d79af434449905b72df254fab2d90a54d24e6cbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb2aeb299bf5088ef075c4998f4b19f21f710c100b8b8f9800391cb07dc54a02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b81a7fea7017d33572e383815fd1c95c4ee02d08c46a50c2c452c7fbf53dbb3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63f7b3488388da09636cd966a01c31350d1c2e99bfd8e6e0c1e7e7f153532b88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0961f411ee620faf4a16adfd3d4851d3425ac6743a34b76c9895515ea057860e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c8023edb8589e6002d6048ff952a096b85829c6e7532bf31e9bd180608b1f23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f501cf24bc61c9292d2cd46660638d522960e5a01dde551673b2e7747790b0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 984ed3a4461cf25d3516434775daef7fd08319c43122e802071c1d83ba8c6ed3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fdcf16940e56fde71e1d5cee426c24e8ea32049c137ee113ff6935593998aff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0810896d25efe97d6acc012e869bb1dab6d317342cd135ffae4865f794e6fb6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ff6a0dd69a688be811ef3975d81994fcfaf771820cadb06ef88a83bca16ca26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f062084931dfe9db326f184b5d4ccbb6294d7610fdc720e0c27dfc2608379c51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d0af605dfcecb638adc06b6755ac4df1121037702d025cb4e149deaa6fdde0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fdc65f68e81daa5edbe06eaf8f35987318d655639229db9577a1ec3d71a8a1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3498dc5a8d03a011e1cbd3b98e926e677f618ae10aad7d57a54dffb3f88e21f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4916a259b1bd379d2dd0d6880e5c2acd8c8ea75c1265c15cf44e7a0bce9e3369
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a99354fafd66bc3280445c8612c7b2fa3c1e41a1c6b6a70e23f101596d5b6e47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90bc5005baa0f00475e9df6958ed99cc2144392756e03450cba4a99ce0ec74b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1776bc2135c4f74a698ae60e42f15e8d055254be8881f010b1240134db944eef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7eda6e66b66abc8fcaa17a7e55fcc5d402b3d0827273c6005dc6388b7616b1dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ae6e916d7521d266aa7183c82ae75963d9ed16ea3a8d9ae700cc121fbf403c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78842aeea10ad6979ab976751ac7b081f97bb74ea9dee4909ac6b905f46f4ac2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d69306670cae2ebc440e38e935c95cc89afcb2ca07283678b2fb88d82e34e181
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be875383f577a5ee91a2e2aca9eab3549d15661c6e0f8265bc71c1e63845c6a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3409627a529b4e7e6099179c6e17da71452847d969daef7d45503a9a4efe2987
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12856ea4e8e7b064922579a53f9fcecfd51dd0886853a10417ae723aab7f36bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c755a421a0d6b78b3abd8526b6dbbe532c6ba48661761ea8383bc8410b677db3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85a43062db96e5c2aac0d6a017d35030e99895042076d879973497ffb3c29c0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 182519af9cb8bbf260cde50734f3b9bb43d1904f83338f3effe92b006b9d39db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9dcaee457f59fcf0f589d975ac051514165b2e507f1a93abc8273cf47f0cdea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a582926878458c8d45659ed816e11e9f840e050e1c371e7365dbaf87ada9652a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7bdfda42a717fc73e1bb086ee2fa3d52062e7c139ee61078276bfe4635a16078
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28f9be926b88a0c1c53e57899e5d43c7218047cbeb37b175c992a93658073a90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bdceef3b98b20c944c9818a7abe8aa55d690f6d8107b894b8f8bf92d70f92dfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78ce3962de09119f266422711aed7516559df3d9b4cdb8cfc36d43b1d8258ae6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51bff1084b74657bbb1fc35d3b4e344de9aafea34179f15b3982eb98da7917f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31cb9da9573112efc42881bdb799f0ceea5cccc3fa1354f3a36ee3483d5c7623
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33d65c55616a47ccdcd5103abfc87d8c45d656e48a1bf51d924eb7af89760aec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8048b726c75ade6f69d905cdad5264fe1500b3eba1eee885ed2e7fb288e82af1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89fa99138acde07ecd1e25faadeb9db253b77388ef857d143cd3bf6ac414c0bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49246106681b07d36801eb81af49b3ae26d8f6823edd99f18f5f0b89706da041
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c8d4bc86b5b1429470fcb91c33ff843e63b450c0bfb147a443cda3a238ad220
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67dab9125c44dad2e7f0b5acb8d0c1b91895c3a688f044247aec564007797c53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37b0c1178b3ca3685746aef36709d82485f918de7e9a6db9663a61c9d28fbcb0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 462f13eb076c65720a5133558af7bee9e35fe9edd3681cbb96f1955bd270f5c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e862b7b72cf5f732b13185704c468738419ed235ef7731dea1d11a9af707998
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f90a6462ab7ec3d399f5b6d4a7bc151e59cf172b66e1a5a61b77e6b2e5fc743d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c15f9a00ff699e7c7e976555c219c0d7956f468cf6b4579a98af9c08ca295284
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b98c72e5df38ce1694d9abd018a1b96510e6fda3eab9a35b1173a1368ef5ebba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 783ca7746ca8e19f88b7866599f7dfa8f7b1d8996a90066cf927c481e7688287
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c3fdbbe53d5ed5ee1c698e8398f9a2745b9bf9cb3b663504ec54f42eda82883
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56bde16adfcc54f579673b10991edf871558a39ceb9fa2c76e94ae7c0e8dd92e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0d44fc2b3e0f4384ed695d1f463bd3e871913397f7855f986a48087793dc187
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ff8b8aa781369445b023a49f1ecf1d3998deed6b3b718783be150ecfbcdf6f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3daa629215aa645c82cb38caeaca430a6956172c7c1377545c2f62c534bc214
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a1eef4c5d37a2c8d482a19675d71ace3f5df16d4102d2502174e64ead74fc61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f3ec18e9d9b0b0bbf91d25d67a6e517f0a41487f90dfd2db8ec4e8ac605b74d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f96d554adc62a34fa899736dfb968b789079fedf971a8123012a04993b613d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0887f95bace51a046430ce9454084cb048bc26f43f7c076792031c40ef2b6fff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8c3282cbc3212c591ba80f486553b18500bd21d9c15f274c07891f6ec9ed960
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb96a5ac005076f4d807067ea97cf67400186cd076137a8d769a4ef467b7738b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c726a6a3cc6d70224cabdebfb152dd64a06f09d24dff84a94a1175308d448c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1445611158c0a3b2d11559cdd6268e8485772e7120896403c5c3df173605ca39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97b3f54968803c463e92327262c2f9a1ef023864cfd5eb104d9ce8fb86d674e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 411106dbd052c5abd849897cd1fae00b220cd4ea9a4423cc48209a35e3993e2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c9395c78eecdc4ba3fdeb6547e1d4baf6aca6093b1a408cb7c91d7d1b31cf9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 244197cb8686c7407f3572a3b1e91148ecf60ccac361d20990dd41f5f9fa715d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92cefbf0a69fdf0e6eb704e0c3c5f95d15549e0e90c793efbc35b0d7639c2002
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c854f133ec418d08e765f823286ecd0a18922f494f705d709626940c3b96c30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d40fe63e4222294f0b0d66f00dee97c7f1120a4d5428cf0428292739e136657e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbe9eb0a8df22ca7e6e16f390e9a14f15b389b2a4921e12db2bf7188088d35fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04fe678565e60468166eb8af5991f3277acb38d586c1ac883e6bd877759e427e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 330a72dab58ebfbab63adc4eb891aac81ea40b393da67e9110017a1bdac845aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 835714a5531f9ebe5d9872165c1e7cdbf3959d2902955419f6ee4b74f8be7021
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12e0a2a668ae1b5493e1462f3cb9377cd5b44f5cc42c2cf8e76efdda615487fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b82da6fb01f6146fb9a496a7ee671e1dacd6703fe9448570cfdde40f8a90b499
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 215d9cc99f67afe2e13a693c8401cd336891def82d626484a267031046ecdd30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 991244a7fef74517a8d641404781b382bb5ce249bba91ac046a11758ef2ffa0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d92e5fd8edac58c23a20b59c0c11e21dea8f8a67c6e9875865f9b4b13a1f1dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccee97a88f113112bf9274ce2359560a4ea268eb6be903cb72563d2d9af1a782
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d7850e2d9d807d93cb0d9e8523ce7b83491e2d264d86734a4a5acdd95de29fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8ebd482afabdb579b29fa98d1532e170c69e67d70f875c4dac71072829fb2c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f15e6a5dfc7cdb51d4e832967c8e71b60214962b3efb66705f27e93cf3e9811
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61c65a2b6a1e5e95c640e141b2cc765eebfb313a62c9a618bbac684760273c83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5160ed6166830ddfde9e72c47672ccbd9fc061ce23bf174dc4b6f44f9630d16c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b828bb16d7dc94099b0acb4f27561bc4f357c941c1673ca5714497edce0ef34
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b109a312a998cf57c119561edbfee014f7c962d6beed3775238da7edf0e6b5fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 449cc1baaf91d34838a2b5d720ee8a10336e1a0b3aaa2a0a6ade4a7d5d8edd2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ca1a7407a5ae05f8d7a9a77de87969551677f7f21bc8e7991dc443e949ca6be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a037b8cbf80708e4e4a7f49443de45451597a1bdac6bf17c28bc8d88ee18cbcf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2c4627c7e915817dbd9edc84d47d8658bf62804e8478cc45b3dc88f71379a32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dcadc033c59edce27cf67b6aa9032a9f80a0d36dba18850bd4597cff4089b8cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc3bcc8131558b36e745d39dd7336f30062c9d78271cb576e71259e2619b4f77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 341822cc7f3c9f60c8726f06ec2a120e021c877a8eaf6aa65e511f8b526dac5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51239a4b78a66feb220dd6e88fe3ec8647b3d84c62f8be49f824360fe82771ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ade3bf104fde729aa3010f21cbd509345f1d17c1cc80f0e9b9fa5d589a6909f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9c9aa8e71745aac675beaa38c2f0e050ab88e408cdcd6f1577f5ac0f2a56a32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d22c90a615bfc41ec18c6c3efc3b3e0f9d395e213ca285a93e465ac391a70069
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa2a7a20678acc573df599a3a5f608543b66fddac8f66f6e508564959f5b1c9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 526bbf9969cbf4b21865b6a85db563c8259aec675e1edfa9de066bd745226ec0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b435e2dfcf383c447dc5ee3d150daf3714926bc475978394b3b6e7fc6a4ee60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3c0861407100241b2b6acd34780d600c73c1f1a7872fcc6981d5080afba9eee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4958b0170778566fec2c1ce12b15d38e7f4cccddba03e68edc08b97753aa47a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc85e196ea30a26edcd9e6d7910cbca2e42074d99eb99e3247c9c12b070bf730
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a68579e97be96e76533452cb8d276125b0d124e1e9715fa166424a00cd292f67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce1f2d807297322b7039a7cb36c50004b400c30908a03ed7b83cba82704aa52b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d24e906b8b5f152abe24d0a65f06e7d64468f64167d4b551092ec7a578b99b86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8437d6af19f8cd566e72e8733d69d2279f157180e8e9560b8ff7379fc48a07a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2983a385c21550d68eb65d66f879871602dd000b83ca086beb33a4364e885f2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d5f050212c4cb8f64da58c4ce76bb1f75ad2bcbd95d732e820ba1fc463dc0da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42219abe4f45f750bf12ec8ea570c9206cb9fcfecc2c8e49a6a10153b0cc4e9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4d80aeb603baee836abd88a4782be6f0c1d10dcaa50a94b01a2538b677c25b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bd3235b138860984358dc0dc9f0ec1f9cbfd3867fb2298eaf31e9be2127234d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5194fbd537cbea82c4752de309f854d0c875281cc0a53f9c0fcd0372229cf96d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c136220a5e45decf25b983654eaa91885e8e1f62820fd201d1a9f19e03fb2a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f09cdfcb4e9133d36e06f95b7c0266b3d3c6dc7e92170ba5d31f678c3ae3cc2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 617fc6fbc793c779fc2e7f69f926c71ef9885c10c1fdc8c55f617b0a67ca7c62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc0f0eb73d02c91aa5ab2ce0a561a8ff81d7ca208428e1d23d5236a488482586
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ff12fa50c2218d9aa1006d8e73cf75543488b8137d99cfca50a2afac4a44090
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 833d359ffd424d94af02d60de18579129cf476bbec9586369fad116acdaabd6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4314c5406ad026fc842d947fe3f05340081426e593d79437c2e1170eec9257ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f93456bd04a184fb5734bf3a4333ec1ef16fc5d42a9cb642d109820dab46acb4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d22cf4ba7f702e44db169d4c2d88b52a32c539f575bff5baed77e35494c1e16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54eeb8a7b03a9dc0914739049fd0a02133da9a3e460955b207079b99d50c0626
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6460552744614b0333d929e772b1758b99c1052b4039fdb4dc2095c8462fb43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3958258b8e860687e500bd98a4422097f29e089a58f64de495a9bd21008ef9f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 334c2e57603ad536e0abe76b72b8a897074c144b898356c4ad7d3a21f4a8ed38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4130f226e8be351ad758760f53de6110e848de988efc23cd248d4698881f0dd9
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 359KB
            • SHA256 d330111edcd3a8adf1be6e4cb95aecbe6a0a9ee72a44146e8ae8c8bddd62cbf3
            • MD5 SHA1 SHA512 SSDEEP

            memory/3440-171-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3440-74-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3440-13-0x00000000007E0000-0x00000000007E1000-memory.dmp

            memory/3440-14-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

            memory/4764-4-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4764-86-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4764-5-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4764-69-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4764-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4764-9-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4764-143-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4764-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4776-172-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4776-178-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4956-140-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/4956-1265-0x00000000240F0000-0x0000000024152000-memory.dmp