Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/02/2024, 06:03

General

  • Target
    9400824b35d6b7a22c13d5f0ccd485c0.exe
  • Size 444KB
  • Sample240206-gr57lsafdr
  • SHA256 ff0451bb8dd17d2c1037379f621ce663be603dc3cb967c9cb21c624223fc82ca
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Yeni görünümlü hesabýnýz en kýsa zamanda aktif olacaktýr.

  • message_box_title

    Facebook

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3496
      • C:\Users\Admin\AppData\Local\Temp\9400824b35d6b7a22c13d5f0ccd485c0.exe
        "C:\Users\Admin\AppData\Local\Temp\9400824b35d6b7a22c13d5f0ccd485c0.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3348
        • C:\Users\Admin\AppData\Local\Temp\9400824b35d6b7a22c13d5f0ccd485c0.exe
          C:\Users\Admin\AppData\Local\Temp\9400824b35d6b7a22c13d5f0ccd485c0.exe
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:400
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:396
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Deletes itself
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3264
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\system32\install\server.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:848
              • C:\Windows\SysWOW64\install\server.exe
                C:\Windows\SysWOW64\install\server.exe
                6⤵
                • Executes dropped EXE
                PID:3012
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 564
                  7⤵
                  • Program crash
                  PID:4080
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3012 -ip 3012
      1⤵
        PID:5088

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 0eee2ac619a3454fa61017167de43b55e179f07d2442977c593cde8d58c40056
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 a7ed92765f520f9ee35209d5dacae6d28691263baa510310b70b4d9ce9d76c0f
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 303d86d89bed8b8656aeab1963242108e8bde495b5bdf38ceb5eb205ad830de6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b96ffb60d92c9530522aec54cf5fee87253bc036aeff23797cee039921a816f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 940d9559cfe4c8fdeb080990566d6edbe5dfb7ea57d697f6781d8947809126ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 923433a059af74c20ba47964dc3454dd331c3f2ae3b19112e42dce0c594f3881
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 419f7d72d8fc281b041dc7fbb7f144f0fb9758524757051f80cdb950afb7ab7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db622da4f44057f0cc5dae89c98ccc0038ad192809cffd1ba8106ce3bbb1d84f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7264b0c17ce6ca3710e4b196a989be378b373bac06dca145d8c2ef2637399f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f710e16b7dee39d55095e17b6e4f459b9f6b862187511f7d21e54a527d0563c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b90ec1f7b105071b2b867c2d3268b91d10a149563594cf2ee9e1638ddba3ecd3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6abe9016acb4a2f322f298687a253aa9a0b6e3b398e3339e015b2acad82a7cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae6dde1be3695dbb0eba92aeb85920cad6fb8481bc0c98522bf84e7d25566f66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72dc42ea8b3c1431b9d65e1b5d19e2972a23bb30d0884ada34ced63785ad74a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 196210673a254e2a09a844cfc49aea1334ac7b513cbf799020a4fb22e180666f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 602856c080091fbfd2aeec3efb5ab2e35b19a7ad00132f85eb23e2b6b128c70f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4fb22df019e3bd50ad30e64e0392f6a84fbff0d61da919fe93bc9586a6772ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47c27994fd6092ae85738f9027ff16261fd84973eb66b6ae449ab728962fb6c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02cbeaee52525780b7af5a24bc6db896729366ad14de876090c40f89d260fdf8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13c651d7a95ca77cc2c2d1e538d6919d4bad89c6c1adb6c11f2544ff5d31d1ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60a68acac628d75ff470b60f5309c9c92f571d4537d0558e13089223e8ce01c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1971d8d8320fa2076c75e95d1cf2a6003af6256ad085fa7165e1c50ebae01ce7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba55e32ce8102befb974f93a81f55eb2074fb3fab615430c4d47df83c7808888
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab30ed6abcce030a4115eff5ebdf71750ed107970b389ba38de687b34121d5a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de167cf0841eea5be9bd60951084a83afdd9991b00b8689b83b8efe253b096bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 327c442cd1778e6b3c575a4d83850ebdb363ad592a64a30a47c9396406b99e62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6139b9643a5b892668540c6a2d964a17e6f45e1c332394e5a712645575540c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10b81b8cea0e646d9363474d994a35c57ae4b5f4b27edfad081c3dc9bdd3fbf3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56521d6b29f2dedddc6e68528e8f6fe218b58530bc48faab78aa6d278199a1bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cebbe1eb217ef7504b063831f6f73e53defa84e74e5233ac8a9e6cf98773841
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2d6e727647bb7f8444ee03a2e776fde6b9e58911e922449edc4d837f7748cf6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6facb4aa01501d590ddba8bd404cf90970df5f29bf877a27f78f2b0904c5f13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 728866bc872c8cbd41de1e90c1456058f536c9372ce001c501d787a5944b5b26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ab677f191c64438af4ecf754a1a04dd3be245ac6ec4b4290eefe0565b6f6726
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebfaa6e246dd9a6e85c1f111f2686468175c01098993890ef1ee7d4ed4c51e35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93eb52bad9121775849f7aac9dd46a4000d3f7ce5749ca94f9bc3051ca5c726f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a56eddf306fd40f4bac2cf47f836fc178a58594219ea3b1d65492287265e21da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0189f051f79987e039ab1cf615b61d81982f11dcac555251ba264089fb614963
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f164bd02bcc3fdd8b93840321aa30f2ef8432b9ffa45231e1f62778ef620fbc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d879baf1eefb6d6a3c02a7b2b13aefafdc4e0e87877030fa748d538f454e3a77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b99270d1c7f40d3d0d64a1d93cd22e0543f340e2a5acc67d29718056ae4b6d0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f386ff164c6b736d6667354a83d48db8c1f60daaff16285daa3eaae5774d6a02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aac6da1174c160e40d9036727d452e049201deebc350971c88a5c7d43c00a58d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e63560f340212da4c0633ff1abef13f70a5073d5d9ed3cc09137c2821b6fb446
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24bf42feba3ba33db31ae5baf55ab2e17534f323a6bac57f06fd40494d0ee663
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e03e904ebf9bac7d2f791dfc06ab08355a20b5318957957d6092f9affbeb80a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7927b59f3f422f40053806ab21129738e2bde371752ca22ce85c09e466b6a3a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 288c0488f1acea9a0540892f58375090f9a1e8fd53ce68311659ebab60068226
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db3029bb6983b8b83f6cbcb958bd8d254798e427d9875f7d04cb202cf31863fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 306e64f1b255e1ad22b0b62563b75b50a7c527dec9deb5c45d1d265608ee14c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc551de85020e1dc08dc010645a86148e3be1ccc53e37c43fb4677a25b110155
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 759955c598c590da447c28f0d42da5260d374041128f62f740c249a516727761
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2dbd2ac9b0c043a26c80fc6e0e513401ee04903ca2c2a787073e0da0abb0989
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4d581479ab209a028bed1ccb5658752fd10ac3fe05561399968f4485a617c44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 205289e34ed67cac7a6bd27cca990048442c3e1e93a58af7f6e589f534bfb9d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 177e967741ed44fb838a80d15f82b10c43ba00c4170d44713e224093c82319f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bc560b17f81072bd449860a110001ec296f603428f57a7e94dd9aaf00f517eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6394d8615df2eed57bc9b19f108daa791a50a18c20d1dad18bb757acca0b3388
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f73280670f627f35e5d8fa453d083210693c92c34ce9136c200323f33b8f718a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5365ae5f252b0056c3e8e114559e85752055d5b8a2a8da5c3d3fd66eb45bdfb5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54ac12448afed03c6e439b61e8515543973b1b6cd60f3eed3a868013af6e2f80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ad961589b74217f7c6584d134dbe576b75c2601e240e479c080bcbf30d7e579
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b54e2e4968f89316bdc021016041aa45a4d324549a734afe70e67a0d73cde1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f02a82280b4dbecbc3f7c55613cd06cf9c177ad7e547ee0732dbce7605590a14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d64862dd68d8d6686758c964ac1bb962bf6f694b1483f0a40a21f106473f69e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36cca26908510d9d41f61415c4b238a13b0cd04a8597f563f061687c3a0c5252
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bee5c2ce884b86ce08c9a58993a666b85b7676113615952207b517502b8ff060
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa4e3245f0d541ffd9a6819b1f3d89b2019c185e9c91aa24fce97d011baa819b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef9a0b23f19c44daa379ca852738e587565f8bf95050ed203c1ac4b3542faafd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dba06f95bb3b4a965e0a7c43531c4c0b92f3b5ac09ee2663fa067d570d354eaa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08c14b494f54f86076d24764a8001c20f2aa034e32d5539ebe6e97bbb82cc100
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c4bd1239eafc58c059544e1fad7184ee4664d6909d820ea0287e1f85c736954
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5801cd25cd08446dcaac6fce28627d514997ed405aa2d31ac42064e307972ee4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a794e3167306ee3efe6de9953363826c09ae22f9ea9f7640e9457bcda69aefe8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95e6603894890e837ca9282ce90c9426f0a1873b265a7fb8e6e484e35a4dce39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f7a9b54e6a98f6b9ac7b329e3ffc10c3fecb4c20390c771dfe657b50fe8cf74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f35226f73b36ce43c381f954d654cfb3ae278cc753eff177bbdc0af2942b9fe2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65c11db903f8205b7811c718c27822b7240653e8747971759f28d1cb91edbcca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f55b64620a5d29d15dc41b3acc8c0c96c71854a6c502abdb8679354474714570
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81d11c75914938cfb1125c968b110c97e95378d0de04d15a42863aab459c85f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d314ba6b6b874c5c9f1ab854299c288ea1d4727432b0d2445fad8eaedbf1a20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d6b52cc53eff2fc283941cd3d3b55557d759dd17955dc4827e7ba91797f1cb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 945685bedc0cfde478a52e8c79c09280fffa46bc298d5590aea65f791d03d57b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25adab86a32ee7b9fcd0f4480c201a41c5c108ce2c720659c53125cee19835bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97e055507d8abbc412a39f3ac86c269ea6f888cd2ad730ff0f2b36aa192cd752
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e2a83b6847c595c07d6d92ed21e81b6973af09d3ad919039f7c71d6ae7e5bf3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3734983bd8005fc28cec658b5d4024d63db1fa54962b03be6a3cfd674aaa020e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd30ab6689a835f8419f1b0dfbb883fb39ff763dd7500359fc9d0f7300e20b1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc9ddd6126304c80906b682075b331395d2da4c17535429a7cbdad3b9c1ff7bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7eb9c511f4a664626a67d8d7ac82cb2b565c8a9e7b9e35bb043c5ace97528456
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 057acc9fad66e1db6a9f9fe0625c6bed69aff02e8ec19b5b5012036487bd9e0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7014b9c05a41ddfdd09d5d5266dfc8d5f173d2e50b5eb2d84e884ffb6725d5bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79878836cf4aeff2376da96aea35b8ba724e9980b6ccb51ab648b92245fdfede
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97335fa0063717e2f5935b32f53939d761e6ac7a6d33e521fed0d6d4d9690e8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dac8555b34a51ea8af4fc268dad90447ebf834808e2dad13491cf2c64a71592e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7951dfb0fee44240352d51b5e373526f3f9eaf0a03e701175a6c53b0b065f961
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa76bfd3b634a1f9003c610ab23597252896de39a254585e87ab90cac65cb6a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c49cb9e0fdf60ee34d3196b5519d34d40c3ef91065f66be9a46d4fd940dd643
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cace73afd8a6054409dcf27a9cd430154962737cc811cb811bf68a2589f5db38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4447f47c113d1e88672a996ce8b03e3c3a1a70eb7ca02b09767ae92b62064aed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 274638e63016ccca274a9c5db41459f0df49a1a50863169c13122d9c22061662
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aefd318808e9e26dfa7d4a2bb1a2860410896e131cc863429653e804105e5443
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bf4019fa0ad842eacb0759bafb9e3c1333428418726fe1f573e353c7405723f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c349658e73fdbc9c6f7fdb2eed60fc832f99f7a64836898aa556951b3de4cdc2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 407ce0786cea4f2e08547f3c4b2a7695a8e64db88f84614b9abad6b2aa87ef6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 225c2102bcda24c8be4d0cff675babe030917e3612e0dd5661d3acb57a0a94cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dea43cf1370208b1c70cf88d740a0d14443799c0fd224e5688353c258f619c2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b25ca4a3f917a20add425a257be6a1316f2431c600a654586cb5761fa76952f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d9d7351c1c27c3d9389ee38b5ba13dfb41dd67419ccf51b65bb7b33bd6f3411
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96a317ef0c19f6e72ab05858ea721cc656db465e5d8b52dfd7cc1dbe4e6025e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c4a0b453c8dc65094ce101720f037b39e27c2ce71c71dab6b8d6e66868a27cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a27e08ac2ac942204541cdf05b08d9bec2e5a76c9b09f57d9b3092a1b41352aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 872d598096bed2316fa9b494c903818c2007aa999d137b80c9e9d082e32f2f81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28c7429f8b1ebd77712b3ae042aa6dfcc0329b20964c71cc4fd18e4864444774
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12fe802a6d794887f41167a293998df84fac8d980dd742beafd5bc3bb3a08554
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f44d11c9e072025d3130bab3b4b9761158b6e7b201efb726d22afcb8f43a7973
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4554a819baffcd60806342dcf621c930ca06b70f42e4ca1876fa33fcae68ad4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9d94868c68e654cc6002d52f2b4cc3e5af7c0d2da92f34071a166795dd549f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7c6d5fe81f170d3681e9d3ed898508796b0fafcb65583cc67dcd36b7b82a91f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e11b26059e64b64fd8a772b57ad262381b4315cac5f5d3d63170dfa2fbcb5e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5179ad165b0ed3d2c1b3b97df0d218ba5090a24d144960f31adced69e4b551df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d6b8c0ddbcd4957f6b96707dd70ab852cad38409e45980faab189b5709f5e3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d353bcd5b8441947580b339f96bfe63b9324ba69232e969ec0623c59127b0973
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79fd36039533336f921dc754582728eeee2a6dd14008da32f84f8ffee54070e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 034ff20e15f2379f984d6fff55f184fa11ad14e99286b0a9d852f270fb2de5ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68272d004489d58b333929f4d1f43bde8f2faa9d38b65c25cb6381a8caa9b749
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 266b168726142fd17e8282e1b0f97416fb02e808cf5544fd5b82635990cb2a77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40bde8a9b0fa4db9ee6bb4d62458d6d6f3a09f1308a173d466b74eec73b891b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d4fcb05206b80eebafe3cab7d6ab50248a13ae3e5e4b8a76db4eff8f8c69453
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 171fedf624dd8f294bc6e7928f7c40a050c48347322a849414619f05f602293a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1eb0b961ed91c79de86bd35b8d711ed08fd0417c76a235bd86b0b79d588a60ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 160bdcd2952bd9d80d9252ac2499036374939931d0941f6f9dd2748f2f99a3d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1519ec801e3cc47f77d5b2d414960399eae764e1285b4f90a172744ae0b9006e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2449999b96927b0cdfe6de29074bcb6e61d6aa94bf66c12a1023424cd53139b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7590de1870177e5cc8b7ee4d65ae4db30074e6b8e38b545414284609aaf4129b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9450723477438dfaee5b7ae0fbd5bccf2116f73ade2107e1ce45b17523b6fc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dfeb033fa513f3c48561017b783d2f7378a2dc6afcc32c2bd437334249ee7c2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecd33d859f7fcc6261a5d1ae5c7628cc23a95aa1fddddc8507bcde9d1c988715
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 444KB
            • SHA256 ff0451bb8dd17d2c1037379f621ce663be603dc3cb967c9cb21c624223fc82ca
            • MD5 SHA1 SHA512 SSDEEP

            memory/396-74-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/396-14-0x0000000000910000-0x0000000000911000-memory.dmp

            memory/396-178-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/396-13-0x0000000000850000-0x0000000000851000-memory.dmp

            memory/400-2-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/400-9-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/400-143-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/400-5-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/400-4-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/400-3-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/400-140-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/400-69-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3012-174-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/3012-171-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/3264-1424-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/3264-142-0x00000000240F0000-0x0000000024152000-memory.dmp