Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/02/2024, 16:52

General

  • Target
    9503615bcaf6a0ab5ccea18be3fd600a.exe
  • Size 674KB
  • Sample240206-vdfaxsdbeq
  • SHA256 f87079fc5059cdd2eddf93d896e4178ada6f5fb33d2348a38c5da7315a3daa85
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 192.168.0.114:2000

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9503615bcaf6a0ab5ccea18be3fd600a.exe
    "C:\Users\Admin\AppData\Local\Temp\9503615bcaf6a0ab5ccea18be3fd600a.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3588
    • C:\Users\Admin\AppData\Local\Temp\9503615bcaf6a0ab5ccea18be3fd600a.exe
      "C:\Users\Admin\AppData\Local\Temp\9503615bcaf6a0ab5ccea18be3fd600a.exe"
      2⤵
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:2244
        • C:\Users\Admin\AppData\Local\Temp\9503615bcaf6a0ab5ccea18be3fd600a.exe
          "C:\Users\Admin\AppData\Local\Temp\9503615bcaf6a0ab5ccea18be3fd600a.exe"
          3⤵
          • Checks computer location settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2756
          • C:\Windows\SysWOW64\install\server.exe
            "C:\Windows\system32\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:2872
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\SysWOW64\install\server.exe"
              5⤵
              • Executes dropped EXE
              PID:5076
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 576
                6⤵
                • Program crash
                PID:2300
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5076 -ip 5076
      1⤵
        PID:1396

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 d501b5d4dc483bd78240af52c8efde5b0e15d2ac7c707386c5a1322d46ecc636
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e7cbb0749ddd7703859f06d0771b78762b2fa1c6d4aadfd52aaed892b5c1be1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 784b4d7d7f6114ef03abc3f2a414b9f40eaa922ca240cc56e585d4f4804ae946
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46e30881225cb095d3d4c8df5299ce5a9223cd1284fb0b37d466c3f0c1460534
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 858f8d7b1c79c23801d9090c51972c80643bdad149a544f5d38270af520a5116
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92fb4f2eed486b378d29c295553d31ac9195ba2cfadfd985dde8db3f97f9553c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 488c79e75bdb3f6f0eaef5539e97461b47c5a0404187568b6a019f72c5890600
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ca52de3837ff236536f8bbe5a55535c0ed7f1cf3bee0149d461ee11af551e8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6d848af05e314c54e954ef85595113193f6c446ffc39557e0b6bdb1a7cc95dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd6aa7b2f3982c783cc8cebf714ef1e702fb82bbdca98cb54f65fcccd4920e13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec67313b001caaf49783f6ea4d92a1d6873c742ec47a9f7451941aef3ef42489
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3def8a2b36389c4261d51928346e070360a26669fd04664f86a23c322c3aaae9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb7951bbb28430c3a4e84a8405df31efee2ba1c9b6f5d773c412b5b88d9d3503
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3c25b4ddf9ba6252b6837296407dd1421bd1e8ffa2d787de552c5603691565e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0bff8460ab239e075c72864e58be4cc3af7a423c31cb2af11afd3d416f3d8520
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a35dcbd55c2185bb0b55e83f7b7fdfeea479555743e5490a58f6e056a48053ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 388452967f869cb3e73542ceb8af3eb7e2e371d78b5433f6ccd06fd6d89be67c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2371b0a62feed47d3a25f02f3b16dabd1dc36d50f0575e18b8a231ca040f3286
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2e01e68cbb3376a2914f6e5f97fa00286bffa79f514dae8e517abcfbe41c72c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1fa72827a653e41646bd41a547305977f895879e40dcd57124c268ecbfaec017
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 559d4d825a43a2454ce520d5107e36c827674a42c44ff56b78232ed7f0f49fa8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6614fb52a89bab56970b3b1208d55db3bb80c79163bbd5a7afde5eb9fd3b4c43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce05bda97cb345f1fb715a0fc6e179ae95b46d185ec965c016bd9738ce22ab25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5953a1897a67a52b79f8ba57ac6361bee0aa13a1d55fd3ec43e0cfe893cf6de2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6320088c08482e5c40296746d3becda4a915288acb506d2268b867b70e854ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82279e5824793597aa4149793cd81eae224f8f6738eef7fede43b046f598f574
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ae314d4031ff9fc30c7e6e188e2aa4c687210f208774011547c844e9b822a7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 176e9ddfd3cfcd66f4f82cb6bae42b136122220ba2cc51f8111952e8a98330a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62c266018f6e2f4b978d35ee5dd35a328ffb413ffe368f413d8b71eacee0a817
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc7f86bbf4b0c254c149c1cf6bdfcf0e2938dfce60cf0a631b909f9e3dcb789c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71f4fd0fd9ed7d7157ad7798c22442cdbbb990140b6a01007d03da5ca0dc3ff9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0887ae24c9ceb4226eaf50bc90c8284a6ad48eac5461ac64399c2133fc9d591
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c3fa509fabcba8e6c8f7bb8c08c1c96e90d848a7d7a0be79302d8612693c7e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1cd4dc5a9c15986fab2348c788f49e2788ba82b0fed38ad697be80a19ddf4deb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc38d57a99450474615cafaa56c2b1b48283c93f0b4c5cd23fe8ff6c34ee3d1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0d8fd1208fa5b7e7847d4e7a448e134cebce003e317b99487120fac9e55e682
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b97ca5f5c65e7e10599442e0c9fa7f5cbab391f198eff31eb9cc3170860765c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e57f7bf567bb5df4bb12d66c273f68f5d8c4e4f46e94e80f56dd05eee3a87947
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 394d7dab82970573150bbb31b60b15dddf8dfe54a32e02e65936567725cfbed1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bef85d67f4cd226a8ea3055c149e50ec1b124991cc18cca45dd69477ef7261b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9189f4c28096b4a3dfe7519a7a8d7a39f11840d54336022ad83a246973011120
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd03300dbca3bbbc9f33250bd9075e2cdc599ae2ff8e090b8878e91a90a05a33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dea7b0ee1df72379585a9bf0e81f5c7136035ce43ab54ade9a8ae3d16397b3f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe756f0507fedce7f355cef942a6d03767c0069e8ecc38aa21b13f490c72db35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d770f1dc82f535bd74918cf76f44f26b515890618d8f0b70728f37783c1b3ba0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e399be898db03a0b9003674d64431c187a8fbd94979b29c5c2822c251a232991
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5dbe22ad4b86e54692104a29067b8914fdd5dd2e2f67114a39d02b5ce8b0c1e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8957ad11bdb652d308f96b1b882f8d6f45b2e5e03aee7cb2a309fb4d4a67863b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af9e2279b0cf62769daea70d4a88cd6c4964954b4cc573d7e29c19bc42703bb6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f810e484100d9334ea46e2ebae558ef5ab2b55685334d54641bdf2d398f16027
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae985f719ab682622c2b74c63138bf7f2adf52749c562f097b9151010dd98f5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aebe4441bca22502d374184c72d23ad04564596f5ca363bf541306f6e40ced2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9262d554a286562450946855ff2afc09f873cdf8f91c4e9fec6244e4cdb85f0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e98c08bf4f655cf4ff1af25a1202b37c5470a9c313bae837eb55760e30e85a0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be4439df0750624717e0b1c5893af659f96002a2815c2fb8cb9eb3ff82cf34d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74d6063254d9d257b1f0c9dd135336bc9d0edddcc9e55510c4ed8845bae65748
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfa9baf636cd71371c122b6aa1ae9885a4d4b751de082b3309feb63825c26b23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c38097954479b8711ba76448e9b683fa4606fec2326c7f3519912f7bf884963
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb809c3a52cf4827971850225841b70530e40c9118b3fe5e2b3a9c337f9f1a2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c3ffd5963e87517a288fdeb41fa138b23a7961a64935aedc3c2437a43c0385f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 714f9f1a593c7c55315beceb82b3fb0bf2b98a6d27612554975b1b95889ec59a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 caec9d26b151c81ccfb9eb9275af2592d7091823653606338402debeed05c9cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 812a69f522548518dd0f7fe374613b4732ac90bad6de2882882127e814f75868
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 140859d80d6ee21acfbde18b16cb5a299db4766ddd14c12e098a9e6cb3838c65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5276a625208dc2e0f2940b8dad7837ad990a25a93ccbf22027bb71a42328a4b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f71212fb835930931c320d3eef7fda7eb439a06a17a95fe604f659be59aa0137
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af5bc4198cfd23d65cd3626004d1c5560eacb6f4b3ffcc9070efbc1228c046bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8077f6cf448b9aacbb4fd10a4b9300ec1dcd89a967ec8ee1e94beb606c9bbddc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d146f5b685f5e1915aa502eeb73b47d74fed3f4e9d0420f217806158154c74e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2aae4fb6f4e8780b4c49aca942141c63c2b6496bf8b8840de4bbc9be81ca2bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 095152f80144eba5fab0d185c06872fb98fe84f225b392215c05d9b593b2b212
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 191d101d60489acebc3e2a8134f6a4dabe126336f2724e5af2f716414631ed4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f4f41fe85cc11ecd331b4ae3d64a45751f7b61ae502f6405ea3687dba648d73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72fc0d399524a36aa411d2b925c84925eb6fcd012b279c3afc993cb603265b85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ec34a5dbf64345de4399ae25ee7738119cfcd6ea0b87b1909a714ee7e752dde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf1fc545fb678749938361d00cecca85397296e7e88ea08ed48f5d959b7607ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02d07b7170e44fe762d3ab76d8198c39a988e1d3b4ea0d3458fafd3f5ac4124b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8e5495ed05c3b4ae14fa8814898f3ed100de9b16941e0e1b12f72f474f88b52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d33a90a82035dbe5f7822b3eb60b448975bc3a364580abe59afdb62afc3502e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97ed1e8004930669198529a5c4487a9400d7f2a9047e113bea1a45d236121ead
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9b8b740ba55d233116a52491254349b14c48b05c5f07fac64cd793ec0e2e456
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47bec36c9e4901807da76b87b22acd68fa5d9078d1368a3522bd39f383137ef1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b0cb67a20f4aa884863365c551ce9a726777993c2deaa3ee92f5f44fe5de4f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81fd3563b7591fd6984491a2d633f381377137efe2517cee176ba3fdb2317710
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b1fbccbf5098556bbeaf57576926dc2b20ed44da41583df5f81ddb3f0a705ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5610246c2e14a03cd2c419824a87516c1f2d8041b589df4365b1a4ee816ec73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39d00376ee9738e6d5dd1e8eca6f51e26a64161199b2ea6eb6be5a51f44eb0a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7450132dacc62c40d4073351352983068dea707df874966a8de78bcbbd89d919
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9fb7845610e0b83184291469c709f17842e1e3538ed626994767232b259f5ee3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45bb9ed85c5e1283864a571b80f961a1376c24edb5512089b6190529531f8378
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14a144f01b83563d2305ec0b890746280238b4dffc0fe366588e38b814bf7419
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb9172b5e4de8bb1ddecf7da540f38f8f65dd899efd6e604acc6789d93240e7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e863f6a215e23b9b45af6021518470771736091bf4875cdb64d11d96225db1e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5622fe6b2ddf985143eeb038c050c1dc204018983f081f70d96789651000613
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7e6accf5fc683aaa24cbbc75d8d0f0d2df65aa1c27596844a096a6b8e1558db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37689aff8cb4fde5186ad9c052cbc6f027e48a33dbe0bff0f1c808dece427e12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f36b0a783d2454a64f07d5c3a5f270244a5d8df5b64851eb04089664f39ec337
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca08108f61779c424231d544029b889c213b5432b037f66d7cb74e66daac7709
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01eb0b07ce4593ece7c0b5a0633d8f7871abe695cdc4a8bd30df741a99b97974
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c96c0a2bc8bf2bfe5e1db8891d3d722bea6734195bb9f5b4aacb147af3cd976
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68516ed3fbcfcb2b86f4eb5304ea8188c444a1be859e0a7b1448243e80f54ee9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d0896e35227e027a5f52f97a9c82461d7bb7adf36b06682bfb7c2e39a0ebbbc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d4691cd9353279fd4d5a6376593ce3d1126ba1239a4764bc8eb882467746c27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1db745380ec3ef94dbd0a1d7fc1282eb29e9bf1485b4a94b45aedbb8bd7bbbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a68445755abc91ee7f2f9b42a66a0bd016c3b37c3361301fb35f94be4be6147
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41e3093cc72e444f917fd0edd623f80384270a0384984c33dacb06eb6c0d65e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f36835297bff874f0c27070cbe7556fe05c1a0f146ca9d6e57af25b01403c5db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 613026bac74bfcba66d3d913fa3634d4e69835f342bf1763aa8f8fd41ffd8e8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a233aaae7eb81d78e4c148cc14f5df63e4491f8d6ee29f0d57d11243a5f3b0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d11f58298c8f2c3e6d15431d2ef8ebe4de4574929b4d74f3d6f546c5b4641f5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af3e1fda7932e3a29791cce9f316e9892a5bb3129a90c1d911d2ab397fed711b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8362357e1b0071b735512fd57fd576701f95025675b98ea1489b386cfc86c1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b5ff54c0125780377988ae8da453f212a218b8a9a8a8050626d6ccfaa32a2d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a10ca552b10a395bbc0521e470020fb99208c71dfaba3f5dc49ad5727180876
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aedc7eaf712bd132750b1dfb38c66f48376672f3db8973a82285b0ab2c5cc01a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3166d334fff1a582084a9f482dda66503463122bf7c50854056a817f2f9e8b4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1051a685c4cea52fab52540857fa83b88b498c32f6a3bb1b905a3f5f0e9646e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffcb033fe950361ca04558ca1396fe1261f87842813d7cb6acc76570580bde86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d848825081efc1f7f3d8ca91e93852418098db91cb908bba2bd18a0232bd344
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92c06994e54a81e4e232dd6a6a20afc89bb85590ba9de68522e6a80516fde6db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a46be6b1927e82d8bbe04b7bc85b6e1bd8da72aa0283a976beb371a996420eb5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74cf51ad488752118351417f81e6be93388623bd8c9cd0b1d52ff59caaf38de0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e2318077ea99c6a9495d6fabfae02e16230911dd3ff055b808e9ce961222f9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c9caf80dfd702dbe2d0a986b25b100b409e57f230b8f9df7d26a86d41257e25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f36277e7f605e6d5975e3516fc69f2041b9c780fa75eb63278e1ff18266bf6b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebba144f7e1205500897a28b87c793cd252546b8cd0fee96c7ab58b3ff8c9a01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 963bd3a06d980562770f86246af66193b9c88febb0c27e33e000becb6949ccb2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ed4434c1e0c805a14263219e4580ea3fdfa11ac5222adc4cf99eaf73b2e24f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b75299e83a6cd841b3e83dcd19bfd4d08da796c82d38da5997224dd82fb8331a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d04ce6ac1c5e3e84a38e3f0f333da8a765407c144bd37b6190a9be808c610ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38cece9c515a7827e9a3f7081a3c6630c11e916342219e752a485af26515644a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33c88a43a3303a4221c4de4a0f8b12d5eae9fb5976b9a55b51eb57ffa7e38707
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef1a318d400c205efd154410a9ee77ed50862539e740d9bb1e8f8d9b4ecf6c06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99b367ec1f91606d936ade13c4eb6917ee6e9f0b61d8fdb08e40ce4e4da656c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 401e7a13ad5a8ed898deed1ca34eee3cc0a10d1a4b316a621a326f5ccc8cf55d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 789ca4e99283c15b2c35838e789e9a0d272eb2fd5a5339dc7fa4d9ee8aecead4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ba19851a675180f72e81c0cf532ccca3dddb5e9167a523164c4a7377d33cc93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 daa2b1ed6c12ab2354dfd21d024402bafd02fac6dc2943cb74296662b3058634
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7fb4321cb17f5ca2abb6d956f16b3ebdf2dec3330e6b64d4cbfb16f3015b33b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e30a9c4739ac455ff90ce73d5b3029abd0974d28cea3cb8c834f08abc1d9c14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 314fb47b639369cfd25bbb1ddb10ef202de246d560d409e8c718537f53572f93
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 674KB
            • SHA256 f87079fc5059cdd2eddf93d896e4178ada6f5fb33d2348a38c5da7315a3daa85
            • MD5 SHA1 SHA512 SSDEEP

            memory/2756-12-0x00000000000F0000-0x00000000000F1000-memory.dmp

            memory/2756-13-0x0000000000170000-0x0000000000171000-memory.dmp

            memory/2756-999-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2756-76-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2756-15-0x0000000000400000-0x00000000004E6000-memory.dmp

            memory/2872-105-0x0000000000400000-0x00000000004E6000-memory.dmp

            memory/3588-2-0x0000000000400000-0x00000000004E6000-memory.dmp

            memory/3588-0-0x0000000000400000-0x00000000004E6000-memory.dmp

            memory/5068-77-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/5068-1-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/5068-3-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/5068-4-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/5068-8-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/5068-69-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5076-107-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/5076-109-0x0000000000400000-0x0000000000450000-memory.dmp