Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/02/2024, 09:11

General

  • Target
    9d84229b977eb18da5880ab9dbe5a4df.exe
  • Size 456KB
  • Sample240215-k5pcssdc6v
  • SHA256 c645a928e2363263659f296e0609c11a6ea63eef5ce0f7022a803e41ee66f41f
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • cuentasdesbaneadas.no-ip.biz:5586

  • cuentasdesbaneadas.no-ip.biz:3460

  • cuentasdesbaneadas.no-ip.biz:81

  • elquesapemucho.no-ip.info:5586

  • elquesapemucho.no-ip.info:3460

  • elquesapemucho.no-ip.info:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    Install

  • install_file

    Server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9d84229b977eb18da5880ab9dbe5a4df.exe
    "C:\Users\Admin\AppData\Local\Temp\9d84229b977eb18da5880ab9dbe5a4df.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:644
    • C:\Users\Admin\AppData\Local\Temp\9d84229b977eb18da5880ab9dbe5a4df.exe
      C:\Users\Admin\AppData\Local\Temp\9d84229b977eb18da5880ab9dbe5a4df.exe
      2⤵
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1612
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1896
        • C:\Users\Admin\AppData\Local\Temp\9d84229b977eb18da5880ab9dbe5a4df.exe
          "C:\Users\Admin\AppData\Local\Temp\9d84229b977eb18da5880ab9dbe5a4df.exe"
          3⤵
          • Checks computer location settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2564
          • C:\Windows\SysWOW64\Install\Server.exe
            "C:\Windows\system32\Install\Server.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            PID:4016
            • C:\Windows\SysWOW64\Install\Server.exe
              C:\Windows\SysWOW64\Install\Server.exe
              5⤵
              • Executes dropped EXE
              PID:4984
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 564
                6⤵
                • Program crash
                PID:3168
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4984 -ip 4984
      1⤵
        PID:3224

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 c5a07c14251086bf9ca302ed47007a543e4837ef5cdd7bdcc75439eef46730b8
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 230KB
            • SHA256 963b7abd634d9feb77a74bfd9d1fa242500e0ef5bf46a44a2410b237a314a246
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1a6abb472f59ea6c355574abc255163713dd5808801822f7b2b54721bac3e30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88777743c404ae6d99ff7cb1e2aa9c1927a5eb54448440cdd7731db958d28b5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4b1c4766bca537e90b7c9a28bb8309edafbafe5aff39e8f50e8720624a6f721
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b781463d28ea434950fa8285f76ec877347664ad15715247794e6e3cea8292d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45fb099e95a2fc9865d48d6b5fb0c238b710d93d76de8f36572874b9d4ddbe0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf00615deea64638e1da608c945a8a4d44a38c00d2a3b4c9a2e15df9c58790c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dadb1e03c942b77226564cdf5e8fbd4a66aa8f55149d6a22aba4680c6c374623
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b69e29706cc791baa5b06e7df8ae30195179ebb31eff4a652dba2b4700a33a96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 866894248daa96cecc2876a0d6c33bc0f9a790c4e07fe2112aeff3ae9f9559d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b8a0abe11d30b65a3ce3bb07285ed8b040f987316ce16495c36c1a7017d3139
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc147c7afabebb4a16f694bb912e1364daa8c3e53661c8fc444f4aa12fd24c44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 917fa65f07010b3a556f8808aac99ae6b69453d0622b1e6271661a7fd6add09e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98331423857e96fe1ad4508e0cd901d27058efd22da0f58258366d7ef922a97b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d65f946a8869ab49c3f938354180da8e1072fe4e3583a683b777e77e7fc78fde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a92f2bae627783de59d837ad18fd056a18f0cdf4e85a5fbf97247a9abbf54fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbcd4927ce6cfedb1c725fe533df7010175edabdacfcf55a06a508e94df71291
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64818ec41f73a7aba10c63473e1749f65117215e688783ab2728e5085d06fb59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d78109ffcb7b5369bbce382f3b29fafc79b09b671ab6856f99bb55d3e03c80a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3751040ae0e23996eff25af2811aa19216115c2cae62e09ad24810d4f2049714
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef90c6880b6cbf521a7e14d54a6f7596efbae04f623d451b6c6b76aed58df2ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9fd493935ee65077fd2dcb2c018e8325e9b70f4f8e68ff2f0ab1d61799ed723
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21dc8748c402283ca3016be4166d93985a9f217a9a5ae3b3f2b8a61b5b22976a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2b810e11dc450004ef4b167a81351f2ee70b19cdb909d1b45d6f4504b0a4c5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18670774a6dfcdd483f2cb43eaf86003764799547247e3f1d3b620d9761dcabc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2f4a711d7b7445d02a6a0e29a563c104127c765522d7f4c5dceca05c8ba2525
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d10998a36fe8a1977d74d5267526b7a0bdec05f89657696ae534484cef3c3c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a38718c17bfddcca8a40b246a976cd4d72eddee5bc9aa88727b4a09032fb9ea3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d50fd40030edff4cef3e098373bba71421b6ccb944cd5ef1cfbd3a901030c17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fb14fdee2bfa734a6e12c19d52a32f5cb85947c490aabcbdacb3b60af72ee6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cdf781135ebc38f77c957ac9f236f175d202379356e33b8293f75471e7f02ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afb17caa307c785c52511fba5c8ecb6b6ec7e091558fe222d89d94fb02a62628
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6773dd0d9427167c756db97f7da9e3a8f6009ced5829e55b7cacf357ea54a2de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccb5bdd9fd0317f2e9f1f542023a28b70ed3237b4f74024ba2e04fe1932a2d4e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35d43fdce6bfe772db0acda72a8039299d66cad4dc790c0e0196657b316c363b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14f438c1eab618dbe4b1a80d3d8da52bde506ff9a955a39d35247c95092f90fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc4fb7f0d36b73aa3bf11ff8f5211d53410d7d41be16d08445eb0f93f2a4ef5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12dfc17bf10feb3d8040c578b74ddad5dc6db2d8f87408c3d1a4ec00e45604c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb5752ea4ef6c914b00850fbd83fdcc91b65c55e5af50d68a2620659ac64dd85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e3cae895c2f337ad352af6914317408e6ebdb9651f953e572d03b21c695ff9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47559be060d75b4bffbc05a86ae80e55e48bd04e57d1efdf065d83e0835b20d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 061fa4d4e2350978e8325a28aea00f4a86a3cc870d6ae27d97bab420a509be25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1d07add90684e3fb138aa4fedaa8e4d99e193de770e11b0697fe0f832021c23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f18d5e412ac5d6498a4a597996a1b1f1adf589bc5907a036b425c5a1942c8b7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 772c1c60db428fc90cfd001ac4b01f47fe74f02c46032bd32f223fcd2983690f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a56993366d86d0ef0049c77e883416251c7528943826c7166384effa4335b49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9736f6e5b7b4b613aef5c1ce8b86025ed124a3cbd716e48b67f8a114d0a4527c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32a8cd4865a30f4adb316ca33d3bcf644999326175cbc9c47f403bd2a21d3f3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 951d1ce349e4516ca0bfd33431c3fa8f29b652740d0ec5bb3f001eeb1dbced4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 183408bb024fed28b58209f9e943d6aaa43b959ee348ed29e639aad5697b5012
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3853e4adb2ebdb1a77df727bbe312c82dbca16b697f577e8a4ea25bbf957a680
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7f4d1721c8636795dccd1080a02793931258c2ba35026d594dc51f7bc9cdf8c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5136415088432472158d308be48349a45edcd9aab25de6e1acedcf8ab2d4bdeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b40687d29d7b62a7a3287d517e8b0bbff287e598e0ee7e1e04d157ba31bbc6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 282532bb358ab737870dfbc117d7beb798eb8130a95ca0288e439a0eb60dadc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9fedf825f43fee77a334df8d2cea5f625aa45da8a0284d2b648a27ac01501050
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8ad279669387d4356168b2efc01887ab8a01066ef1eb111f01151785d2d6a0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5909203f12814985f2e45ab9976bce8ed65ad5a6d76794a67541750a290cf5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d50d05ad91dc633eb9ec0f9f61a50a7c3d816a6112cbef7063b4c99b4e10e979
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e414c2776566c6e08e127ba3a502e444365f7b046faea312ebb88c205ecfbbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 081f57cf976a4e3ee6658d0c908508c1f971a9d9014144164ab48424c0267244
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b83af8b4c66e1e318df7ed87ae0dab46a4934a0c12859f28893fbfecc9c7d1e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a54c897df236d929e11ed5e28794add3be02ec7f912df24a20902393d43511e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 243d6be560f26366a1c770c76dbd903b91ea38bf9e289cd1bbb221c6cb5e7c1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27e005bae57c676162ab4aeb3e88acdb01e7beba89c8dcc8773d4b624cfeca92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 297fb6c5de6be2970401f529a1fd47d1440dc8fb6ff8bd57a1bcacaecffa2a03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e5048299041ea430522e10c117be31f92ac0a1aee41320d1077a8abea2c6107
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b850972f6df0ed564d10232ab8ef2ca09c9ee8e083ca2c583a90b6418403f59f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6f743d7f5c19ebd8c03fdf931bb85a02843993e03b4cf673e412fc7cedd558e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 557958947339aa35f878ce49d0c85165c37ba5fb70d2b9dd92b7fa49f0362911
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c944481f9c0b48d4b6c0ae031b5b951204245ebd81f2747d6e90018639b8649
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89cdcbcd8d0a8c32f3a599805572979737c177f12fabea2b81b9cf3ffc62374f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9379f2076f75686eeda10df1986efa15aed1d0ebdd57b31b5a077542029c2045
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 328d564e0e33531bb067a428611b628fc55684ce3ba053335c5c177863ac0a32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4766d93ae7e49e107dba7d872609e85fd356bc23be925a0762fe9c1b20ffc115
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c32029d99556dddcba68a0315d1f15275e2617859be0d9c829b1f6fdb554734
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 faf0fc139d69b5d3301b3ff7b50110a30fb9b69d3f1f43e102c5d79236428cb4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f56abb86c16a4439d113ac534f1442811bc4f48f5a67476116007698aa73e5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25bf11a82ee7dafd9ff457ca284f950775a3a222ecaa1fd02618f1c72219d7a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 229eff024cbf9c8cc80274dca71b12a55d18d92a345579bb71a43d30b1c5d135
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c533439f965138bd8af24a45615022d22d86a156f552ef73751fb85666638e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9225402ba4997cc318080dd65376d6d7773b4f46f1eefad1a86a09134180c89c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56edab4b5251370bde3fb4e6e700b1660df0f8d6c1cee63f583c9951b6389246
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b376d6ffe21c818b576c4cde47b7b19b1a47041d9fb3ab394dd0abd874063e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c29d916360bfcc3a1f948310c148a5896441f6d20932d9194c6c32d4edbf07d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 587d33f726ed3980e23b760f48ebe4ed9fdd1608824b1f2351fa5e689e1bbdcd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29ba78da8fef3711a63c2a173be1e24c6866b6ee5c8ad194b17d1284c9338ffe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57b53576fb9677ab76c41ee32143ce3345a44867b10333b44e5812c80ce08917
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7287d015db705b42fc71d0b1e08e80bcc34aca0aed83bb718aeb499ca0139505
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c0eba921be62d7524939bbede6ebe7f32572b06d0d766e35006550345e9d8ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fd9d85c74478ce5ddc4d522813145892cd84110253bd8fcd7efc68b4aa2d2d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8d841e9abab1fcdb926ae25df438e2db7141770299b8338f1ae2fa49f88eebf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b6b750e843d85f4f9a9db027f06039eeac92730777de343574669aa10ca5202
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e81930ff636f7963f4daf01519431e61bb3765cd6a14494b54849d2861cd7e1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0bf6948609b7b9898575894e3779d0c4eadbc4d67c94a2b630fd075cddcdbba7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4c2beed04e21651cd195b4989ee2518c10316ffd12548ca83c1acf9a8767f7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b354f0a9795ed2160af14d087cdcc79bdb29065876793fe61aa9048c176eb37d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79dbc59b7c47688bd076046e0c2140ba34076cb507a64e14f6b92c89cdfd4c8c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5691ad606eca3caef3811a507b16fc50530277e9c83162504d2b7a63d61add4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3b82c4a95a6cb5373fdfb099c7ccb32c6e7a994e257bd37b6912a43d511db6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c1f8518dedf42306d88b5731cad2ef8602efe9e9ac97764fe74876c7040b5a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ad15466ecc32c46dce8177c90300e87ef5d2b397f53c6e83178491aa793e176
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a6e4093e404665faba2b5e3d2bb57a1fd0c32781bbe62002f2fb5e0072111d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02aa96168905a4ff0ff44c0ef96fc76c12cba1369ec1201048e82506a82fd835
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d26ed37dad6d1e1843aacf0d128680baf45edc9cfd8483ac304c9c16ec236be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c826a9472bcbe583534fb98ef75210dabf16c07a7e57399adb7f150baad6116
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17d1e18be17b12c3f8ec8c1b66c2a59905aa3783df215c5930c3d261161e7abc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adcc428f706ba1029ef29e40937b7c6fefc20ae46536982a2539349933496f95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f86becd00949691ffb423b12d01f9fb718a24b8a4813f707e6d7418421e34566
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b81e2750f0697deb45b4323e84d64092948c53ceb91721a6949891f5ffd7c5b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58658f89dedfbd74c4c17b60616cb9dea88ae56168d9c2d192c203bf55d9a1b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33b497a218f8b909846c3f35b078df4b314502b61161b930bec4b9515c9f9cf1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e50704e8d3987d94958ff0cc67ce7cd820c140ad8fa00a375cfd4d7e915a0d78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 186ccdee0c00c79f0777d4999ec213f2fe4c4cad92bd54a5355d830de21ef0c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f184b7c6f963f5e6c3079abfd13dde8f7f807aeb01945edef669a14998d99098
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9ef79a7324c479d434cff7998aa5941d88bb3595de29c9cfeba0bba13216212
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a87ca0de483e84bdb26057f8e04fb46ec407495e57eb08fd9c808e50e9bd244
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6dcca86d1fdf1d99d23d6fc5f60694ce95d6903978a7eb7436b4b2140c24b221
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 854ebab2121d19c236a2b3577ca8062e7a08b38613ca9f42dbe1645b1f45a333
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 456feabc7ef702abc002b8b19001191e625ced7d7ae4db97f6f3806293a644b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d02aa44270551a11abd6b2374823bbf9fea5d12ab8c227527342e4f289dec374
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68a09889c404703b3c8708fe21a536d2b3b3fb17d2a51767fff2d5992452c05f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bfc39bdfec03bc79fcb931e2f8cbc1446b8ec5ec7a834c75649b399955b7480
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 908543d328449f5c21a6a7149504aaf2fe110d80d2770495d364d7dc0d3a0312
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5374b6805ae424f02038d7487cbc19379d9dae02e53daacf69fbaf7b0c11832f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0649434df64ef18944cf4ead87119eefe60451e109a3b1adb1ab68420fd16210
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2081b3b781fb3742c74392dfb03973c9c8793599894479d900b9d733a060d6b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8ad7abb3aa3f049edd20ef7a7435efe8aa044129b6e92529bf51263f20be451
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2400709d7492cd143de510596d4756d757c3bd128dfe8936f71fb2b2a42b48c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4b790a350319bf181491cea2ee74ff042c374c852a3ff313a1496abeef3dc66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b2aa4a392ebe7f23a909a07d68486a99d92ee0543845c67c74d46f5707abb7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e59c60bea3dcb30b3c8179628e4e513b8a53742e2cdbb8a316d8e22a8ee6ca5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a14991a1e1e02d16e355d7f1864ada58de81f5b94574de3fddb4c91a381ff5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74f53e4f4ab2d40e6efa5a2bcd81311f085932a1a4fa3ea8c5aa6d326ced1f0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31f8e65ce4871722d03f4f63c401db8d044de10c11c9e8833399fdc52d9163a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c09c7c394e5ab8bf68e082e08539670f35eef1fdb27e4d1146e68167bf53b26b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3ad4e674271b56d78cab1fd5efdb728aa6113c18829d8ee8c31fee6c2e7cc28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9754818d45fd5d8c00f5577086f9d396b8897d11c8bdb6ba877e0369293f35a0
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            Server.exe

            • Path C:\Windows\SysWOW64\Install\Server.exe
            • Size 456KB
            • SHA256 c645a928e2363263659f296e0609c11a6ea63eef5ce0f7022a803e41ee66f41f
            • MD5 SHA1 SHA512 SSDEEP

            memory/644-8-0x0000000010000000-0x000000001001C000-memory.dmp

            memory/1612-12-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1612-10-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1612-13-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1612-4-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1612-3-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1612-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1612-82-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1612-17-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1612-9-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2564-22-0x0000000000560000-0x0000000000561000-memory.dmp

            memory/2564-21-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/2564-1268-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2564-83-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4984-119-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4984-118-0x0000000000400000-0x0000000000457000-memory.dmp