Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/02/2024, 18:36

General

  • Target
    9e462247c8f8e736f3ba05014bd386db.exe
  • Size 638KB
  • Sample240215-w9ejyaeb49
  • SHA256 c0c327a567f6744eae353775cb6da9370165e497637ba2ea2d08244f64e1255f
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • country.zapto.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e462247c8f8e736f3ba05014bd386db.exe
    "C:\Users\Admin\AppData\Local\Temp\9e462247c8f8e736f3ba05014bd386db.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3292
    • C:\Users\Admin\AppData\Local\Temp\9e462247c8f8e736f3ba05014bd386db.exe
      "C:\Users\Admin\AppData\Local\Temp\9e462247c8f8e736f3ba05014bd386db.exe"
      2⤵
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3608
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1036
        • C:\Users\Admin\AppData\Local\Temp\9e462247c8f8e736f3ba05014bd386db.exe
          "C:\Users\Admin\AppData\Local\Temp\9e462247c8f8e736f3ba05014bd386db.exe"
          3⤵
          • Checks computer location settings
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2960
          • C:\Windows\SysWOW64\install\server.exe
            "C:\Windows\system32\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:1100
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\SysWOW64\install\server.exe"
              5⤵
              • Executes dropped EXE
              PID:4460
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 564
                6⤵
                • Program crash
                PID:3024
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4460 -ip 4460
      1⤵
        PID:2124

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 f3dfff114dcc5081cd425eedcb1e84317f9348bdfdead98df0fa7eea10ee14aa
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 57c32dec6fc57b09be7630531a288a41c0c1434e5b6803eb53c5d407dcf9b218
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1063c0da8c861b66cd38ce1dc85a635ee3501874f248a43db4344d6b64c321c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c667124310564a1fc011b872ebb30b0035f40a63dab775304c31888cf41addf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8701c93de6f64f195790a2a289f2b3e6203c7a9ed7f1ece428f11c637629ebe4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b491891083d72cb3e731f8c7afc1317830569b34afb3b99fdda265cf29eae910
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b19d9e5212d35e0ba4618ee79d24b32180f6642add507848431794b37e69b637
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 487cea35d8e94e078fcd8500afb382dedfd2e2b97fa94f2858fc50bc05601aff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd9c66369e3684c8cacc98c6ad87b3bf76bc88dd0574d7e8cc4a8bd6e89727ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b399b419d7e0fe1dc35c90b2435b0a6d4133a527a8000300f8d867a9e88bceb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 070aaa5312339c0c1baa2dd6a7dcdb73919bb29cc920ebb47687572b4b0e59cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 382f5cec0bff12dd7cd362dd7142c0dc9bde72907647fb46e10116e33fe761f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1d98d505911d64982e3fa57c935168d84438a7bed1316d943514d5304a97a3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0c7a720d0387ee87847c6ed82b5f8f714519d3e552a4c78715f8d06772a7da3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64ce6bfbecd1635cb3544879ccb229a1c475231df2cefbcabe1803aa44acb151
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 298708be31ed1228cc8899e777e1c0f5cc0bf59226853ee591e30f713ea80fc1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d05ad14289f00a1e33fb720b6c187da7f795b08d9c93d71e354b6b1b6a3aa321
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f1e7669ded6123a0ca1061bc66983d5c38cbd928b9a705871efb3608efe7312
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5dbd5cbf141969279ea9e54d89c8fe9cb10dc80cc00c7bed7c4a0051ab246d38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b00ddb37d5b34e9240682add117b50607340ed539d5646be3b7e4966334c407b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a7abeb475285b0d4b21b79017dafd55f0b94a3c5e8ec406183ca0414a7b8fcb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a76b4793d2cd47b3e4cbcd0dbcc9d2196c9eb93c538d63a14ebcd7e2da5b7b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e84db527e23bb39161f6747ad0ef9898aee9961e8851d9c655214fd4da65c7fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4459e7dade8da70a142d4d5d0ba991a2eaf0372998f3b110ec450f9e6422e291
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3af6b48fade70cb47832f0cebefa7857dc20b7ac805f71b641dc8b5314c5dd38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b429b9d7c686c11b5d8a301da753792a5d748a732da363fef65ce33d2c4e9544
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fec75373f0038b4d1e1a2d15bfada15e27d6885751014bb6ff57a8c6cfe2e382
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3ea23b0ec27aaa8922a21ffec35af80a98508e8ce1f3171b5889c7815a5c515
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce105758d0b47ee9428f47f18d3ef356730c356c2ae93cd46525e4858f445288
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd3cefa9dd2114ef52920932b9edb4e2a38ffd5b6bdce52fba56b4eabd6191ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88861bf58cdeeca98ba917c0bb86dba0be8c30e550d36c4bfea7ce0429583f28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 967ea339d90d41cd366bd1ec46e12cc972911c73dc2bf8749f361127b9c8b3f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b6cf228db17f10b050a366f90e459971abc28d969ca13d72d14f182da8e6584
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f28177dfa4b05b2883ab1d1ae019a08923cfaa1509d2abb33f7b0c75f7cc2c71
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59c863ac82d6c8cc610f78661b53a701286a8324309c529ad4d41136ded85570
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6db45817b1c3d4bd35a6d3167e7cf9664d6f4ecf91bb28c0e53dbcbc01d5948
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a30014563878c1b8da1e4fca62a7e20d41c4269394ad09a06d4a4587825f2c14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de06afcddf7ab4e16ccc10b808b0722823d6fd9c6620bd8808b81ba98e534513
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f74120e3c286d92a6227cb10d297014e254d1de189cefccf19ecf7511b32a33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0b7c6030f27ef9ad646f5bce18136399e3bb3630da6075696b127219fd4d9ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f914da84a822b65e851d059e14b43946126b300d806724ed34658fb42b098631
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87397e10c7df23effaa676a4f73ddb2c28423b41a4c1fd08bac7570e7bd30160
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af4fb8bda8baa1da568c08ef8782a5bb46fe5bba95abe3d782c55e1e412b1f9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 037febb21df2c1c2692d1d8cf0d8790bc5794b90f6989bf7380873dd711c7f81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7dc0c838a4184fa9bbc6f2f495e257ba23092bb3fde735a8d94746f1c0d2f9ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d088ad5e7b275772456765ed669edbb6f3fa0030973fa9c305849ef84dedf751
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 300f3254452d6b6cad9f06c1460e8e2d31b63109008891332afae7b09086f58e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 416ce214f036e798ee07bc80a0c564692d8a797f5896c3684a57c143df848f1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64f32b5a95609aecfb5523dd029db979bc5b8212999f7cc127d912814cc22758
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bab2f4d2c10b50f3fe361e715f7773cc2c5ce234da53128d802336fa51043b4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42e4226a6abd939dfe7f149199c1e2b843d52e06e3226cfe6b09b0e5763891c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 181fa431f20143bcf4965bc41b18834a278e6b1ec60c279c5d8e7ab0974dba99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16955e095daaf23f43b74da4946894599f7c860ec626c05cae26f62b28c16c2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b217ec568e20dad0d6db1a670fcd1e3907155541ed4bba3c75b73a76a2a9ddf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d235b07fffbd280fe991bbc631ecc3ff3cff11e8400dec5e5bb6a8e63fc05d31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba89dd609a99c8b19f70d79af1fae06e13c6b1b9e653c32855f8d304afb40361
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7c3c91730580b9d643eef255103899ecd8861c19e367bdde42d99a21e2f76dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 163c07e22290199b6cd2eaf657d071bed182424ddb49b768efb8434e3b2aab78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c832b43dce0806c55ae7b84311487b2abbaf779e01ceaec983ee56f6e493160
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1e1413991760b09f860fcfbe03bb809a91b955b3db00ef99588beeb5781da5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 622ff0da88d92f35705fcc89879d7f6a38648921ad96230cc84f76c0f0b0bdfd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20bd1dee32b8cee81eb64800e75558fd10e0ff837c01324da6944ecc96dcef6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29f992412213f73d7411b47c3c2f00e6164d1219748bf455620e846380bfef47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 336d0f589a167ff708fd4dc94c02d4225b56969aee6c415b9b5bc0052cc77ba6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb8ec8431406319d2bd273a9d67beadebc1463bd0fb80e8d1f3b8a5867695e91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a73bbe4fea0798e8c2d601a914d1f50b60a0bcf4df8cc777458aa8c7b24db03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 475a4815a26dad3ae00d485a8014dda1be5a248a2456d96f1d67c097563594f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81275eafd47dc4342bcd9db12475cefc53b1a4b9e9bc67ea54e77b7644820786
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e7259a0e3263c7915e21f03781cba1af4501b9798121ac8692448279baa0ff4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1be34270b09708ca4850c29c9854cba27cacc99c4aebb4330444b236f02129de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1710c37cf6b4022aa4e68ee8e89fa5f1c849b7e3168d157c7c56c4ef3becbb2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46c339c6fdb02865124ffcedd7cab6e476b9119e1c00a077214c3879599e6452
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c55642586159ed203b83b1ecc097445114bb387dda8f45df3b47c1316662fda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 902213d277454ff118beaf4996bcaa63d4bcc3c5e062bb9faeaa53edbe5dc93a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74cdb89c7b7fd0ea50916857f47aec11dfef0c2f7c6b278bf87df2e18fdefda1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3030b65ec42821a9806fe1da1a9a6e0dfbdf40a1e765d1dfc25f685c14ed0694
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 691b8e6ff7fe29afe439a70892e2ce8fc5d5eef1027b7c00d8e8659a3695c8aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b39137c13ccb7004d7f1af9bbea462db2fc87e3cc0ee53ce47eb213ec70a283
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb7925b8fd3a21c751e12b99596d98e5a9f7e7ab96a9cd32f8b767cdca835f40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05e79f83e4bb72a475b3f98b84e139cc26c0d7f46ebee90b03cbfc1f45d50a15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f039103da2f154a1750b9ac7a367e92ff53712424331ee5bf36b090e81053ca3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34368047dc0f762f550951669d6171727ddcc3e43bfdf3e14bd8e37c726d12b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b02020329c8de123c23314c7f5fa0930c6ab3450922f9a87982e57465ff2075
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35939343c1a265c219742f1c52b5da16a046c1ee63aae1ccd1c30a9fdaf75afe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fcceb1c89a0a922deff4f975251253f1e6d0e17e051faadfe794128bc194ccd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27f480c996fe492c66bca5c76cb26e59a9b7c6ec0201ebd1a49da1362bfaa063
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d017781c5d7b7ce1e934611977c9be916068408ccac32d5b655de0312c79e7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a77c7e02ce89169fff977e4d81603174ea477ea0b6e5d160137882dc6fb3a26c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59678503a7358ba9eb3a73171fe01a487353ca4b3e1d0810a5d6671782ae7983
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d5d4302f3e2ba639e00f6428d230fb2bdf01404d846e54d822805c49239a913
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4422a675f2f8f041b2a578cd72e65f7e52dbc0c33be2fd6ae45262b6801b8821
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6be699f562cfa967c40aa55387a592e2bc48815fdcff1b4ca81f55a1851ccf3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2246ef38cb6d0c3819fdacdd2f8769bf7ae0c8db60d43084e8009e2680ff8b3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebd14a292364f1f45ab55273b17312bfc0a4fccfee628b4ff879aba5bcdc0bda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e17c1a9512c71756db9e8fd08795b2eb7b1bb594f902b25e632a2f5ac5b533c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0804744bc2a03a0c48bccab37a55892572440da1f4b3b854fac618db7b4e70e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e617a2bb0a5ee0872fcd2ea9164be011494e5a026912e33fa0f98f31c35ac67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ba600c40e3e225bc5d01cf60fd82421698d091742d73a880c988ee6865a4d82
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e791bbf5019c9f068748b8a47c6a3cb234ae5953d7d36dd8ae9f4b4a48ca979b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 307c70e80a54945beb7223c437dea6a41889e0fff2473b6ced4b21870f7d2f13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63f41ba2ad977ff1c1446ecaf39ea492349b26339ca5b0f84399809d0cea1d8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cb1a2b7d84e16f0eaff671a47dda1e14d20e2e6cc7f703c33c032e8453e6f16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6127ff2235c10fd38ab7a1affecb7e13ecadcae1414920ff0e262853dd74fb41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e838f64a4ac1a0775376dfe4806d0e6248d3f27855b0eec5d4e7c37c0c372b65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e65c7b42a85bc92dac424e44efeb9887c53380916322597b0019a7380ab6892b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d908b136e7e1696472aaf2230bcfcb0ba433abc8ee0bc0f1598761c6f02d8467
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d917dccef7c3b49ae21ce24faf82793d3f08199be21063be2671bc213324f1f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e38068301fb9c43a54de0e0d19fe3b49c8feb10942e24c84f0b07ee9201fd31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7bca40449c54dacbad578570e0b7d366882c61cfd92d8a5719a09ff2ab2aae8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e5e4f5aaf6a8862c6bde8a7252bf9c5e1adbe2badf601e3cc61dc538fe76276
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 303bc933b295fa88963c70c808677edd64de491068b9ad37c61a146bfeefe765
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0f9827e53d06c703c253ba5a2000531ee813fd89ca4d33891457841c99ab6c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b188ba2aaf2bf90c97576ecb7fee9303902e811235af8d3fa0ec655f654cacbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a32e2a4e39c5d427f1af2fee06de14500cae6d1dd86b29ff3b40e3941703fb11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 faef6c6236dc575d1144d0a5c7658a7f0ab9626046cb5eb8a8451ff5eb92c22c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 278256008d3797b4b97b452874807edbdaf64fe6d5586954d7cb4435780dc344
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fbb822b79d15f13555a3cc0649b66fb4420c120133739f61ee2f87f765c49545
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab155195d07bd0b7858c8ff49a9d20c5111b7598f850578942b49215f9e89e2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8b0b65b3e718ff0dd659a23f556d975e6fea3d7f5be82e90f15ec5f1b246520
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ededa902cd19a30cc13bb796c91d898553b085fad33f2c2d33b6b37cf253c87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f5b7e2ada864a308eb642fd8f3c84a63d7105e1ade1431970ece727554a0a48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18745f09ac01cdbd419fcfbeba9b27caa89c7d88b6f85966b404a8a9ff41252f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54944e9ecdfb9defa1910d4020e3ddef589364a72c57628dd2a5af8ca4ba55f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 687192d71ecdf7a67ffacf3b66c8a72e60388945e79ec6b12d0b3abd2156fda8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df3c6c96f7e3e5a286e6fd88b9ec31b7163baffd17feb904b3423af732824d75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4246b61dbce322ce1f02f772c01501f7e96ea843d47dd1a9ceb7e3ea779777a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4444a65cf14388a567eb63f434354abad4b17a700381637741eee9c60728451
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a2cd100d7dd8274048eaa6faccf8e8c62dd3127890c360ed81620b696fe1ed7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35e2d54083a4c07c24431c549f501462c3f9fba0c85b79359c59578f17e9d10a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a36cb7bf58cd96ab63c2d2dead0a35a133921d2fb328539d4a13102b21518286
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85c7808015c27c19e03fd89e7454fcc962707589dbf32deeba5b926dc3d653c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d01ac8ebfd6c5fcaf03ffef01b7a42cfe3878c8266a94a7ff2437d1435c1741f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a74506df6d9d907652822a4da7d459b6e88218083f5c971ccbafbe045d31203
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a0059b7e6666766f92282c939baf50e58f120a8ffdd8958782e4af152d32354
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5faa88a0fd110799d109fe78db4e793130edb3f36d217d6c8aaf22f0e6f99b55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 039f92e2e392ba3207837d24ef2a8997f9731ff7a4c38e0a7a478911605d3451
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e39c3edf8eb145066604b7b9ef75dafb1539e6b9d0295e807456e5cc142e7a8e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0226e93f969a268ab673f97f40589c7359ba1905226add686aa2642080703401
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93101193e2482026afc3efe04d46d625ad256faccc9dab9a6905d1d09ec0058c
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 638KB
            • SHA256 c0c327a567f6744eae353775cb6da9370165e497637ba2ea2d08244f64e1255f
            • MD5 SHA1 SHA512 SSDEEP

            memory/1100-109-0x0000000000400000-0x00000000004DA000-memory.dmp

            memory/1100-102-0x0000000000400000-0x00000000004DA000-memory.dmp

            memory/2960-14-0x00000000000E0000-0x00000000000E1000-memory.dmp

            memory/2960-945-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2960-77-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2960-17-0x0000000000400000-0x00000000004DA000-memory.dmp

            memory/2960-15-0x0000000000160000-0x0000000000161000-memory.dmp

            memory/3292-3-0x0000000000400000-0x00000000004DA000-memory.dmp

            memory/3292-0-0x0000000000400000-0x00000000004DA000-memory.dmp

            memory/3608-10-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3608-2-0x0000000000400000-0x0000000000459000-memory.dmp

            memory/3608-4-0x0000000000400000-0x0000000000459000-memory.dmp

            memory/3608-5-0x0000000000400000-0x0000000000459000-memory.dmp

            memory/3608-71-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3608-78-0x0000000000400000-0x0000000000459000-memory.dmp

            memory/3608-6-0x0000000000400000-0x0000000000459000-memory.dmp

            memory/4460-110-0x0000000000400000-0x0000000000459000-memory.dmp

            memory/4460-112-0x0000000000400000-0x0000000000459000-memory.dmp