Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/02/2024, 03:00

General

  • Target
    a5441f567cfba8349258212698dc2d1b.exe
  • Size 397KB
  • Sample240226-dg962abb39
  • SHA256 09ca55f507019724e77ae590fda300ca16588783850b6a55ec124aa16ae24447
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • tunisie.no-ip.info:3360

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3432
      • C:\Users\Admin\AppData\Local\Temp\a5441f567cfba8349258212698dc2d1b.exe
        "C:\Users\Admin\AppData\Local\Temp\a5441f567cfba8349258212698dc2d1b.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3184
        • C:\Users\Admin\AppData\Local\Temp\a5441f567cfba8349258212698dc2d1b.exe
          "C:\Users\Admin\AppData\Local\Temp\a5441f567cfba8349258212698dc2d1b.exe"
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1476
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:5064
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:3268
            • C:\Users\Admin\AppData\Local\Temp\a5441f567cfba8349258212698dc2d1b.exe
              "C:\Users\Admin\AppData\Local\Temp\a5441f567cfba8349258212698dc2d1b.exe"
              4⤵
              • Checks computer location settings
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:3260
              • C:\dir\install\install\server.exe
                "C:\dir\install\install\server.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:1096
                • C:\dir\install\install\server.exe
                  "C:\dir\install\install\server.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:1696
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 528
                    7⤵
                    • Program crash
                    PID:4368
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1696 -ip 1696
        1⤵
          PID:3952

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 eeeda6419879616e3b83b224b708330f5e3d0c2436bd874d0d2c39c714190bf3
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 fd162824c8134978bb98c83803e66bf934eff1957f457d9da28123f7758346dd
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee69e5df1d9e86a72c9f4ea601acc69c287ea742ec79811f6fed5ac4958c8760
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb182d339dde377d19fe5ee27149961caf972b4480ea681f0a26273f520bb06d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ec47cd4efe481fb545b2ab71c1ddacaad4dc531c3290f2fa25413eb737b3e3c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94ff4f0ec1f4c61789caa83e1789df3d0297afae104929f7c15f054c9d9b815f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 932cf8a8c9060a98c55caf29f2d3dff263c2dfff016514dfdfd8a03d2c1173f4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ecba9b57b6e398fde871a027bfc6e540944f629293ccfe809451122925155a1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78fcda228f88967151ab13ed5c3d1402c77777a36f342b8edb896fc9ab8e2278
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb1b49a0fcb9cae5f083b2e245ddfe358bcb672b8aee96cef068005fa3ff3da5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69cd11d71f5b1995393afc88f28a0112ecc5bc6bffa4148d63bbd323a621cad7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f43986b41c148f4d7b92d1fa95b91dea12b250db735ae094cb63a7d459d34541
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 353eeeb349e8546a86177f18fc0b9e93f17e11bbd8327a3967f3a5a1839dd802
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d064831c740c81f4c323d79d80a29f19ddd04b062c17b71a78e507eef11c93a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ab987dbccb3b3972329b05655df3d138c964d4fd37b70fbb1aa2fb36885475e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 422f59fa39a13c3397b2182590e0fdb3ee02248b9244c2ce92371358858b2fc3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16081979e981b6a04d740a793de7f526b31adb0507cbc3168661514091635755
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 00b1392083117c3c7aedbd4db587199d230f807f6d512de834fbfaf3fe9b1973
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59fd52dc6510fc810a39ee6d4562ccfae3d6d9eb6b15ac5a3fe61d0c7495f947
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 96007c99638ab68cc6f05fb9ecec06d47c0e2b9730f09211341e195b813857e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5220345edd0adbf81e47d7311c864e9b3b59516b7226455f81b5113573f077c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b54961de445e211a86275314a02399c9245df5aaf67340bea0b334a27d4a93d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38c6ef443a7499111fa62a53fc77c434c4f9c2ea96a23ef28db3435245c84306
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7f261d7713060d50b47e0a4e307bf810972e3cd58cb5edbc8c3065aff710661
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 191101a9e76ab702bf25d068c6f4ead6124a05b28824d19dd4b1fafbdcd66fb2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea7b471e4a66e657364aeddcd595921babfdb1a34cad18839be7fd519c68b718
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f0bdb79acbbaf31bca887b7ef95c38582dd66b0c70073aa7c86962d4f01eae6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e94df610526234225156481746c94351e3ee757ee8a4a37df28d003e32ab84e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a63830c2bea2a9e82887e88961c93d67c5529a8b5451c5b7b5064c2c0e61fe4e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b40416750987430ca3d72279329eb9791896417d89a8b3aa4fda35852d4d7232
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f29a764243900ab867c76bb49e4ce24824ce63892bbb6fe32535ffa6a4f1d664
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0bd80ad168db616ffc1cff4f7e0dc6b7c6e11362187e8ac1ee94d1c5462cab29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46693773e4213b218d501ca3288fdc75a4a4550c40c7cc85019d4c2e7fd660cf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2daf8b369ba94ee5549daac51f7d5a951447db55a0f8396d295f7ca1292895a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7d78469e416f6a9f992bba8cb54ee09b438a07d2fcfc0a796fd17118b2f2dff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1425e64f824863a1c6ae8d6f4cbe33d64f7b3d90381604e3b051221576b44c78
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b13fe2bbede0262c77db7f75d58efd40f92ad33287f9121c12143a7d51b7e5d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 49f97ae8cee5cc5056d755f13097223eb406ce8e6a8deed52f62857f1138e6be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 690363e23e2147ac8e6d635f3c3e1148c24df0cacd9697014c9d8b0b0a73a0b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14ab9fad1da4d6754314700e6fb666e8b08d0affe4c1cbf875eb42f3bd985667
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d838536a675209351c7426c3c3f1e75448805f95a2f44f22fa39fcbd37fec453
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 798593a3b3a2956dd16c1aad965067ce1c490a57c61cc7edb5eac87b819cba25
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e2c08d1fe440066f87810e00385d4123665c3f02ce10e7ab95e09e1d555cd41a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5bae9aff8fdf6c1332580b3cb01447e2841d5f310601882834f7d13c78167b2c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c5c891ecd4f08e50651473ebbf4a69c3f3e6b5f4717870db04b77d0181a9acc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f352be2af45b384e1a65180dba13055a162b2c847d8e0d88086ebcc3178181d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d1e7b90dd03575ea2ae9039cc2acc84f84ac186177fc2b3123e0f359ba68edd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cca181c9291e4a48e8c05a5a4c4dae012a6aa7a2445bd3183b4eb74eb097ecb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5b3d5d9b846da50329066124608ef1863017a77c79272700e2a5d0c84d3cdd0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 227a8847f845889aec01cb0a2946af14bc1a546d57cff086eab2633a468c453f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ebf1023169a5ec2e456622982ae30788a9853645caf75795783c43a5787cab6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ae055bfe19525ae9eb6f5dfbecd76a2810130208f1e0480a5a2a499a044024f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe556a1b324bc01eb91d70f6c54bfef590e5af539e15c30e46b93ba4ae95ed95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9e9935b721fdbb42971f208f741dc4a739b2cd9c3d59b840a9ddc7ecf8dbd11
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 09b74adaa5712632b6972468b351ab5d673f2888005496cf33497b962774dc91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56cfe2c3e8e8b280e6f077cb92f047dd7712be4fbe92624e0c1f63a0a78fd73d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be8f82d0c07fc76f6589e3f0956710c57b0ef66e41830fab2a5800fe1f2cf4bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 392238dae6b62afd2064cafb9bb3f6eeb826cca09f78f7cb2dccd283dd184d24
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 176a543a87e935cfa2b51c11391573fefd0aac421b21d72a8aa27e095c7474f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8550fb24ec1d188a0e7ec089b1902dca00d1933076e709dd29e2a2032c782dba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af8c6936617cf6be00b3a2e02f7caee68fb85b986825ab631cdeba79a9fa900c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9fe1b268c83b517e2daec2c0d106d7b10a65ca98a511bb4c682adbbd43ea7bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f78a283271ac0113047608eb971fff41f3ec3941f2af52ee7d570dac0fb07b8e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b9511df47d14dffc880312ffc1995d7d56644e358864373a803c988290bb5b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ad2c495f21ebe3a8c93f906b3006976bcfc4cb390aec86be2c86c9c621d5fb6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5774b80419c70ffe6facccce2c34e5793e465dd5a11e52a9d940efa1ece525e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 248749d936f76963cca09f7b25af81f6f0b6f91aef9ef29948dea775422a0284
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 519d823e537eef99aa23d366bdb2b808ef22c8ea6564ce9851971e4fb54e4191
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34ddf80a87c29ac9ce8c1474c5771b52b3813bd4e0e450ead49da33fc38b68a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a5940fc05812ffd940e670b1d21378048008603527c89d1e00e5331700dd4ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 847d94b564a4cd6ac681f8babfd6269a6dbbaf9067aeaadce1d236f4a96cbc27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe9a3da466db8b7a064695c71b664f42f94146b6699ccb7544605897c3b704ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 90da7a220c29512a1b550383736b74356af0c81c05781235f7c57d23b88db789
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a3b37fe3dc714c130fd335c0bb7ef298b9107b49c1840d521dc84e80b1bd1fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94a8d08e60473242ab25fb23829286bde26bd8cb60393c297276e473cae47bfa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5e3dc0f14e3744adfcf497c1e4832baf86234d79dfb40f9ad30daf2bb5cb1ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f61b0e32da7fa7f1334862d363540d42488de7ceb18239cc6785dbf0d646150
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e0bd0e961c30c4f9aa527acf177b97e67942dd24460ba4e17e5bec8cd265cca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9dc57eeac8aab2e002ddef3a11fc7492d0df394b42ec8dd9d9dbe78dd41fb4d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8734e7b819850cc4c666fa329e45ea361b603c1cd664a85de24b0206da14bd5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20ef712cdec390cd2fa3cf6aeff9bd73a8d544c1c3c6dd16b8b44ebf91ae7a49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d3d613fb57117408836e011080851c1457f8ca7af692c78b7a26d6bac6f4bce6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1960adb29629da3fd8d251a54cd49592c6870c9c76bb6d8dd4dcd220105cdf9e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8573af85f6705d75ec7905e7577f3e638ddd14b5a912e5d69766afc04b6c5dbb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 80067fa514a7c85a5a4c6727b46543aa110e8fcfc94cf7eab989a0a06c30bbb6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28b763f50c7251785c4104c3146820028ef96c446c48840f13f34c5f73e94750
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3eabb20a92d7b767edacda91c86cdb1f54abc7f5e048c00ae4e5f5813c30bdfe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b3f9945b2106aa04d2954ef5470f6fd9b8cfd4ce99b587e07b1eadfaf0eba58b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83372e7699c5f5e6d2e39f9bb316ca4b75e88eed2a6849f08fe8db0b7c986667
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 289f493af5ce276d63b39807d518508a652e33f704c379e056e810805f74ab66
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b95af763fc348b3652a5bfa02d7724e44140d803ff6d688bcbce47bd3cc00aa7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14f44a0f3edacfa930a810c42f14287c5e3fda46b2b5eada3d7511fb97e808bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 540acdcac51b1ce2dede8d1fb3c32df7f75e6dd871cc08421abbaf0936910cdd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f7ebc8444dcfbb392dcb49836f75ed38c7bda24747e17d3cbd98776053f25ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc5c493b4041553b3df668854f7ad35a660530ed52f016815e3ebaadc0e80dfd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f73662268bef92ae00e4c7b6b061be30c5286c1c7c40227ab41812845e688ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 03174f0226f23ba17c5b0385e4378d2b8f4ad45f65d42f02fb2d12a58fe99feb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 644fde6c662024addcf109eade78cf7d153c32aa6a7bae4c112f5118c615061d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2400152200ac495aa19844a1b68dde214feaaaafdf250af85b3f9621ad40b926
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d328474a40b917019cd2c3f9a179e358fd8bf9346365fdaf338bb0319e969eb3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1807864ba7c078fe6f0f679f588bb283458b88e1b5d00a8e62f774a64a3cdb9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d03b8e31886b0872dabc8a162d17b6838e81d863e750fe4e11df54a12f65ab2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 660b8c152bc7a59b68baa5c0725fa9e322279367552ca14132847bc0e3f32255
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6623980c84d2b965233160a8409a31bfe59867fb2c474736baa0f80d08d97fc2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7329f8e50dcb019a0a467b70a9260a17e7b9a8383a378482d6aea7691f0d1751
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 871e6bafed0e0500c18f8b4cb74d8ffb045d5666d6071ba1505c680b23076140
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a97b0b634198e5a10ffacdde425df2b265dba8001d5c1100be47e1e4bfab2f47
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c8f45664eb1aa213c096554c82a2ff1ce069d2312d1e05e5a0bd14de19d9a745
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 243d63439b576f417998b559ba8f67b07e833a2fa3557155027f218465f7c51c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b3cded5163f89e3c7c38e5d056f4b6a1a88363e082e180e77f421bf0ea9d50f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc58bb4bef7ea1cfe6dac1a3f9fa9cb45a4ee91c525b59a9ea8bd0c29ed0da1b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3941d9855a733b732e422d1845f0a66b653e449cea9e7e34833fcbc9acf04701
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad4fe746c207e6c0baa49cd6790fdedaf19b66037f03dff20c8d710e26835b61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5604b4a8aaeceb8acc7d9e806ec94513e037b4c5ec419518893e359efe66e443
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 117a4d3aa6900c81f586835eb8b8f0f32d75d80569c3428c5fc7e440f17e27da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 941204f819fddab4ea34a30a96acb2a114344c4bb166c73556d46e947db02209
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c69733b089990ce8c523cb050a3dd32c3b63358e9da394d74e52d12ae9673465
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d02cd209b5cc2f6dcab2f7d50db5b1564d358c6f8eb2dd987bcd816913e0ca78
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d595b3c5de7c2ef97deac68a4cad178f3935d285fb089ccffbbfd6f7728ccef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f08145c0b2ab817622e4c744fe28e761a6bd485d0f644fe64d862a326e45d6ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a398ed80f40e601f2daa5515d8362c91be8ad74006440d3254e8a76a7aa246f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 810747a9c2a8e8f085c418dd495cf6b42537ae97eed7eb9355527cf82a026e95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e38b9ec7541ba2f45875ceb3b95de401e4a8d487260a3c4256b0eb48bd3c1c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aae49ccf6880db12f91347d7cdba53874500f1a0773ea587b49cd50fc6c5f328
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 64cf5298f19f918056c97d24384ac01f82269975bb7bc81afb4409b36523930c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd77abead32fb97eab82a8ae3083733f10b3f933293c73f173cb5ac0164001b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ce7eda4967f4fe2388c5371cd3104e33fdd5d61609642b7eda20825b45256ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7bd57fa6ed09aff8d199c6046876d62b6ded4ddeb2461de817e7c9afd0d4448
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5639fdf7ddd15ba3f81efb9406287f0965bbcc42d96f3669270798d9f669ef4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b724220ff01c81c4c9ce3d32d609cf3a0b89b22fdbbfdbef7578e9defc4d964
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 241cf41dc50d9c822876cb8e62183eb7f280d8365ac979a22dbe8a3407a19ed6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1cffd559a4425d95a9fadb047824903348b24e158bc489643862ad68e8feaa68
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7242aa538be88ae345450cd952b2a007268940be11c215cba337c50cd6f88ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ac6dac3791cf901f7d5e926354b00830076fc096b10f2226d1affbc6319934ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5cc6988afd54a198df55437f2505d55cd5554a1f2ce7e217ea13bd833891d549
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 410b7db12475d38fd722a824e4ffb766678718b9651949acd311c4f6a84ecbcf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20dee2b52b4fc4b0c3d76acd13b2edf83b131bee95b38c8b05da7b368a5e372b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 017e7a510c2ba2c47e5843deb404ac5605d4d9e24be19724a16b43e0bc004cb8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f1509dc376ba466d7ce341cbf26c0ada2c6022423bc09c80ca352be54b3f3585
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25444c64a8f01cd81d2cebd5e0a2c5784ec60f6ab0b63be3b8d34b24b904c728
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path \??\c:\dir\install\install\server.exe
              • Size 397KB
              • SHA256 09ca55f507019724e77ae590fda300ca16588783850b6a55ec124aa16ae24447
              • MD5 SHA1 SHA512 SSDEEP

              memory/1096-169-0x0000000072D10000-0x00000000732C1000-memory.dmp

              memory/1096-171-0x0000000072D10000-0x00000000732C1000-memory.dmp

              memory/1096-175-0x0000000072D10000-0x00000000732C1000-memory.dmp

              memory/1476-72-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1476-3-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/1476-7-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/1476-12-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1476-4-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/1476-146-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/1476-6-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/1696-178-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/1696-177-0x0000000000400000-0x0000000000450000-memory.dmp

              memory/3184-1-0x0000000074E60000-0x0000000075411000-memory.dmp

              memory/3184-2-0x0000000000990000-0x00000000009A0000-memory.dmp

              memory/3184-0-0x0000000074E60000-0x0000000075411000-memory.dmp

              memory/3184-8-0x0000000074E60000-0x0000000075411000-memory.dmp

              memory/3260-147-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3260-1128-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/5064-77-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/5064-17-0x0000000000B70000-0x0000000000B71000-memory.dmp

              memory/5064-16-0x0000000000670000-0x0000000000671000-memory.dmp

              memory/5064-209-0x0000000024080000-0x00000000240E2000-memory.dmp