Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/02/2024, 04:45

General

  • Target
    a83f9f45fe65d6337b91af328c76b656.exe
  • Size 768KB
  • Sample240227-fdshxsha2s
  • SHA256 14542582c132729efd28162f5db9e77a4b732b3002f9a339cd87498ee2d0b760
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3444
      • C:\Users\Admin\AppData\Local\Temp\a83f9f45fe65d6337b91af328c76b656.exe
        "C:\Users\Admin\AppData\Local\Temp\a83f9f45fe65d6337b91af328c76b656.exe"
        2⤵
        • Adds policy Run key to start application
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2852
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Modifies Installed Components in the registry
          PID:384
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Deletes itself
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:668
          • C:\Windows\SysWOW64\install\server.exe
            "C:\Windows\system32\install\server.exe"
            4⤵
            • Executes dropped EXE
            PID:4132
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 564
              5⤵
              • Program crash
              PID:4832
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4132 -ip 4132
      1⤵
        PID:3300

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 b93f96b56c0d4dc2455265cf49518e3eae72b0af3b3fbf8c8dc5bc64bdc4e4a2
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 314KB
            • SHA256 aaa466bc19cc3b9baa00a6404183b0859ca8ccd185e354eb6d5183d65033e387
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f8f58daeeb14c25d5e5b55758156bcc9f661a78c2d0610f2a1f80cf363afef9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4cab3f3ac5e8e3114904d726e77e4126c38ade0be932be5a98526466aaacf2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c34d3f710205849a6eea4f8b1473e73bbb663d8fd55fd91782d190e26c42e078
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70026a56017df396beaa51a3828d7f404a02841219894da28ed73e9b06c085ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 155205b1e00631f60bbee65907cc33b5b001b65556d430fbacc9f59708ebdb33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e76c7b3d33348a3e861538d959ecb1c26b2b62f50086cf6544f23f662558ff1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37f1945a74e86fa3bce0e83acda7a351c2dc6dd2567fe625f05508c7a2f01319
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fec39d0c901c428516b78bba4b0a787cab8b808fa0276d8aafe45abe792e452a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c24a057269ab2f323beaad41ea930bd603161d3431f46cb5a0fa3589a87a6d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4808dd1fa25fd90907cfc816b8a3de6b57cf4d4fa62e09edb7b637bc4728ce1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 296bfaeecaa9818c4febc31a0156931cf3755634a105209f4053d003b67878e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0c730a06402ebc28f23d7d60e5616267add78aefe6cbf054f54825ebc5d9b4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8407b35e57a1b50aee1636763140f38c867ff5af1070c978e2393b0d343c3ea5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0fce85efd4bd210a1214fcb6703e00b88dce5734f5a05002261ee27dcdd2863
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14edc7b0995f19edfeca0e65a7bf453f174858bde8beaad9f3bfab7adf63c58f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90ed4a8d4abaa5c5758ae703997c07b5473e6990edb6a2959cec6a11879eafa3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d11e6b797ad0bd92f457fbe1a23a56a6b4d47bddb30711aca6cfcbd7a73bda4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f006c799fbbfdeedbe360a0aa12e54b1f3c1411cf5820916fefe15807d46af2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70f8396b42caafe543b2b4186e26b52cc24b801005b83e04cd6a6f1867abe4b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34b43772d554f57c36d644e023dd2d7461b8cd0d3efed23087354442fb8227fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b95e483b44e67aaf4c31b2c5565b82ce6797fdf7d3265dd5c9d5d50b5c7b671
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b4c2fc09f707ab8253bb3ecd365efa6f35f5fca59790988e25e9e8ea17a0323
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11137f80e1becb42e7f4af44c70cf4a6b31c5acebe68a9c56e0042ac74cac7da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec04059251f36d53705049fa406b02e374dfd51213409845789b1fead75752a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 545cd0562e8b6d6d49eea007f7af4f4c192ba2689d6663b6fbabf268985abb98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c588860774a0be6617d0fe20ae188523db0d5008f7bb354d090f8abac2da914
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb5e67cf37e854ee75a4e867f3ba999730bfc3f2b6ec4211687a201a2e0a8a11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0228442438e8a40ed3690c17ce6ff56335fd64a8b302fb47f23804845c56728
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a405c802d5265e84341c202d9379510a29059fc8d67faaf850d8a044b4235385
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0869aac96d0aa71e703fcc37534fb7ff67447c448db485450e5a5c1ad5da531c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 194f4ea7fbfe42b24a0395e39c3c8f9d95d6c9ad763cd63e9f27c1ff7e3123de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d1ef349761d20805e0b13bec06feaf025a3dca8cad18e9807ef5d30c6219343
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e641ffa03625b3361ecdf934d363e5632aba25febb345fe5c9f1c42de3117c92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 087c02856dc28f300be9ccc497c2f97a1f9f36779f1211c5f723eb4bc6893399
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c15a43cf7b2366c6af3c722bff677b23307c5f08848e8ae6d5fa422238b1bc86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc914031c373796b114f22cdbd022f678606e12046c2787a0d6fb5fe3080731f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e744d37a67faef78cd2135e45f14c536449c01c12b3091ba6d6c0a307317130e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9868955666ddfe693cac83d83ac44b9f820e51a8054d582b6fe967a6ad3e943c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bac224c732407dcd1887cf7cc8896c13b06708745b3307658401281537a4f48e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd8f3a70eeb5b8bd9bd91bc85d664e4577ae55b06a5643e7731349f49bf79893
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d2ad8332f3bafe3ea064b9215a766ff23368aebc43cedda805dbaa20ca50a9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57faabf2085cdde9defdcc0b45aa80787cff4ffe9ac91acd45eddfced5faa4b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce9ae44624ca4f0455c66b5e39fd595ff87e1b9d5facfc2441b8916989778aaf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9e14376879e42aa488e08391684c673d62aba1b495426e8cd3d3e1de660d546
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4516bfd390a09acb386912b7aafd9cf0e43cf5cba6cc107df6f50dab70e00b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cccf7c234d8334591c6e9e2752ab06806aaa7d5d698d54b62ddaf347e47fbcf3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 019d5536186b6b493fc7776107c38cfa5cc76c72df3a2f2b6b28a57f804cb6d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0992082568b687b47ee0a1da11c36fe6656df7f39268183fc76b659c6e8febd7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8629a859c4c2f0a8c2d56e247bc3ab5dc25d8935ce34819d79189568cb54e1a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a06b179227031dba28c1d3b9d6870c6e73d5e73b3ba8ad8934992d12c5123af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c568cf0c3ba0ec3c130dacff7886e3ea81489b09ffecf6bf3dcbb08716e58bbc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 893f6b6d2aa98f64520129ca868ceb969958253a348015fa7ccdbd25e2f742d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d37752ec51413c2568b7d40551b78a07849bdc134927d1ef58b16d3cfdcfa338
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 902c3f9abc9061379aec2d24a806c18e2107419511911ef8d9ff664aac7d4542
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0be0f6e837081257be40665a2927fbe848252411fdcffb0c931b28ec7a513fe1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed5704cf90dab6d97efd7c4f4205cab3218fddfed59e5cb392888b16455c37f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e53d859042096cfaf91684d65baf9f65ccac45e75ef83d872df1178fde9e96b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ac13161bec003705e9c1cc7b04b2af559b7d626883760a1b1db625c8502ab5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c12eed7e64eff1fcd9e65bc9d92d6976034e09be0f0b636ffc2dc8f78a950598
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab09b3711f588da062ccb5d55b615af062f3696dfa6fe4c5853ff852594ed001
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58042398065384f8384d2ee93ab7ff107f316120838c5944b45b14898f9cc8c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 480fb0505e4e850d8e48f52a58d4b45ac0c87f58cfba8653f70b555a645babd6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19cbbfe2e900f608e4a50957814cf1d8e487c5fa3b9fcf7c9a51fad47646cf9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b6905f393cd6754858dedc94a7a63f301695cf3e576d2f7ce720f7e458668f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7277c75801cd366f0100abbdb4a91242c2560957812bac410857bdb37ca793e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0895e5dff6ad4a6434a62841f04db2497558cee4f2f1060c965507067b83ff60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dee598f14d9e194ba49f454ccc091ff1b9bc49c310852e6452ac00e5f9234d78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 106937ecc0439ddb91477267fc0a7abd188e950f919ca757c3d7ee8364100016
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a93db5639d89bdc18c920a6292f20abd6d3e87952ad9e1421c9ded8a65389b34
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc037ffd1175cb50fdd07fcc7a8203bfcd1189521d485a1a4009c11691a3a75d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40c0b5f43a5a7e02ac0cb772a8199bad3db471ec6c64b90e1f5f29024eca3f56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7c0fdc7c281e6c9c6af672540d22d8296876ed267ae26585f16dcded7c2617a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72608bd2103bd0563b3283113bb51cec7ef765e2e8b4aba463df3d893e5bde41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d368435f579f465903ad6a4df7bc3f49397280d9a97231e30820d4c210c61cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66e4439ce926dd8edb82ada2934b8eef9089808d7b8523e068c8ccfb949286aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6899d90a8462c51a7399bf6eca95828c168cea2db8d3183469c62d8c114e3db8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5289a79b6565081e1e244f2818a3eaf9e49b955c1e396a5217b45fd855ff45f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c3527b7b571b75ba4ed78eb4ad538b958f9919237653a832a93a35d6100f2c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21b1e0ce58669a9e65e56d9c704cf0113b29cec67feca2f85ece5e185f292464
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a94d1efeece448a2c2e0de197685a183b75c74f42b6c38efaac90bd09ccabe72
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b9ac2ca98c47cd69d7248792738ca601494445532b276c7a1cb127b178287cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5759c08928dac31098345821f1788dda070da5218bc48c0bc7343394c459ade6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91dfe619efae1d0d9018f5eb1da58fb3550021117437915a17a8a15d06824b22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 503bb99ea03ac327dd829698b235f26c27d9d7500a1c2660c4c9bed4f88f7218
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b31b5fd7d2ab39c00a96a3bcbb738c47ab875ab6c0ed29a730f19933726d9151
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a864e184208d50043b97ae446becb1d5266b617e3694032f28ddf69dfd3b7fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a66ff8fa11a1c185841b727a633574cefcc884ca8b4aabb6c9a02f960851441
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f1b2ef71dc92a4f5b1220c3b8dea01a99d91f239a7353992728dc29dc49dc54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 374a60d4b0158a511b5606f3effd096b736469072c14b3043d3565a178cefaae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f76c8d4fcea6d5af3866ef7c5a32072fe03cfda8672ed052adb7f600ca161f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d2d6a060bcd097dc29d2ff566c3798531243a6974cc8a31ed3336055f79b70f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c100a57af1ec0692397d72ce1e11af2b36522aebeca3bb67b56f55199ee76fad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31a2373dcba61f37baadff15e092786dc4f5c2503bf55800e4b6d04760b59c38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2438a139b2be0135e5e838383b6586cc7d5ef87176f03c92588cfb0b6df9b405
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2489cb9e897786e5622ee0216ff590d306449ac72fd9837436a20dc5c261919
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b36945a4653fda8323fa4202436e2bbd217ffd14f316985560003a46f2c3a118
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b17aa36c1363243012c04dcffc3ed2ec15203c1613a20312adbb4c9caf19169e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f5595731ef68e5d0b35074bbd9fcc8f3f07f1d3b693b44038bd7db912ce9f53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ef13d86e08b423356abc5d1a9b0d05a7e3f0054fc0c88d9e70e8eb525810f18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 435a4065f61755ae627696fb8427b96d08a78d39673b445da236f3060d52a60a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 845ccfa1d76ca4f6157eb8f9a3f4910b2cb42de0a1b0b756f076eb047424c72d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d953050329e9730df2954211150876576b6e9175ebbf9dff5ff3032479a02f21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6dbe95efe8bbeceb2d03b9cd5e96f6ec6acf8d272fa3c213f9fc26df6d9de999
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b838e5a0ab9294189e79e44b9dd13b214af09d1ed16e7ed000e0d06eb1b5375d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25a0d581390c1ae20f34793e4e23d247464029c456bd261b9df3494a748fe51a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63f3455e97285f0ade849a09ffa601ded7721371854e5e09cd00e96e1409daa7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e59953e0446e13b7209bea931f05c52b9a7c101c5e5c5bbaa08efede856e6c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 217ec7abc365b1e9a08f03472f5cba7c61821a8626d0de18123e25f94a27f6ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54f70ae6fdcbfac2e414e9338d21b60ee9636bb1bd1f47d1950f128df950b6a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7259a0c237dd384bf9fb12ac2bc995833a39db474bb419cb189ee4521102a3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b81e052a73a919e13df44d575b8229494cb8fe191fffd4f17a9ef97493bae12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0c8554f2edd89c67414a3787653939cde43ae6ed9052b826c48c947906a3762
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc3e1126fa6b49b2dacb4aeaf628b86b7b2e34a51fba58e486d738f68c3ba114
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4bb3d4ac32f0bb274ac78b488ac7eafdad35b88fa880fbdba8b5135821a4b32b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f36a437e4141ecdf8ef2c5527aeb455f51932ec0f2618eedca77052b453495e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3253ae42b6cfedfb2e91dd10e6b821f1df8e5834064ef4f23b3143bdf4c1961d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d2782d0cf543c7e04abce2cd4ef58d345e9bebcafcd105e6e3d5d224ad4e210
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea0c5dd0b0fb0ca3fc52648fa04c26e62ce23c72de68d96d3670f47fcd035fe5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d90582af28876fbd9bc4cd6cea800d3d392026d6a402b2d3c801fc4303e6f171
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4420668fa96c9354f41cd2c6ff6740eea5076ae3fdedd4b6437002c2a0f311a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12a5a8028917483b952e2862c06cecb6dee871c1e062d9365a464acd30ab5015
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f6c90e1c08542bba1e83b53f8681b4514e906f692004c837f09e688d716a9b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd80bb3a1427dab29ffbe5aae7d8783b52cce03d536a8f9c37a0e31e9ca6f1bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cf7fbe0ce43597879817b39b2d334515b2bf375d3a3dc9b800ed1fb537904ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b81ada1f46538da48b1989fee0a898161cbd413d38f5585b0baaca3b725a232
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 907b2839cb20b51df994dfe0f209ddd1adddc867a0d8a6a6fa49d4db7934cb29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aba5696138a23e718cc7177ed0f7e36f9e9b76af157299b1d89ce14a9a306312
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c48838badb2ee6fee41c5c6a8277f488476746a2c63f22ccbeeafb3c179a90ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5115e65024ff0f225531f06d38b37866a22af6fc4f7d4087636410f959988de2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7fd59daa0f636e9da62837f2350f42df8c9799ef9835ec0a8b0abe5bef8e588
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6db749ae3a75fd103bf434d4e0c58678c4433d0e998f7aa529a97ba342d917b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eea69f7d4140c432f465f094eb7a050efc5b8460d095830425a87e4409397c89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a26d2542ab7d62ea3d168b8083eda0ea1f6d581153c405ef239d5df865e558b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a5c21f601dfd108d82c28d17a45ffd3b8b76e8c3d4a1a07f8ebeb6c79939a0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05c8b0a02473f56b122b6e1549754b99c46cb097c92489ed13c29f90ee9ba518
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 601d0881ae3dc3b9c2b827c9cad2e207d80f3dc5a2a7249a78c10166c32d93f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4feff1079f863dd90d8cd144830afa120df6f426825ca295f57e1ee1e7cf1eaa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bb68015cde60fac85826c7561233d5654af37ac5240ceee1a882b817177e96a
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 768KB
            • SHA256 14542582c132729efd28162f5db9e77a4b732b3002f9a339cd87498ee2d0b760
            • MD5 SHA1 SHA512 SSDEEP

            memory/384-68-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/384-375-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/384-69-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/384-67-0x0000000003710000-0x0000000003711000-memory.dmp

            memory/384-9-0x0000000000C20000-0x0000000000C21000-memory.dmp

            memory/384-8-0x0000000000960000-0x0000000000961000-memory.dmp

            memory/668-1280-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/668-135-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/2852-136-0x0000000000400000-0x0000000000579000-memory.dmp

            memory/2852-0-0x0000000000400000-0x0000000000579000-memory.dmp

            memory/2852-64-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2852-4-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4132-162-0x0000000000400000-0x0000000000579000-memory.dmp