Analysis

  • max time kernel
    150s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/02/2024, 08:16

General

  • Target
    ae1ab19362a1936a3d6a6f9a9177268f.exe
  • Size 331KB
  • Sample240229-j6cjysbe45
  • SHA256 d225591ecb086ea8fb188a1c155df7823e58b594178bb7e1f14e2df79817e510
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    Yeni görünümlü hesabýnýz en kýsa zamanda aktif olacaktýr.

  • message_box_title

    Facebook

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3428
      • C:\Users\Admin\AppData\Local\Temp\ae1ab19362a1936a3d6a6f9a9177268f.exe
        "C:\Users\Admin\AppData\Local\Temp\ae1ab19362a1936a3d6a6f9a9177268f.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1708
        • C:\Users\Admin\AppData\Local\Temp\ae1ab19362a1936a3d6a6f9a9177268f.exe
          "C:\Users\Admin\AppData\Local\Temp\ae1ab19362a1936a3d6a6f9a9177268f.exe"
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3300
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:2544
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Deletes itself
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:5072
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\system32\install\server.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:3128
              • C:\Windows\SysWOW64\install\server.exe
                "C:\Windows\SysWOW64\install\server.exe"
                6⤵
                • Executes dropped EXE
                PID:5032
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 572
                  7⤵
                  • Program crash
                  PID:1372
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5032 -ip 5032
      1⤵
        PID:4816

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 b84a6fee1f847a798921dd12f57a92c2486a0ce70552a62d3248145af8dd052c
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 05046adf4fecfe32c13b97605a562daa58e3654f69ed01531bfb33032bb011a2
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d8a41603882e418d6018764e74085947ceddbe50898fd1560370b040730de97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69219debb9e5a20b420adc2ed7dfd94a8ad908cbcfac44bbe9c24feb791dee16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a7c0c1549ea05d23389ff37d76e50abc11c125d21222e9c0c2a7c7a70a7b48b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f561077eb06a1ed8ee7c313303a83fe5cd6bddc5b25f9490b39fe36e2f77e4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98ac518bfec71dbfff1fb6a17da056fc61099e211c13aefb1067be27f428df4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6754ddae5e800563f8323f0ea4c808d0e458421e414959f4d4bdfff54795c5aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a47063938d463762c5b945864d592fea0ebdbfe633216a8b3aa0a29b9b6b813
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c571a864e2705f4ba59b99d16f79e1e005cfeb3de71eacfa0b82d3328d624b99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e2b7dc96b13c66a5e9bd227805be128ec3987c47f2396887843096c942adc30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8911d266646504b9086de39fffe876168f2bc346e3adfb48db1f07cba5bcff23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0585841358ef318c2b03840a58ea4da321e55eddeef6ba3cc7194990580b44aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ed8344c4ccc591cbcf433aaa35ee961e4657ae300c75be8648240042c5ad6fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1cc4ec895bcc7aee146cad20ad5cfd3fb3b03188e051519d2de09a5d0b60350
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42a96a7d3c5b88d034184746c6217aaa4ff864960ec2ccb295f76ab297b01a01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5480cb842a3f30afe6ba9db26d226213bf46f0a014d7def3ee63b30356616f62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f134062ade61172a57e47c1cafc148829eda5a79ebc26ccf1bd3d8a25cd36289
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2761dffc486d9704b23e985cad1d89689e38c0d92e98fa56c91d4aa4fb1da269
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c5546112c0c26dc31a027a835e920fcf980bc8b0159a9b3ccf369df7a4fee9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 611ab7b28db545b82415360fb0d178795f4f690da186f91fee0b6c72b4f8d3d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9eb6431f067e5a71078913663ec7035f0d52b3173ccf951f5a0e6b4e1819b11d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acca780435e95d7d530cf36d5d7bc52ab0f4772fc1809b4d7da92a8e67ad53f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a506acb9cb13866d3e1ea7da2b51bdf2f173e67edc3f678a45ba7ca0b23c0df8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a97bb5938d09716766df4305a840e8406bf1fef0ccface5f8b555444330e63eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1515f7f254bf37dc0a2cb219be9dc8aff3d955d82d68b6af419d57af534c0d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5326814d7419b9c7fe1de45005827247529f86882412257e72c55f6404f8c9d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5ecaa12ee48e88d447e0d190b9a52bca7c0404a973a8362ce78bfd04fac0f32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e14e97ba7d65286a966f97109c54a15c63783c88274f5fcbad3b7e682b5f8b7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d136f699103f852894654258f4624afbb5b4e02b103487b7ad49b75205de07ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9daee7f63d6ba272f4625ab0cd4203019808d71768a98437c3c3c31a643d3639
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28e14a7e6fca527a5f0554f7638cd1f84ca3640a428241f9d2920e17749ae440
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f8f9f167671eeede04c0539e9ceaa419e9b40e017144de6e8130038937141b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31a33a73ce3a19b745966e6e9963e001da6af28d45bffc740af2fb460d26884f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4af047db10dabb994894217e6b5282c55f9b0efa9a188b5e40ce77ed0a05be09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 697703bdcdc4617d4620eb5d46893995b45dfbadd4142630d3d0d69980a003e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ba0373bc8566efbb0db1d81220d74e2b22db3388cad2f6aa3caed3ff475c5f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3acbb9f2b0ceffd0a3a64eeada746080252b4886c3cb589a9b591697fc9dad54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b903a241bb21ca0088236d7468983c4297471fb51e1bf5408ce73096cb48d52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 203a83d0bbcb783ec9f4ceb1a51c1a95c5a3ce3095194df24b8581075197440c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a1dc3c2c882e55882146e2556d9b8d5d616e110924371232cf49c48dbc8f68f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dbc88e6a28a9e47edfbe186e999f3eb906603948203f126a9741bbb91a6233b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4cc5ee9207cb87c56b111785b3fe9b008698f4a18b1df331ed0bd8ddc48190c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f68c083b4e564902a19de24152fa1bba96441e824e12e99fa6d75c3cdd4f98f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ad3610adb67daf3397e23df07caa41ff037ffcf6049cd14db2d2300d05695bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0dbd4622d4cb659334772f6583996840573cad0e57b02bf08bc39beb2b32e132
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6aa6a5e60ee8af7338d73c756d331dee7b8ec916e48b74bc6e6d84548a544968
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3eb90dc9849db6a687a09ce132479fc086c416fad9f811869f1808ce81d2db17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb94da4c714c58f7f040a06e4005b085e011d5220fdfc46f7e88b4e307dab197
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c0b9af0ef109c540d0de203c08b38437eb83de8637551d40303c16f42043d9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58ea8df97722a99da456ceb4d3c91e62cb933c7e70cdd07b732189bdbef4c2ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42b73fb81ad9c80a95015ff833da3e6bdc5c5f502ac6f8c013b563741851f893
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c63f73b704b7be39c339afede128a7fcedfdb37a3965cd0ac144916395457e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d7d1c99050d8156dc4154c9fca14ea06d6981f05cd1c046dbd8e2dc86e3a61d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 302b973d02855009401915a70a856c7a61964aebbf1e60b5f23531d30214c450
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7dce6eba8c52b7f3d3509fda095b8d5b791356a253c2f4d15e0eb9593feb2d35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a8a71897c749ab04caa2306d5d7b718d97bd20bcc930f213cff41f894a55585
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16f16f37ab3981c156d68d0b37acbd917db056da78680a7dd97241c1db6460e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41d4c5bb5d53c86cc28c75d040ab2ca66007080ab19ffbc1497b99a4b174a9a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb82aa63ac90a0910c89fa6187930ff09c567def6a34a32f011139c10701441c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a3f16fbff42c7ceb29026d0550c1d2d667bf215b5c5b0eda83b1fa12d5438ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7b4f3d7783f50f9e5b0a38752fcea6a6622d99075bfbd44f43342003629136b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0204b907187e714362712f4b8c0232ad6330d8996537a854d1a691b121990aea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bfd81590db7cd70aebef531b6bf8b0b7763fd404750a81a901edbf3c2667185
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 923b4b7ca95803a49cb9012cc7e5f9c62d509f379fd803a03b4cf249626394ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf7632bfdc35c27bd927db5a831db3df09bc00a237771236754e4bdb7c1adcd0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c76a18cd922fdad97c5354c7048072817395556f75922a6430f35b03bd897cf9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d18683fb0964d17b09351b7062e539d2ec47aacd6da0ebd0fcac39cd53e3f78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89d6771281db2575f35e178aa193927d703581344e2f2437d8f998803d8d7b36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69304701e254c97185fba86b80f968e83d7429a1fd94a77c5e3771497f165057
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4394a0380d96e7bef874f7e7d52a8fb7224a6440a2ca96cf9eedd8af72265c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 105994c1e340131f39ec2cc7133c246c0939d221eabdde1e96d755424a0b03e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e3f4d4814b27e78bb21d1b52916168eeabb47dbb096e40e26fe9070d13ae821
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c3592a0902f9899e365445384ca024f5abd50caf13e859a6db3deb02e5fe6e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e96b8972c4c88e92f3b209a5ace5328b7dbfc684d7428034747ad10bebb4df4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15ddcae56bc03d3ce3c8f65c271f25ef60764b3b35a47ec58871705ca79adb89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f9c92f55d0aeb0f02c2191560b2ac453b6ab446853ad826dcc82cfb3f1dd1bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78c0683ad27f3d472872cb98e5376d142fb9bebd0f4e71e67c111d25094b63a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97d776faa111aed060657cd414d20c2229db5d522b16449c603ecb2f2e34c7df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e376a1b6100ab7cccd3b1011858dd13efba7a18ae78134e51a40d9ae2a888003
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3abe6ad4eaebdd1418e4d9b51edbfd5c0a864b12c76fa19d4a1d4778e405700c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cde3770bb1f581ddda966dcb5aef216c9d7c695055ada86c789f8d2056937b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20e5aa280bf94df40e2db9c64f16cc13cf1422298f70ccca4b4a9c3730b31ec4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad661e055b0ea6202226c756cf53f073f62ef7681b70fcecb318bab74e1a543c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39af9b9fa52c0b37f9ce4360fa740972a09ff0b3535ae722ac95383b94fa40fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd95fb955eac577b450db69396cb5566c14e6e4b4747f8321e72e14d95fe3452
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6b475988898eaaf85501ad35a9311326c9cc2ba0c52a4ae8694c84d3c4810bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4f189e70f53693e84a274ea872b13758d4e13c4b81125979d5bc21bf6959bd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a483a3bb47b9fb2447bdb2003ed864d33ab12d4c9cfcbbec362b3d149191a5a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ff450eff6b58ed80818a9b754180eecb73621be1a7a649884936c6589f3913b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af569d4ac5101e689972f49640561544438941e1da72221fb1e0504812bbf96b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b177a21e5f6b010d40b2f81bbd21bcade8effe2ed36f9c5ede2dc4772a449d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3e8757df83b3fec62b91c11c1d463c8168c8e33ba6a3127137262ae6d872756
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d358951635e32a940a79a0d6953985244164b19ad63aa883989242ea92b8db9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1cee1066966da99e7f6c1da0047798bbcba32dfb87821775ef09c2e6b774417b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67c4bbccb22dc914c2c87cddd275cd8d86446a691869f9a4892101558c1817fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8072f52f538e5f0ac38208330c2d5518e604b446db93b92f313ea32e1875b4b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 376880076d59bf0c6806510621ce6fcbf1f34d33707190499aa755a76db0b36b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7fa3b352042d2737c0ac9d44d332606d8a0d495e5f0cbeb63439a87c8933428
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8de802c96e282e135f480909bb78b235811d32c513116bbccd191b636e532f36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4b2b493f4523bc6a116e15dd5f30c3ed6af35276d8393d688adbf52649f989e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01b483e4504ea8810678b7bb6c5616456f0274a724924648eb6ea07a9a8115cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2090365c5f20c40356e9f423b76eb577939395506c3e62350dd0da2b42c50d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 594c6e36bc36832a58c6ace12494c1a48e0f093a40d5736a566b94e80d0a1e10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 189c49c4a043fa9dae67b131185a831ef3433b01a9d73a38677f9930cac7eca9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0595187f34b295189910424e9e228684118dd52cf2af2841077721b90636d361
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d572a9d553028121026ed9411d33416cb3603444b9667161707920846d94cc72
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5584afe64bbd739d8ed43ae26991f76b0c58147a3d5e0c53b01b8a9f1fc40535
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61b85b1a9fb9a194098f51cf80dc0b3ff810064ef372c6c480e5802cc42e36ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fa1f0d62eda42f8f3b7b08ddfc5a928a71cc1d43f6a374d4f80860f2e4130f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f8e6d2446915d489e7ec973d8bc69c47850fb064f4b0cda7ac14a1846b6cd4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 865df664626d1a523d8d1d1f786005fb90c13028fc04b7f7e5741fb54f3be96a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b231a11b34b18a7153246cd11aa1beac54e103a4649dae95b398ea8911980668
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa3a485a7eab5e3398d2c513c6861ebe6b563620d6c002a4d993b3d16554b6ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 272d0ff516ce581d1539a35536c325486176088a4d6b25a34b648895c121a5a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7f3973da95f06bf6a76bd871e71fde8cfa4dda058625b71b80c765ca5f04440
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cca7a8852b3779ed89e33717db636b31dde6956933dd30d607bccb41898faf1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0127af747323441d21e4729af67007f0c676ccb0166a52d73f3a66aef5478dfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e75a2387b7dd72d9b9e2eed4087fa27f2adf93870f6669ab6b2eda8470a5279
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 838f0156c7aa48de9d59fd71e9b7f108cd6cb42de4e3cd93c159cf2e88247d29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7778d52215c74acea75986e0892341d71b3772985d97479ea0febf4d4961a0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de3750f35d40ec2ef2c1b3012f7be5098fd4216725d14e62043873f49f0d5afb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6cff4b02db96df0cdd07600e515e0b8ad084d2a91bc4476f969dad43c0d06022
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7aeff5e1d19d0f3c8aaa1913642f14fb1fd35f51a291380f3ba2a93ab89a3eb1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c6f33c6ba2a563e017f3d93a4b41742e3e03418a9648e55aa836167aa376350
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c51fc63c77bc9417b8b7b3e06d2df0214946f3413829e6c4241a5bde0374143e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8f0cd00370f7bf65573b589433c54980a6d8d75b2da0f8bd103a7fd45810ed0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82adbaa1ace1af555096ada4bbadf55a738552085d88bec7b7dcec979f65a68b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 456764f533738c295871d47e91ebeedb66da42fcdb601c431dcb6fcc504261b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4e35b3928b1fb8968f0da4ccf3be75d2719404912a30bd17b5ce9b686e6954b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb594849b28ecfaf0b0fcc052097f651e645710da27f2b04ae2be4cb4df2a574
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 310335e447f9f4c1c87c876f772d5f83256d623ccb163df1120b22e08660539e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98022e31187e255d5434272b7115ea19388b1a1c59fb78b3e15ab88acdadbb55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7fd1ee0ce9f0cd20ee6e6574c7c156b62cf3bb41561ce033feddaae882d6bdb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c72524e8291b06ccfe8d0e07ffe63d36fcbcf9bd76c5cbb6b6f10b5f3b0bf3d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5881899b3439330b2ec70163cd3fb041df02eba01cf360d886900eaf755f2c5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 002a63be60f9fc6dd140744f60bcce569386738742538377bc9f1ba7b7f46840
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e28a3ec49cebeef1c39a34819b96926790810d6a46579041a055ad51c5deac2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10545d47fc5d0b7991281aaa9438716aaf899c55c5c2815432979b797b854153
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ff086f00569a923547b18b2067c998968642b9b026520ce8e0aa12bc244752f
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 331KB
            • SHA256 d225591ecb086ea8fb188a1c155df7823e58b594178bb7e1f14e2df79817e510
            • MD5 SHA1 SHA512 SSDEEP

            memory/1708-0-0x0000000000400000-0x000000000040F000-memory.dmp

            memory/1708-5-0x0000000000400000-0x000000000040F000-memory.dmp

            memory/2544-16-0x0000000000970000-0x0000000000971000-memory.dmp

            memory/2544-178-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2544-76-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2544-15-0x00000000008B0000-0x00000000008B1000-memory.dmp

            memory/3128-166-0x0000000000400000-0x000000000040F000-memory.dmp

            memory/3128-174-0x0000000000400000-0x000000000040F000-memory.dmp

            memory/3300-7-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/3300-6-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/3300-11-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3300-4-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/3300-3-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/3300-144-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/3300-71-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5032-175-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/5072-1082-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/5072-142-0x00000000240F0000-0x0000000024152000-memory.dmp