Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/03/2024, 04:07

General

  • Target
    b049857df3cfac54ec8a88e6b4bc8ff1.exe
  • Size 283KB
  • Sample240301-ep3mlace42
  • SHA256 adc8ee9925208539dbdec06ba5c17a41b84a01cede9efda3ab054bd7c81f52af
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • glorg.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3348
      • C:\Users\Admin\AppData\Local\Temp\b049857df3cfac54ec8a88e6b4bc8ff1.exe
        "C:\Users\Admin\AppData\Local\Temp\b049857df3cfac54ec8a88e6b4bc8ff1.exe"
        2⤵
        • Adds policy Run key to start application
        • Modifies Installed Components in the registry
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1364
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Modifies Installed Components in the registry
          PID:2020
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:3224
          • C:\Users\Admin\AppData\Local\Temp\b049857df3cfac54ec8a88e6b4bc8ff1.exe
            "C:\Users\Admin\AppData\Local\Temp\b049857df3cfac54ec8a88e6b4bc8ff1.exe"
            3⤵
            • Checks computer location settings
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3304
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\system32\install\server.exe"
              4⤵
              • Executes dropped EXE
              PID:1208
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 576
                5⤵
                • Program crash
                PID:224
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1208 -ip 1208
        1⤵
          PID:1856

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 010b1264afbe921cdd10712091edc0bf63684cc2f17598d2801772992894547b
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 9ec576abe7fa1cf12963d03341a67054c1f0771b6635434354a29d3227855110
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1866fc1e440dadc62bacda1b05ff18b66e6c6c315632da49c0355bb4965301ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8158ce4d89f2239016e82aaf9dde74ad5cffb1543b6253bc2d473ac52a4ba161
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92ec1ec9d3298f39d9e8c4734a1df087e71a79c52a7aa5cff8ba9c9421d0ff95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3d7bf05d13f6c92cbfee3d9852ebda058852b067e6f9fb2cdfdefae9eb1d24b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b9d2748222fbde10f31191b189daaf711f4b0c0c0c4290a9c84d8c3bab3d3cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9da8eb2a4953fc920a51fe42e907ceddfb7a39ecaee9584f3059c98bd113c528
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2541b26b596d8ac82a7b9ebbf19e477a72e56a1b0274a83afe3c3463d175aa2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 574279f2b11a1a357aca9bfa190a2e96d25484f599cc2a26eeb68e2bae27fdce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34eaf5ea1c5e278ce8e762a8e76f24cec462f6672cf90cc034c4ecfe3f5be29a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0782d1cdfe2f17c621c1c4b6abdd21b840a4239600e9192d25caf0d5916f24e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa4e277fc7021d74d00ffb713a7427b9cc94fb3f29dbc1b5da56189f5c92e12d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59f6f04792fb55b8ab8d299c4df78d95df317d83bbc114e4ed2b427d0b974403
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3af7eb67c42ec8a0f4cc806cd41c97da089e2ff57d038273140c6ba8e9dc1c20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8250dd77e18803c223509534ee8cd1791c4c3eb0cf039e3667426e542f118a25
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 39668329a97d185fc2fe2e28cf400240c43110b3c729a35d2b2fe1362a5d6fb3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6cba502797a55dcc2be20a84fb204ff0acc14527743ab4e0b580f326d93daf9c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c9fc40af4f477d81198104f0df967716fa37b0dfb07edfc3364628698c1bc65
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5830e49e8b3223ca2f5395caf3a614d7ceda8b81f86556a0c499e04417d54154
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5bb52c58f0c1fe67cb4e92313fea398c152cee6e19ce2aef55755bdf9883a5be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce604eff2a6dc6cbe362a4d9b523a8b3f1831b68a9b3a4ec070a1c79f26417e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b8655f241f4f838521307cc337751d2063fd6f10e4d56e489911502fcf4dc419
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd65a24acc17f6b52322937d063ebe3eed6e37205666335f6d30bd0e3897d3de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f3205d8475e5b5011a8f38aaffd8dc3970ad1bc83205e436d463b87f87a7997
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ed76baf7be477971b82a9a82db6e64cad33f0404dcb9b69fb9843b202525b5eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd9db887c68040cdcbed656269cf41d0ccff68fcea53a6f4914eab35e1ca25f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 008ca3fabd62645c97191dc5376fd6c34159c270ddaffb32cd132db1fce08cb2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59b70b59cc5d70fe653161f2c337f381f8cce373204cc7a65517ff401cdc824a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6af6878e2d0bae8520e27345bacfd9397e583442746d2ec714894d999156e8a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0a06075e1551fefd8cacff1ece05e8d76f1a890d6d739bc012c1337744e0cdf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86e8c25ffa1f8d92f8427257ca7cf6686a320d3eb7a4cdff2ff83cb9a3a1d528
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bba5f52bbc906cff683cdade0363b0f4b1b1d3aa296ad37f70df49ed3e511b61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2cb1b736ca14b55791747dbee51d69dc5e99dd6750c7e95ab1bdaaaca92538b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 230ee9aeff1939985e00b7fd556971fed5e47614167c784a287d51a86dad17e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba78866c2c96ceb97539d88baf4fbdb6d427c7c9855ec41e8b89d48ae87911d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c5097ffee0d308ba2ad8ee53185988fd1969f8b1f7e1e367df659188b12d525
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5956805cbd9a72b987fbf190996537f799069376bd5a068ffc9a3393b5cbc368
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 81ef5705111df64cd3c2201b72db0c673310d336da50c117b3d1e952fa2d7ad8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ab04d449ca432b92249202fe6dded914e5bb849f5eabe1ac1756c0ec0839244
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 90bb4e1d9dfdf7fb5a1230f7972c80fd1a80bd312c51c7eb2acec51df759c41f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c60220432e1f905c91dc5250e5891c5bf4d068e0939f52972f6b32437cec751
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b85e5c0351a8d80158ab95f14a8dd547eadbc204bfcabfdd7a5cf18c78a76b96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3d762182c6eeec4b88df1f17c267d6b35df31c5df92f39ae5d069cd0f8eaad13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2169e2f0daa979946ba0e49c89d3ff609d2f0039fbc26ff40c95f9ca8568baf2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 509d545bd4863dc809f9176d710a402fd76649448d53360c50ce2b02e6ea3f73
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6cf2ebfd3c49e5462ace68d7ee8617290e78f172f709475a34c7cbcd3940b842
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f5a85f351a5a8f27283290cbec479ad354f7f9ba00587ace22588c79efe9bc76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b83decb9f4c1a7867b3178216b252d397746ebd1c2f13edf226d32bf97cafce0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a650bf80f2ce1b561ad9f8e54de4655cf71d2205a71bfb99dde5f7e0c0d34597
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0932fdd07a0411ca9379750718b168f8cccde9634d926bbb87c22cc6b824cc42
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c07c21e84420d55878af78cdc5928fa2f1d1b05b3586a11d0a9fc8b1815cfed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0adeef3dcd7388e5b1c27b780973719522867056d5f7ce0bc0e8281060079d09
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d2739da3c94ab2e8c8ce321cdbc24c8220820097f5b89fdedd1dd7c32a24adee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4029a336b9898412e896af0d898af6e2c01fce481dc1c137bb05231baa0db385
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d062fac7ed405cf605e6545b99ac35b29daccf03739a9c1f665559937a2c9d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 926af9a2ca8f18600af7e11849cf7f399ea8bceb9644880512e6300cdf923dfa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6403cee04b10484a660809d25faff1baf4738dab385fd4fa93f96dab53a4dce5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5985ab194b17810cd313cb34ff43a2ba26b5a0783bd0054b9a52a6fba7e3f70
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd20b6c8e19f167d18ac2e2ec69a255cba78925838c72e574b8cbc9d26a8c013
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0ce98ab63995bc14b7d082ade86129ff3770ad991a1254ace0d8e8e183b3cdf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d0ad1c82ef4d76efc578a01e255c3f39c1ae006ba7835d34760cab2b9cde0ca7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5319fbb884436385c12b174543ec35b1f7112f39cfed445f8a1423e7dca41726
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d8177273024f21aa07bef20e945a0302ba643d82f4ba5fc47b3f44ff443c7da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec55ecf69d1d7e0af7f1e6703c0e45d535e212e74b18eff7d0b23f4caffa6846
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 651a197936a17347c7ff367214dc563ecdffcd03cfcb4d1ab00029a97e5ade5c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 00b32f3eafde3ddf4a6aacf861a01d77cb09480f55adcae9c80d689f00bb0147
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7e4eb9de900361a22ab3243b57873934a0ba6f5d25e9f4ca321863aefd557ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 137e9c307714d8c63b03e605f6259231be1e8966cd894d044fef6390897fb859
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ec58e081d4f11f506d4d5e633b3af334e39904f436a7d08a29862c66b34ac43
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a52af95cb8d4b00160611ba033deddd00679c03736367294581031ebc4aa3649
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5792c83e0115ca6bded120833d3b63393e083fc1e526deed4114957d2f6f3a38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fec2fbf643842b105fad3989c88fb733577cef12b607c64c05b96fa90aef892f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38ef162e78fd2924d11b76ed3a26abf4dbc78b098d83061fc080c46799c748be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c6979e17f3145b135bc1176c46fc41a969a934ab9a97fbf00c442b60f6ffd0f4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ae1ab594a128d8e1cb529270f51457d646f0f4a0acc1229f93148af8e470853
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2e61ad3bf9309924728c0fb6a12a1729a4f0562e09441ee670b0a2f97aa78561
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cff10796a65cea537e70ff1af9cd562aef04001f86dc1eee3791ba8987421d31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e140ed4ef555deae5bedd164cb2875d66cf04fadcd368c1dc450ccfb6429e8d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f97fefddd54ff71104d9a3ad26e82701c9bcbbc5839d607d9932c63040b3695
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 018c2ac99b7ca9c09d454f259ba50656ba507460fe25c910dc25f006f306ab6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 80aecd8830f89c7a460d1e41fe8f0dad6b24a9ecfd193b76bfe47ab5903a35b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63f975fc8c8d2f52ed114c0287ffe2c44b48728236ea4ddecda0a5eb73089e9c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf1c4ea1d5ec97f145ada24ee6896ed7d90df5b2ad9e79f6d960d0105bcec8a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 335cf103544bdab7245b0f395c426783696acf8b07c2346d6fb9c22dd000d7d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56211aa7d9e968bffdc3bc945cf48cd7b05d66696a638bc0dac2e7e160528a03
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 52523246da41d4180c7410aa6169986448343591155a16596c08d35431568487
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3fc46a884510eb2fc96b486781c07ae49d5266c745224fbd7e9a5b68c7ba10d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7779f895569bb5f7ee0abaf9118b2717a5b2879a91d1730e35b3f64cd33899e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e03928946810dbca345f804586034345198832eb9f1f2d8eff6ede7a9648acb7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 503480f20f49d75a1ffe8601eabc4223e81e143ad202cedb6591ca7965783164
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30b536d01e847354c17fe699271e08bb1450f82abf8fea6db44f400df33b6812
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1359aec981421a9c1363486e3bd8177cfd7578ad42e44bdb8319cecdc894f85a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44607042d6f35e787672aa0f544e03f17c4bc789814ba36824ea903e71fe33ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8bb599c4477a925a506aab3b65da0033eed2a50ab8d428d1e1f3b5f0c05412d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9c2cd12d0fb80907004482e90ebbe81eeeee989d35f0d360bc40feb20bacd50
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42857271c0557265816428c0a37b199582991434996aab38bb2e9a8cc9505642
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 51062cd8f16df9ba5123b49b328793c0d5bdd24950dfd04cb89f57814628706d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e04b01a64124da6000e3ca5e56e07f5238d8fab42b4222723df2eee7577b7a58
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 03a6f48e6cac342243c76b4328d04f4972d3f7a2f5541778270c351254843afb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b45a1fa354dd1e89d0a4bf8c2c474a91f5ebb853cec49fd4cb305b6a403548b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1a39b0764b8db087a7cbea6aa753d9a70cd014dbd4cba6ab12bbc0d763a7a81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4558469ad127ed8f8addb67aa0cac99c81e8c03b208d5e07d3a2ddafdc6ecc06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9215ced96ab48c606f35edfdccd6e48a6ebad3fd05d029a57207e14d9971102f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 47a91d7f6e3f3b7f29eed527c30207f031b228a6b1567075920a08148e5d1177
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db1e9706cb680feb3e10c9434ff73469de593db8c68409504fb420fec679b3ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 79eb54e92d70378a7d55458d0d5e2174f7d3da12c36f180e196e4ea265d1e8b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2258e9c43d3b454d5fe7fa831e5f557af8424d5d376309d6f4b2ee9b00715c6b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a7dc168f568e3c10a0c6d518262c82329feea4048e2ff71d0be5c065c2cabc10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a70a0b063ff150e24d071666699aacacdd5a6956831897bff6fe25cd3c76c917
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd740af55fa725ff620806730a50a99587c7c9dee86be469c79096ecd3848f82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eba0eee5cf4f81b4082613c17e7df86cc224967d9833eed6e2f7531c0947f7f4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 502548b02f5d6a31ff0ebbda9c4ef314e05ecfb719f1b02eb451fe6f9c55faf6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34586a031659161996f9b88d835da32799acc52c29953177194816a54e4653e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01aa733b58e6c8f245a3d124fb66dce77e0a4ad15a9d9ac89240c7541bb3ef1d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9ce71b341c831a4a25c81cc605db145dca84a7da8d5654411aa795ed961f8a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36d40f5ed80ab15e2e35d51b6dd27ff5fca54de362e153b4ddea167d20f13fed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 152fe6007658cc32dc631119d3c54f360e452be0986954de336c6a32d0db3665
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5d45f49f82d02f2d6228d36d4c8331da4aede81f75a5bb5932a241da9dc8b48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6e59afee88ba62f5e1f9db439aa497468b4be35480146691f4c67613d8311c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f63a83182d1e1a8947c125943b8a9886dda4e7a746d05a26b2945dd06dcbd5a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ef03315a7441c9f84a20f777f62ffce444b86edd989b41ab0bf589d59d03c0d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c15fc67217f051c8897f9ebe52d10928aceb02df6941a840e94cfb2106658ff2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a6e59ab187c63b349f862a2f3f8339fdcd038efdf65ddf49c8eb1d58fca9e8d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9652b43566cc2319c28319c1885759e0768bc6452fc66ed8fc3c898f9e09b70c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46d0ad4753432d4a0519e054e522c5a28dfd21298590a3b50dff36648a6ebfe1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c40368fbfec82cc641419e1a7c34c1cc7c07db56912dffb9dcd9d6239aa4152b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc31f3eb1073c976a5ba5859e593800501cc3b0ec997ff5d94f307c07a65b6d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d239d81a5c50228455ea79f0b7e9218026bd21d8582449790db6a7264f637f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 605cec62f1a988c6e046c01df4c2284c6684288966270d7c5ad2e1568ad15c9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e91b8064265a88f87362a4adefe41feaa80c3955d07e45b888fc72c5524466b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 713fab0054aeb8d01c33676cecdd83dffa99197666633c07330b779b8e56de46
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08c045b8b481a34d67e02668de575c49b0095eeb9ce7562ea5cc598a167f3104
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a3dbd3592d9decda62753bbf4cefb3a1767adda018e45265bba971c62f98d5c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0e9ee38ed66d23b5a7dd6de69c99bda4a623a6cfb90ece62dfaec379dffb39f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29239468dc6253f7129f3b1709ea46d69322f9ef1acd192008b66483859a6dcc
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\install\server.exe
              • Size 283KB
              • SHA256 adc8ee9925208539dbdec06ba5c17a41b84a01cede9efda3ab054bd7c81f52af
              • MD5 SHA1 SHA512 SSDEEP

              memory/1364-63-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1364-3-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2020-161-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2020-67-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2020-68-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2020-66-0x0000000003E50000-0x0000000003E51000-memory.dmp

              memory/2020-7-0x0000000000C60000-0x0000000000C61000-memory.dmp

              memory/2020-8-0x0000000000D20000-0x0000000000D21000-memory.dmp

              memory/3304-137-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3304-1460-0x0000000024160000-0x00000000241C2000-memory.dmp