Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2024, 19:01

General

  • Target
    b96fff8fd17e2f0e7f08567aaddcc9fd.exe
  • Size 320KB
  • Sample240307-xpfryabc94
  • SHA256 e09fe658e0fd38a9e957a35581be61cda00865b2453ee81ed96ad16ccf1814bf
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • m1ster.no-ip.biz:15963

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    ieXxplore.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3508
      • C:\Users\Admin\AppData\Local\Temp\b96fff8fd17e2f0e7f08567aaddcc9fd.exe
        "C:\Users\Admin\AppData\Local\Temp\b96fff8fd17e2f0e7f08567aaddcc9fd.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:636
        • C:\Users\Admin\AppData\Local\Temp\b96fff8fd17e2f0e7f08567aaddcc9fd.exe
          "C:\Users\Admin\AppData\Local\Temp\b96fff8fd17e2f0e7f08567aaddcc9fd.exe"
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4408
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Modifies Installed Components in the registry
            PID:2436
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:3604
            • C:\Users\Admin\AppData\Local\Temp\b96fff8fd17e2f0e7f08567aaddcc9fd.exe
              "C:\Users\Admin\AppData\Local\Temp\b96fff8fd17e2f0e7f08567aaddcc9fd.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:180
              • C:\Windows\SysWOW64\install\server.exe
                "C:\Windows\system32\install\server.exe"
                5⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • Suspicious use of SetWindowsHookEx
                PID:4448
                • C:\Windows\SysWOW64\install\server.exe
                  "C:\Windows\SysWOW64\install\server.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:4996
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 572
                    7⤵
                    • Program crash
                    PID:3964
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4996 -ip 4996
        1⤵
          PID:4928

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 2b122a11c3576c818d259ae6ebfdbdcde88740f02c83d000af2c70eea74fe29f
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 07f8bdbba4de9d6936bac95b426abbd092f0eb1f6118ded130c25e28352cfc4e
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c4d26c4f9a4be19ba93d08421bc2205a90f20b84c1f388e142d69dfd5f07494
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14497c4fb4daa0eb60edadb41fb6a4191d9c83e67ce1d047e25d29b2a65e2ce3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f38cad85c4bb556b1bed2b069d557db99aba6f3b728e0db8cfe81739a6891a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ccb8923b0e4dc65ec01f52f162b8cf172124cf0aca62dd13d7b76f12dd2968b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a86ae800eba67275b49f3402bcc437262992514885a03ca81ab35a0e109cd9b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8757262adb60c1c9ef75d22d66ae6721332100c9791f6cd23b2fce41f8b28480
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22f1d5b1a18b126bf17d512b2eff911e57d79505186d7a108f1377c6a9b87856
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40d642aa79b29382271394f71b697087e99129676e9b06ba2829ef8472c8ee14
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4074f045b62ca60e860a9a0146919896bf7d99496f1eee87606f70bbb794446f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce783a8111ca6bd8141a6bad8b075dd39fd256fac2c2a6b2c33bb136e4d26e2c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 409aa38f89d233d0469725bbf3045e57ee621553ffae86b00dbbdeb459df89f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a8951a005c9c473d4689e7662e8079bf994919f394465b90c2f795d391a486ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 06fa55357f306e39ddf13d9208bc9449ed40eadefb4e712fe7a12ac7639693ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28c566cbe2b5f0bc4069cd008bcf4d24a9c36296949a310fa8dd63192d9ff28e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a81c5d110b3e13656aff98e726a00b2db6e9995ee7fcc205e0263be1a158ef01
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3bd21a1aa89cbaeebfc13bba8ae82deec825d3d35cdb26c724053dbb553c21be
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 511beb9fea11b1fd005ce03eeb45dc2ef00c90e7c1c84d47a16902465ad36b53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3897d00e314d079b68aef5a419552048717249dde6b6046102c126f112057fcc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5670c7057385828f37e17ef9e9f86c096b1febf23dd535ba13852791c5f053bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 485fd5fe7a837367e510e8192ddaf4d00275fd955f05faea98083f71f27ab0b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b13123d5ad64ace2fadd9d813355c262eaceecaf7a4905c37bcb840639400c99
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35f7c5e62ef7be53dba0abbc0ce66602cbe2f36b15ed661007931875785d46b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8089d0b82778e6061a626bdd161e30619cb43b41c8b9f17d1d8bdf8c00f8fb6d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 06029c9676c5e711b648509ab960a96e671f9d142bbb01dc15de5de99bd9d707
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3feaf0da5a26d583a91c7bb5b34f3d37818db658893cb74e3f3fde79c233eed9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3415bddc3a7fd0d48b3ed45119eef01ed7fed7fcca2aac611682e0e4c704d068
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85b944ac41d886df209ddd66c012d82a26d9529b2c42b5429e0f88430b390058
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56d987ae7112323152406fa9850d2e766f085bde7782c73119809bac422377e0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d86a20f138050b9c3927d3a1315ef0e28eeb68cf743cd89015b0551ac0d58464
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ae2189a163ad999425142622335e90d951dfdd814eecef6559e68691f0736c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8601f57e7a98070ff24ea5d2890473b5f33398568113fdfb06c9ab772e03793a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e28a18a4236ce7765880ba7b45cc41c51eda7167fb65c8442c5e5aba376e57ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 693e1c8675ede32662fb77ed84714e6e823b4529fb63e4e7d92b1b5093c6f63e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8fcb3df1e2ed14eded304868faa6fdace1c5dbc98979cd62060cb69d01e6ba55
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e4284932101a769c1634de62d49bf69c5899cc695643b810b3928dcb707301f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98a64405dbb96495c3a9fb6df7f3a435dd24e98350b0ee99e0cda2673f6d39d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6525fa1d9b223280b8959ff22142f411578e95697116e509e61287c1e5ca1fe2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e835f558505526286aa71625555ee7bc9f786227982996463497d9bdaab13af5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25fe4b40dd8bdba6fda1123d08fc546207818c0b237909a01e7f367ca71109f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 885cd4b9dfb4aed1f7242227415e2bd42fc7b9e80deb5cf32885661233f012cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a3fb35cc38f2d12f7cd1d7bb1f5aaff6a3e3f3f681b812520c64e4e7458e809
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9604a2d9f24446ee7055e1d72fcd09b056d0d8ecde9e2010c69a3f65c639d2f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f060bce0610cc4fbf39e2282aa5e2ae5e2d65ebb5d356a3ce6cf1d1b560776dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 96800e5f03bfba6b7818e5299af7f67153f64296b57148d21e73ca8782a6a9c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6007d4688672439230a6fcb6061517a25c66303d9d0eab940e8cd628b139edd5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dede11b41a069f26a9c18f88b46250d732781923fba1d425f7fb9ed1b3dc6bb5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6965eb336da6cab83ae0b21feb394eb5ba7e5c2b5263d96920cf3e04cbdc2899
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e77956c8689c41a78437140244823fac87a52bc33297d8f687ecab65c967ca2d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 480ca35f87bff428e42d46a453ddf571a2925e80fac5c8d7491af181ad923300
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f32dbabdbf5fddf5168af86fb6b376d7bc9f427318466a6b5e4502832eb06da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73d33ddf86fc842f921778f58af13db5bf5353327295b422284089175b20405d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ddb438b76991259d0983551c2b9a58043d6a5a6b3640eedc0062c724593a7477
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6c12a6bb5df39db595b7f76422d5618017d63ea38ef99734d0581725042b6b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 688c86cb19db744bf3a299756d4daaefa58d9099712db56251634011ecbfdd7c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a0d0ba97533ec53f20fa18cc4dd43589ff31f334e8c0a876d3c8a81fce02f78
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1724c07034cb418acf911d618a67649eec18c78eeaa65800f27d71ca4c4051b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c99777daf64313b2b26f49f496d2c6424effc6a7176cf07216cd8f97b3513b21
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1816859f0f15bb29d29d1aa23310f29dcf25429a5ad177373c7eb67a20e56f53
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad7a3aaa206474bac2a8465f438962f2a6d50a78e453331d5fc7a2ad7c743fa0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9fe7c618b9f4cb82a04e13a06c7d24169946a1d60b4e64a8a0dc6d204099b4c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 144dd44b5a128435212a994af78c052ad882bfc69f6ba0256d9f61841d38f6d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e814e79e3e879c09a96322fe1f9eeabcae1d092d7ba8e22d9f379d18a4ce9e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a26113c8a18d46f4f5410aa6ee6580a884c487eeafbd30fcdca6e55df842477
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9cc4a156ef1889f307f8490733394ea3beda2f08a7434ed25fd95914747b6d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60abb9f5c8c1da6ad0b9dba83fa6c80135a1b402b8bfe14ca2b7883e155f58e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1cab5dcf67b47a296771514ebead68ffb8fe184292f697c7b78f92d49c7eb5a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c79bc0f973831e0a326cef4adda0e7a0f58e7742e2a5b9a52dc16e980c7c2bd5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9f6c80896788c6abafee906981ec143fd0245fc783af893683f0e61b51b10bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 852a631a97b1e60ef73e62a9b6581ba9018c96b1986ef0bd330a5b9346a19eee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 477b65173f9a03a6cc2232b0b4d62f9d8ae506dfd9e03b1a3ab11fea79965c66
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ddd31afac1494020d91379e50e5812afedac9b0672edc6504c0d5931d0e9bdd1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 314cc06f057bac11c24cb96fa94080892c01dd5808f4e1ad26645d609ec56240
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 357da9b4b9c13a22e03dce1c18cb68da3f84bfb4b971394b1c3d7cd1bbe61915
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4aeb4924a6236fc64c3437d880287cc2ff7e300d807a168e903c6c25300991e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d53b896d5ccdb9584bcc9ffb21024f2e58dcc895ec787e7f3498841e25bb7cc2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14bf6902a2547cddd63804c96518fed35480eb409e9052245f2043cd8970134b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 52057550074d5b118348204bbc58faa6c7b53fef3c21bf945089e35f53eceab8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78bee24fd257b5e953c79c1690140cfa41cc45c45ce4ef89520b8cfe070e08df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee08ec8965c999f86a306bf643cc19308671d6200af0db7c5ad0cbd306b3bf68
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 374b4a040f723d5fb848b650d03f24de81ef5031a9e6283c80f0a144bad9f5e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 641c196fbabe4631edd120cb94261cff32443cc21700ee98222cae3609601c2a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb87b25de6118a77a72aab5ffda5b9e26d0ad9fa8787bd7ce09129e12bc4c379
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2e3296462f25a2df9a4c3869c4672248681cb531b8062ac687dedbf67bf6a59e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63eac742239039fac0406366abcc750e9d5d27a80cfdd15936d0d09efa940b20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 531be9d38e9f1693b7df07c043c7fdc4af39b3966c78af186d2d14f9707070cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3aa3a9e5f9c98513b14b7e90366949413605ff1eb7c5e49b09502cf8e82fc1f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e8479443bbbab657f58debdb2660b05c6bc5ba95b285d852745a6060d42320d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02893caa3ba773a9f892c94236c376a7942fa1ed6311671335df8c7a1776fcd0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33c9b2eac6bb852a67a1ec26861b96146b76b41fec1ee3a718359621564c294e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1275da70be847bcc83432e6c6b37dc71584a1fcbb16f1d323d6f765a88eb2bb6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2cd3173a2a7a887c78f8a6809a36d7a47a0af9bd27e6342f59d7ceb4d67a686
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 469d88a785a4197729d2ed6d50f2693c64c31fc9d6d625c1fd41e263d6d656da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ef20305aa0dc76cb9649b451b447d757d3780cdbce7efb74f4f3a5fec10e720
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87ce579bdfc379c2a61b944b1a28643a7967e626eac7778f9aa985139968d9f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e9f2171099f855dae7276e7a86212e5189b1fcc086f6b2acf705fe81988d276
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 404610d427368137d7e7b36d1dd07db9ea406c40ccf49c273b378c7dd97614c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 016e4bc8b861ac611698f0a7b3ca9d426f9f494d201715c02422addd9138b9d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a39ea3b54711258ff5ce89eac33531dabb765a39683ee70bcbe4ac89ea925562
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92cda05c5619160c8af12628052594e8030eb9ea6a3b8fbc03a4bc7cea8aefaf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c703c778d011903153c9634767c34e1feb36d80364fa0130cfcb8cd657ddcd8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 61bc391193cb345fb22cf1eb887630b906b44637f521ba96f6d2977bfb58598b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f28892ad543a6ae56493b918fe8354bf54a478d11b1d58323ffadb6a9009703d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4d1075d78135d8ca164b2e0f6a2043d30d7d4478e17cb9066414d5abc45306b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 895f332622a38e70573b28e6dd35dc6e15316f158ff74571c2d628eb2dad8fd7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d7cafe578307ebe0e7d1bc9c1c4557f9a57b2c00b2afc34d69bc40260880bed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0faa81a44131f93964f3de89fbe002ee09fc3d1366975c3439be3a7d123e3788
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ac09c9d3b1422aab690a10b59e4363cb9eefb2822b78398c3e661a398f9bbc3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9af294c0dff8b91ebc9d34727ee23ead76b02eafd5b801f9c5ad40abee79c4c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d10a26a236d37cb93d526c6be04c4ba18bf8f0cf44451f7b32b6ac51d834370e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c89cf1ed5efcb9697e2e325f82d12cb63680bc9b0e48915ca95059f3664573a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 636c2cea3ed5483206353b1ceb2395466b3e5b46f8ab86961e23c5bcea2801a2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c3caa7b75f84bc26a13a1c85e66ac7ec92ac97509bff3d8fe4912b789a96052
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa7fbdb1278a1b2dc15519f44f5374b70aa288e4f39635abc813737ded14f0f4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 00ef4df19b9e4bf039f08d5dc477e9f8015166c1ad481540ec8dc787d1b29c18
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 23748eed692374dd8b1d52cb2a12cd18a3e426fcad84c1cb1bd290a2b9723bba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dce4586d5e41adeb3a77628ef114b8936c60ca741ddc684fab767acb6e2ff984
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41d1f2b148bc366b2a59714f84b0c3d18a6f3d871623f72c70fd0ff30c609977
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3d1d7df418a993697c2f7f26dc29ed00855bad657dc1bdba7b6aec19162f6741
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ed5ef30006ece8f1a0291ed0ee02bf5628f58128acd8160ffd7ccc894117fa6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4620a48b2c4187a4d3283fd185fe30320c573f1b285002575ffc040db9f488c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 476eeb4b47e5e249efea8883f611e99a6663e2066e0910e6c42b93bd22c55bd2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41ace518d6c1df7179b874aaef2e9392f552727f5e6be17a084698a9d28195d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29cb22177ea65f5d9b5a9b7e1f3fc03e8d7b14e8f0c0e3186c0fa1b94026ce24
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44f7ce885435ede3a3572154d0c59f86f6ad661b675b89ad9a99a68ae4d8afd4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0dbfec4e41bf88a4bea14cd8fe045a262b1bc38698ffe09396d1bb3eb8cc1d6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b46f33d660def92792f0f75209cc79a8e8820ccbc985cb177ada9d42c785a31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71bbb2dd9a23817f2e9834a0b46acc1051582f670cd8bf5ae56bf50448bbb443
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 04d70638be1569a73759ecf69282010800bf6662787e0706ee6bcfed502b243f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aaa13b08f6f5ccac54d7f413e23aa0bee71bf46ed57fca6887d515910e801d7e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40e9950dbe7fdcc8763c3332738a74f0195b53cd6595d77ae4faebcbe6dfc597
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f01249c33000b0a474a194e8f5070f81458849b153124bc75cebc0b3b6fc9226
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef9ba3345044e19030ef9c62e67c4db32915dec9ad018b3e69f34fee854376d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73e7e99e69de2e8c048a55b165e44257475f9e172a9fd72c83120e8a9cd95977
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ba4fb7af9bf7301690a6b0ed7982448e6d93f2243fdc8bd3d482b7cecb9f9b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cae581fcf30520ad6d905771be52e148867b1e17463cf5aeea787b5613ec60f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e845c9f9b9bc920aec8e80e651089ec54437d54e54f4bd0c7a866e54b798a0b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b37f71c78a63b37c19e9cf28a4dd2612c52c1d39afe54d04ce6d692ea63185a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d5cdc655ff0e01e908a3e7cdbb7a6a655f8f9e442c46f0169566c0cf5660b69
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\install\server.exe
              • Size 320KB
              • SHA256 e09fe658e0fd38a9e957a35581be61cda00865b2453ee81ed96ad16ccf1814bf
              • MD5 SHA1 SHA512 SSDEEP

              memory/180-884-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/180-149-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/180-88-0x0000000000400000-0x0000000000457200-memory.dmp

              memory/636-6-0x0000000000400000-0x0000000000457200-memory.dmp

              memory/636-0-0x0000000000400000-0x0000000000457200-memory.dmp

              memory/2436-15-0x00000000005D0000-0x00000000005D1000-memory.dmp

              memory/2436-186-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2436-76-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2436-16-0x0000000000890000-0x0000000000891000-memory.dmp

              memory/4408-148-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4408-150-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4408-11-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/4408-7-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4408-5-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4408-3-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4448-182-0x0000000000400000-0x0000000000457200-memory.dmp

              memory/4996-185-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4996-181-0x0000000000400000-0x0000000000457000-memory.dmp