Analysis

  • max time kernel
    150s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2024, 16:50

General

  • Target
    bc500b8a6c897f33f9623961ce58e0fe.exe
  • Size 649KB
  • Sample240309-vcdqpsdc3s
  • SHA256 3d1bc5b5462fe94a97a76643bf7477b86475beaf5ae819963ede6226fbe647b3
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • ftp_password

    ªš÷Öº+Þ

  • ftp_port

    21

  • ftp_server

    ftp.server.com

  • ftp_username

    ftp_user

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc500b8a6c897f33f9623961ce58e0fe.exe
    "C:\Users\Admin\AppData\Local\Temp\bc500b8a6c897f33f9623961ce58e0fe.exe"
    1⤵
    • Adds policy Run key to start application
    • Modifies Installed Components in the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:2264
      • C:\Users\Admin\AppData\Local\Temp\bc500b8a6c897f33f9623961ce58e0fe.exe
        "C:\Users\Admin\AppData\Local\Temp\bc500b8a6c897f33f9623961ce58e0fe.exe"
        2⤵
        • Checks computer location settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:3436
        • C:\dir\install\install\server.exe
          "C:\dir\install\install\server.exe"
          3⤵
          • Executes dropped EXE
          PID:2304
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 564
            4⤵
            • Program crash
            PID:5044
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2304 -ip 2304
      1⤵
        PID:1948

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 78842aeea10ad6979ab976751ac7b081f97bb74ea9dee4909ac6b905f46f4ac2
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 588KB
            • SHA256 3b58d01ea4272d4d2f6a95083e2b1fe6b0c5fdd744ed591a288169d89f505876
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95c55b29e12e2361002988120fc0766d71ed4814049218e1af7667c4ef05f0a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7bdfda42a717fc73e1bb086ee2fa3d52062e7c139ee61078276bfe4635a16078
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9c9aa8e71745aac675beaa38c2f0e050ab88e408cdcd6f1577f5ac0f2a56a32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 334c2e57603ad536e0abe76b72b8a897074c144b898356c4ad7d3a21f4a8ed38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ca1a7407a5ae05f8d7a9a77de87969551677f7f21bc8e7991dc443e949ca6be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 883f802b42fe7c5231fc2102aaea36736715a25c772316b89cc39ca0692b7d31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d5f050212c4cb8f64da58c4ce76bb1f75ad2bcbd95d732e820ba1fc463dc0da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c15f9a00ff699e7c7e976555c219c0d7956f468cf6b4579a98af9c08ca295284
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c136220a5e45decf25b983654eaa91885e8e1f62820fd201d1a9f19e03fb2a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2c4627c7e915817dbd9edc84d47d8658bf62804e8478cc45b3dc88f71379a32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67dab9125c44dad2e7f0b5acb8d0c1b91895c3a688f044247aec564007797c53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a1bafa91aa4fcc8a63b9088c8ad2c386ebd96795599d735f067be6f75530949
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c726a6a3cc6d70224cabdebfb152dd64a06f09d24dff84a94a1175308d448c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccee97a88f113112bf9274ce2359560a4ea268eb6be903cb72563d2d9af1a782
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b22ec38b42e80411765e1b0de91935398738327dd37ae7511cd29ddc19c8b0da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8c3282cbc3212c591ba80f486553b18500bd21d9c15f274c07891f6ec9ed960
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4d80aeb603baee836abd88a4782be6f0c1d10dcaa50a94b01a2538b677c25b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f09cdfcb4e9133d36e06f95b7c0266b3d3c6dc7e92170ba5d31f678c3ae3cc2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b82da6fb01f6146fb9a496a7ee671e1dacd6703fe9448570cfdde40f8a90b499
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3c0861407100241b2b6acd34780d600c73c1f1a7872fcc6981d5080afba9eee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49246106681b07d36801eb81af49b3ae26d8f6823edd99f18f5f0b89706da041
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a27202f72f1fa91e28de5fee6e806581468999166ddeab53ed0d65bd151a235
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4130f226e8be351ad758760f53de6110e848de988efc23cd248d4698881f0dd9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f15e6a5dfc7cdb51d4e832967c8e71b60214962b3efb66705f27e93cf3e9811
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c924a858f9c60e964fad73497a292705ccf5957c94d472afdf2497a8c0f62035
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f3ec18e9d9b0b0bbf91d25d67a6e517f0a41487f90dfd2db8ec4e8ac605b74d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b8180ae5ff64c5a8e41d835d79af434449905b72df254fab2d90a54d24e6cbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 617fc6fbc793c779fc2e7f69f926c71ef9885c10c1fdc8c55f617b0a67ca7c62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbe9eb0a8df22ca7e6e16f390e9a14f15b389b2a4921e12db2bf7188088d35fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ff8b8aa781369445b023a49f1ecf1d3998deed6b3b718783be150ecfbcdf6f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7056ef553e69e30cf095993e4a910363a0920bba1323a7772893ca51188cb4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d40fe63e4222294f0b0d66f00dee97c7f1120a4d5428cf0428292739e136657e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 056bd4dc63cbdf1c36827495ccafc309add57f9be3dd0cf64e301e221ec961ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92cefbf0a69fdf0e6eb704e0c3c5f95d15549e0e90c793efbc35b0d7639c2002
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0810896d25efe97d6acc012e869bb1dab6d317342cd135ffae4865f794e6fb6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc0f0eb73d02c91aa5ab2ce0a561a8ff81d7ca208428e1d23d5236a488482586
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5160ed6166830ddfde9e72c47672ccbd9fc061ce23bf174dc4b6f44f9630d16c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df8317305e65840e1f461d929015ddd5e9861b7aeeab99d152c244d1a7c97f7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 835714a5531f9ebe5d9872165c1e7cdbf3959d2902955419f6ee4b74f8be7021
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a204a9e34d3d1d50aaa57b25455054e633e3c099b8b9712b623a1a19e6492093
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97b3f54968803c463e92327262c2f9a1ef023864cfd5eb104d9ce8fb86d674e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8437d6af19f8cd566e72e8733d69d2279f157180e8e9560b8ff7379fc48a07a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ff12fa50c2218d9aa1006d8e73cf75543488b8137d99cfca50a2afac4a44090
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25e9d0188517703e204c23af90493f33ee7a20caaaea47d7665795110c7138de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 215d9cc99f67afe2e13a693c8401cd336891def82d626484a267031046ecdd30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb3c4dc9cbc4d237c65d8f1aa79a495262ef4ae20f7777401f929bc88c2acf57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ae6e916d7521d266aa7183c82ae75963d9ed16ea3a8d9ae700cc121fbf403c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 833d359ffd424d94af02d60de18579129cf476bbec9586369fad116acdaabd6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 647fc0ccc100cc5e06048222b85ba286df9e9b77f72cc006846bd9738f150f0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09585f6c86e8ef252e1f1f6ec2667d1c2d13a038fc302f96fb1719753585217e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce1f2d807297322b7039a7cb36c50004b400c30908a03ed7b83cba82704aa52b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f24638181e5640453919457228ec856d6a113db2701a412959e052caae050dc3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42219abe4f45f750bf12ec8ea570c9206cb9fcfecc2c8e49a6a10153b0cc4e9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f93456bd04a184fb5734bf3a4333ec1ef16fc5d42a9cb642d109820dab46acb4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b6886c6a3c9f3d7aaf3ca04a1049490c5d8408832dcea686d4d0e600bd4a49f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2983a385c21550d68eb65d66f879871602dd000b83ca086beb33a4364e885f2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebbb1e9b67f56689b26850d8ca8986261d39a92bfe597426bbab4f4ea6cab2b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bd3235b138860984358dc0dc9f0ec1f9cbfd3867fb2298eaf31e9be2127234d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4314c5406ad026fc842d947fe3f05340081426e593d79437c2e1170eec9257ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 820799226d2a9b73472ff740f04750bdf6f5b25900801eea2b3bc6395809456f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e675a091d466cb262a1666c28a6b11b94a81503fc08c3b460144fcc50ff1807
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5eea11dd43e402d241a15f1f3aa045b43c31213ade41ae188c85db2857c60c5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28f9be926b88a0c1c53e57899e5d43c7218047cbeb37b175c992a93658073a90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54eeb8a7b03a9dc0914739049fd0a02133da9a3e460955b207079b99d50c0626
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c3a680f4b84a6cfd6e794f2b2e178ba81d271562cf376bf5ed5b844eca5f052
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f28eb96e2b793bc9ea99c73e54d4739e1ae83f5a579cb39123b76fe350d19b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8048b726c75ade6f69d905cdad5264fe1500b3eba1eee885ed2e7fb288e82af1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6460552744614b0333d929e772b1758b99c1052b4039fdb4dc2095c8462fb43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67245b0a3907d44c164de02cef8ca2fe50e274ee8041fa4399047fa99fe99a91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9fdeb467a7050f0204dbe020ec205b0bdd56602fd430d5c6fef535c4f61c4cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5194fbd537cbea82c4752de309f854d0c875281cc0a53f9c0fcd0372229cf96d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d22cf4ba7f702e44db169d4c2d88b52a32c539f575bff5baed77e35494c1e16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ea3367aabcac7b99b6a2ec7191ee2d221ec9d1d22c37e06edd3f154f3159b82
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cba6791be5ba198aef5c385dfa9c71f00c372ac8c76c9b4b57a9bba9ac227ab2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fdcf16940e56fde71e1d5cee426c24e8ea32049c137ee113ff6935593998aff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abbc25c8905e212347d9af9199ff39eb3a942227723f13061200004884feb819
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8357d985702460a678f01d6cbfee8ed7033cfc1fbdb4f039b2cfdb5c70f2ffa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a99354fafd66bc3280445c8612c7b2fa3c1e41a1c6b6a70e23f101596d5b6e47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e365233d5d0dc5c8794ec3b4531c520d1509858c1c69a807c200fdafaf4c2b40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb39ca35576513d1b4ec84a253cbf930bca7090c62c9ed92fddc4d6ba8b11281
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3409627a529b4e7e6099179c6e17da71452847d969daef7d45503a9a4efe2987
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a11e3c188ddb02b22de9b3533af57c9229ad28dafe295956a6cca00d36a78bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9c069be7d4e0945613a3a342677d462cac51b13513c4cafefca27195ae1d936
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3958258b8e860687e500bd98a4422097f29e089a58f64de495a9bd21008ef9f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8639ffa38db20422898a03a639256174ed906f44e4d5040f88983ec0d0c7797
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4e6f08ad00fbbf1362a7ea38127069cd4bdf23daf98e8900c77dfd166a3c2a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31cb9da9573112efc42881bdb799f0ceea5cccc3fa1354f3a36ee3483d5c7623
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adba73df0d12ef1f51a8680f2877a9cff759d29be8bc6784f4b9ce684674050b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2df66ad5c2cfa7c8f5bb3e038a53810565a69132e33db02b2bc6dceafe5294cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c8d4bc86b5b1429470fcb91c33ff843e63b450c0bfb147a443cda3a238ad220
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92df3929aee3dc254318b91f94779ed3fc57f8e240fd461e58bc2d9bfee83847
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a49f7ac9f842615e3d79ea67d1e2e0d6ffe4474a0dc513c21c0ecdc7f660bc48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e862b7b72cf5f732b13185704c468738419ed235ef7731dea1d11a9af707998
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f773b46a0e52abd0873d199321931d0ea07e4551c1a893c6d92c3b75dbdeccb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3b4584ef920044278315d730cde6d4fd939dbcb25ea3f4daceb77a3604a6d3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56bde16adfcc54f579673b10991edf871558a39ceb9fa2c76e94ae7c0e8dd92e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f8ef6cd826e0f87c947e98e914278412d95b97edd2387969228dcc60473a856
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e237bf09d017cbdf386e836cbfb4913654deba5c38b3d6d6a3508ce574a1eb84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46ad28fc85b9c6f5fb75302522deefaea360f90b05c5edfba9c83ac2f12ed4d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6be52d8f420033e7f847ca53d0f73f9bb5ff5b85712e5a66cb1ca84b5eff4db4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14ad77851fdd05a542d5b6c0aee597d4ead9fb079119fd2f9d18455ceccf1ba6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 475ed7488c62b16b0f59ea183eea122ac5bafa42ba82803d7ab279ce3ef5410a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 986df286cec4cb960fded491b408ebc862f738f9d0ccda27300e10e5ca14806d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e7cbb0749ddd7703859f06d0771b78762b2fa1c6d4aadfd52aaed892b5c1be1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cefad20dd6fe51db6613fbeb155ab011f07b0615e23e8877d9d3e019d6a09b52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a6dbbcfc16753ce01daa323ffa12622083a3cce8b8ab29a7ebca478de462a54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02bcb137525f7c8bbf987203db99256c114a623716ca498062bdd32b691efddb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10e5c8ad8a677570b690c9651d4fbc8a33e32dad35bca94d42ddf1faa19db946
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8428abb916a3d65da716de1b9249f6d3d5fb007ada5fc12df1ef31585282e55f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbd7cab169b63f6c5911a3b9949d2ffaff8280cadee906ea04e55d1575510240
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f10d5c9e7ef7770b672265c38c196ec1a20071f6e6adc9d36e2934809e98302
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 324e50ac954ba2b855e54aea33c28f69be9145a8becd42816f5f203dd62717b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b9a9cbc047f97cf1a76f3cc08d84b0a4c0970542136b40353bf31e6359a665a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6ebac36e8ea913bc20b038eff867617cc1b49a218ffb2a2387be56e5ffbf6a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7dc51b087b4610334cd57df87510d942c09865dbd019d7778707ca664de7e135
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e495b71a4382411900ac8198dd46df4e189ea4d63674653052cc2f771613984
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20ef9543d90f1e3cb32da560365728ab9c02dbe2f9a0c191384721a61565edf3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46e30881225cb095d3d4c8df5299ce5a9223cd1284fb0b37d466c3f0c1460534
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6d848af05e314c54e954ef85595113193f6c446ffc39557e0b6bdb1a7cc95dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0bff8460ab239e075c72864e58be4cc3af7a423c31cb2af11afd3d416f3d8520
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd6aa7b2f3982c783cc8cebf714ef1e702fb82bbdca98cb54f65fcccd4920e13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a35dcbd55c2185bb0b55e83f7b7fdfeea479555743e5490a58f6e056a48053ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6614fb52a89bab56970b3b1208d55db3bb80c79163bbd5a7afde5eb9fd3b4c43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ae314d4031ff9fc30c7e6e188e2aa4c687210f208774011547c844e9b822a7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0887ae24c9ceb4226eaf50bc90c8284a6ad48eac5461ac64399c2133fc9d591
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0d8fd1208fa5b7e7847d4e7a448e134cebce003e317b99487120fac9e55e682
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bef85d67f4cd226a8ea3055c149e50ec1b124991cc18cca45dd69477ef7261b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe756f0507fedce7f355cef942a6d03767c0069e8ecc38aa21b13f490c72db35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8957ad11bdb652d308f96b1b882f8d6f45b2e5e03aee7cb2a309fb4d4a67863b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aebe4441bca22502d374184c72d23ad04564596f5ca363bf541306f6e40ced2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74d6063254d9d257b1f0c9dd135336bc9d0edddcc9e55510c4ed8845bae65748
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c3ffd5963e87517a288fdeb41fa138b23a7961a64935aedc3c2437a43c0385f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 140859d80d6ee21acfbde18b16cb5a299db4766ddd14c12e098a9e6cb3838c65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8077f6cf448b9aacbb4fd10a4b9300ec1dcd89a967ec8ee1e94beb606c9bbddc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 191d101d60489acebc3e2a8134f6a4dabe126336f2724e5af2f716414631ed4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 784b4d7d7f6114ef03abc3f2a414b9f40eaa922ca240cc56e585d4f4804ae946
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec67313b001caaf49783f6ea4d92a1d6873c742ec47a9f7451941aef3ef42489
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 388452967f869cb3e73542ceb8af3eb7e2e371d78b5433f6ccd06fd6d89be67c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ca52de3837ff236536f8bbe5a55535c0ed7f1cf3bee0149d461ee11af551e8f
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 649KB
            • SHA256 3d1bc5b5462fe94a97a76643bf7477b86475beaf5ae819963ede6226fbe647b3
            • MD5 SHA1 SHA512 SSDEEP

            memory/2396-3-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/3436-678-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/3436-11-0x0000000000610000-0x0000000000611000-memory.dmp

            memory/3436-10-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/3436-1987-0x0000000010470000-0x00000000104CC000-memory.dmp