Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2024, 09:36

General

  • Target
    cb1349b01069f8a2b05cd70be4ad1ed1.exe
  • Size 272KB
  • Sample240315-llawqsda9t
  • SHA256 bd772e1f284f4766c9d15a63fc8558928f2280752a300422db83543d7b3d9850
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***server***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    no file

  • message_box_title

    test

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3444
      • C:\Users\Admin\AppData\Local\Temp\cb1349b01069f8a2b05cd70be4ad1ed1.exe
        "C:\Users\Admin\AppData\Local\Temp\cb1349b01069f8a2b05cd70be4ad1ed1.exe"
        2⤵
        • Adds policy Run key to start application
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1636
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
            PID:4720
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            3⤵
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1276
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\system32\install\server.exe"
              4⤵
              • Executes dropped EXE
              PID:1628
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 564
                5⤵
                • Program crash
                PID:4796
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1628 -ip 1628
        1⤵
          PID:2392
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:1892

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                UuU.uUu

                • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
                • Size 8B
                • SHA256 f027945af242c0b5c499f86ed7cab5fdd8422ba4f15172cbb8bba2b67b9cf98f
                • MD5 SHA1 SHA512

                XX--XX--XX.txt

                • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
                • Size 229KB
                • SHA256 6c1e8265bde64b6efcc1b2869a612e61651a0617112e574ac7e6044fd0c233b7
                • MD5 SHA1 SHA512 SSDEEP

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 76978147bc2fa45118e863d27cce63ba7b755cf6be837e6ac99a62843e5eb857
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f8273da2e9c51c9ad55e3abf740139b8810b916ce45b93a2033df2e7609d434d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5887899629b48753ab3d34cb4decf50b35dfaabb3cff95875a55896af723af54
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bc66105be74849fceceb689539f915e2c777c7ff00f0633a5984eddff3f0ab97
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 28ff60c764fc738cdbef1d1bd20dbfda48bd8cd4ce7a488113557438046c2977
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e90af9282fc23e159c810d4ff778f68bbce2c897e59cddd2479934bb14ce2f60
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 75aec2270135acf3c7791ae518bc6869d273a627b90ee8ce893c2dc7a36abfce
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 269a2cce5178cfc62ff98b83b30ebce3b268a1f06e51c1522fb22a0a002e81a1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1cf882e7524fc58baba44f9bff39c70c05362f64a5363387e241ec8a3e55cd31
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f71e244a58a4f89cc922afe59815d168f45de6db5512c9a17a9994066beda897
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 98b35d9143f211398d3227a8c0463e04a6ecf7c6f7b4ea965dfe2274f0d96990
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7008dbe8a783014614fa2e7421b24ba58ab66afbd69baedbf33310a6277c19f1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 dd555bef9d03014b004b50d05b9fdb3e0d9f4da7791e65d41e6b8a6c0f307032
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 32c375fd149551eb4bd1371f6aebf776d4362e41a2bbe6bbaa6af448b1d99031
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1c61cd20b2e7af2d188c0c7c091a7b18c5d611f4b0a7b550cab3c279f9427ae5
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ec2855531bfe5f184df2e766aaded8fe5ac01879236fd8bdba3c680cf964f444
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f5811682b80d68caaf37dbd3f266db2a967aaa4f9c2cd28b04873cd6e05edf9b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 939f57d26764ee6db3149286c7f3d97e7b18a4536b72c48967444cd1f83b6c3c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 bd2c1b0e865bc0d6bb43f16a84e24fa2bc15799f1331ba998fd9b6426496264f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0fa6e5eace4fa5dded3d8062ba60933182d2ef6aa54c0085f471a4af16aab3fc
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e40224546aaa8c1880f3ab1a6e1cba51fa83a9db24aeaa0d754fd6a435830e87
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 020be2f63568cf51d2ec73102be7cd124df613586f16ba08f6cab9dae0b89757
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 393c5104ab865762c30c77d3f6feae33caa21728c1d529ca1685a93d9d65cea3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5de009da941ffa6f69ee53b4a5a7fb7b211fd1fee74d298c1fb65a577252480c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a979ab75feb86c2fc78d840dd46907a3c0ad5100446c2a4e269a386c4087f064
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6473de2d527b3b7808deb93dc9c263443ffd5d52309f86ea9d5f555b0c03a589
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a596754e7903f7777fc3be250c0f37d9083d47ebc2d44af7723b03225033919b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2eb35bd5746a629d419b739946929434c7299b05347a7e880a1b2b6afb3d4b51
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4d73ee13dc4fb89f5d510a5c1a02c545175a633a005aa59f31fabed7c0247229
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b8e96ba45164678f2d7d0e3d1762b3d8e419ee55fd00988452cb83795a62757c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d240f53cc4f820cd08bedcdd3b1c28950fab7e06bff343fd67dfff66c4d51cbb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a5c1ed3cae2292abc8ec583f9837ea1bfc8f2acfa0bd91ea73b1ba4d4732634e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 32ae72b2f0748ffe6bc11cd3b8c31f9640444e69823e75d5db6cbc7c89d356fb
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 dc6b2ecb994eadc7aabd81187ce876509484d8459d3b39ebd506625fae5f2760
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 84fd5d9afa1450645e8fc69507440235506d0bf83de267809ecdbb3e699ed84f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 89e21f0de90a621bb6d8443a8f7530c9e355408f81fea26b04d045c3a5acef9b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 52fbe8ad65cf8f55ab64be5622f39aba93fed3c4b3b062615e198bc1ec56f1f0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 213ce8c357004b13148e652d3bf5dd9a869df1c698a92336d21e30dc58703d58
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b1465b0cac19d066418c9a1ea09217f5ffc02f137dd5c28ec641b1e92183b0b9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 248a7aef00c86aa64ad915c3230bb7e998bf4cf9fedf2a2c012e80e8dfcf8c7a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1aca5e18d6dda3bb5602f38bed2b03099c7a40c3d980792dc7c0aa2e7a480f8c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 845bc1d8022cf4b963fbf31704ae373529b73fa1e562d314369dfdf82711b060
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1e2fbea3fd57adcb8b9e2f26d496289c92aabe2eaa2c2ed18dc7052ae32eb834
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 49be3163dc69338a7779a0ed3f036956f8f6f16992cb8613a37ceb055aeb45ea
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c4f74475a35e0d94ae9c7cb80e8512405825d9f56871539d9c584ae1572e0b58
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 36f8f6adb7384b0ed98f58c237619435954b896a122454d2495663996f07fe7e
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d49c3d4e9d04643d10e0c5a1f0a63e3595da64785706c427da44a4ce72343a83
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 fb973c0ade777539e9136311cd770ddf13bef8004f76f9c3bba6181b3ca54535
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e0802268db2db9f52e9ef0422795a536a6f28b7b9029503b6933d07e558e05ad
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 aea93fa9da763e9dab89c9177dc80e0646783be31cf0bfd5605e7e5edcc20427
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2954b7d01f776148885cd2b36a21e696d71e8fda40908e6ff3d97a0cbbf624da
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7b8bf221b1b817afc4a491c6f90dbcbfef5095b1e5341f3d810a3cdbf8b6b733
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6ad36b12bf159c0bf185b2a2d6a76818d360f88845e2b69c2fc34da596915e39
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b0946b562e4c38967d5754d8ed84cf280cdee523d3289b763fc4a05aa48a1e36
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 caf553e2bbdea2272ff338e345260a18724de6e2944d1fbcc04ea198bef470d7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7601b249ed5293edd956661dbe0bdb747cd561ffad06ad57d419226a9138a3ab
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 785c6cd05ec62ca511c846c0ca92efa24f80b85ffaa4f27a9d3a094d2b6cdb68
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 15f069e8a96c5e41e0ce3d2303a50c37431abe7626287c9023877e3f5d13cd2f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 71047ce35e524fedf53da86c5462704b83a867f4f374bcd3cfde8b9f19ce5a8b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1d4e3b02d567559f73849e38c3e5c43ee2fe2f2b185276abcdaa33dfa437b92a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2bd4dbc17bdb8a13d08d3c97a6c5cd5f900d1d7eaa1f1dde702c6a326ac56fb3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 62e57bc5e807579ff36b966ed37aa4231bcf839d15ab52875a3d3c0e744beead
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 9275366149d98d4982a95e822382bb505040a25e08ed700fbd2dcd098b3eb50c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5b7b165676226253ac425de97635ef874574a0a96475ed3b10487d12bfcc2412
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5cdff8f7486decb333740b66cb1654cb25428bb9a988f144008cfdb56fc17cdf
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 85d4e2fbe5295ddc9fc87e2e6a819d400ed6471e72cdef301d6fe5996ece62e7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 750ca33d01ffb34bae868bcfdcf7d6c2e36cfad93d55c8800b8819adf6abfcec
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5ea2380c8a4cc6f07e2cd6d80c3096a2d6304e880c38a7dfb34f5046c15ee4dc
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 756a2c96233f2fbd84a91a25f856e51a15f6b6e8abc44c3510830ee04dc4a5c2
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2ea31168d0ec5993e54dd045e7aaacbf9cffa752baa113d4cd807fd4964917af
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 68eb2aeed655d66a0ed2a9c403ba88f0ad7ef932a69fe9911adb0c4c269d3910
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 51d872d25a216b6246babdb7a22d7bfba6e22c2989146c60c422cce4ead44aff
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 72ae2911d763691a7b1604cb479a01c43eb32d6d78f207a6f43bdce7fac4420b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 6d4e949fa744e98d95a346c0c76fb78ffa43b5e1dd325b442a55f6622108be13
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 75c4f10b0e2fc27314783c145b2b7f11bae98bb3d58b74aa0afd3a7c8ca78297
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d8bdfca03f61793363b6209d2ac4ff7f1a4cb71dc4ae202b82fb04783e32960c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 487695c708bc980a56ee40b7f1c5f745ed44c0fac5ac2a51a4eab53894af76a0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 70b4571e126119b7a898d3ff2c0cb1ad80ae7e0bc7c54524716856716c7f1fab
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 50e5ffc6f1755939cb82f099d4cabf95f7aaa65c79867e096488e023c16cb394
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e96e0589f64cc9c612fab736242372e6fadf77c80752f64d671dd6c3076341a4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 cf1087d74d350ba3fb8ae094372392596dc53bccf86e7087fc15dd947715d1b7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 fce70763d4b47db64302d87475ab3453b3f5d6c0fbfaba7b3c0060df4b9e93b6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 f97d8e5876a74bedf7b3caa4c8fb8286b04a51f2070d48e8bb3b1e9dad63c6b8
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b38539aa6655eeafd0f39443dd62d766a5ee4c49de8f58d80bdb1d678787ba22
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 8617481762ab9fe6eddd0150455ff382a1215db43da7f5ee4d18f986de1f2f6c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 86a562aeec438190a33d73e4539a6c9aeec31297493312dc0fc2d22852c28687
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5a333bb20425ddd13416db5160f85cb391e8042f7bbf60ff290e93640a4929c9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7eac3c4f140f550274c1af5ec83333bbe6ec0a03b1f81b0909c210fdf1c45679
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1494af1d0a0b796ac2263ec5246406e65fef72c1a0811095323c6de84abee43d
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0e015931cd3dc3cb1ba9921fd7d0fc567e23e8f011ae86bb6d5d1d1d0b332510
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a6d8cf0cd09beed5245922dde823dafd1a97bc08e78170a6ede52350ebfe5edf
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 111463c281212bc7787fe4ec941798fb66ea4e632352b6412a2e75f550d43d1f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0bb4811d98ee4e0e3e84fbfc945bbaef4da0bfac7730b9e0146438a51850ced4
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 21450ca7e42116ce7b7b8784edb5b687ea54a83cbdb9cb183ede3228439a1834
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 4743cfd247b15e62be3433cd2e45e971c63b60103cf58418e504a9689803726f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 824d900b1713f2fa8a8d7365a60212587e1f18baf8c5cda6217cf811b006d5dc
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0363bbbc26090edf5432ae818ed0f43e4bfaa3a727a52fcb7f0ea163cd613a36
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0751564309d57bc688a9dac0a00b0ef145b2fe03528ca3dbf50c7b4bb4120bff
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e2902a81dad7b5c856d92374ba11572ef0269d1a2ca49025d1d7a5725b16c2e3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 11a9b996ea3df4c773cdd01d3bcd7f545cfbb7fb4a11075e895ab07dac9f23e9
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a7a210428ca855c577d95318e3aad3870d0aa72bd457bee16adbb5f1ef4b9a19
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7af9d0b32ec6b00e8fc144490abf20057bbf1e3ee7550a46c6d648de615affa3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 645db820e669b4d6ba851e4b4e2a908302309d7b3fc94e2715cdd9e3c2a6dc49
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d206e9f0bfa2e645442e186e8efd5f5634fb0cffbd018ec7de708a112fc591b7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b4eb14401aceb9853558eb214e97d584adc799769e10741756e1d2a4b980791f
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 394e004c3ec7fd255f05c58ea24e164f98e85eb91923181aab6eaabb807dfa78
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 117ddd88dad0f50571980fb892db2e31c09a6f3eab45e68dbdbedbdc2d1e5569
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 abf038f1431dc72d14e56e05f38644e6c6c14f5bd43327e3fb61eb6a2a3287c7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0e78dd504b7f3285b8ad9ffecdd5b0a092104a6c5b289ae178b5abbf91bf835b
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5320e0580bba27bbf684bf78c1aef8c1da2b4c9af1798351e90b9518b6c5fc8c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b076f71e0c971a4b5a056ac0a1ea3fd1b951f87f0155775f0a6d3bffed046a13
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7a1f11a019f89ed1f00b56147fa5386d89caf591c0897deab50017ccd825acea
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 7e89f865079daacd420c42b196be624e33a8194d0f4cbf4e1c46b8227de6acc1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5680c458ace3f5b9978e5de23bc537219e1ac8c281464a48a562ce7fca2b5be7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 34e542e1a5a93500040082e2911a4dc1079b43e441b14341658b402bbad14e2c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5f1d5210ab522e1fcc446c8e1dfb592459fbb6d8625e8e40121767415477dcc7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 32a054dbaf25f792f49516b765f020fb5fed9ddfaa0708d146c957408655dc7a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 a80af6568a2dc7dc79e0c6e17f27bb45b6a1f82ee527df4dad0f76ddff7d25ec
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 952ef0477f1d551bf99469659b9d99e8282bf5d384bb6be7e5fe5be0eb9f893c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 0e4fb9d686bc193a22ddaa4c115da0f23e9152a44459fcb77eada3569e1968c1
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 41a114c89e6f0717b585fafe2e73e0af36a86e388cb363a0fdc3c61682f4d705
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 66c7eafce3c03e603c5106bf8a49fbb1e81ead8ffeb3ea2c7e470a7302759c05
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 5864210581602be1161f439e168e22ec6bcf273fa25a79f87f4225e7b2abceb7
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 e523f29dc4b1814b3c44bb40e2ffd0c4aef46c0f4d6a669f6b78f4974a30199c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 1d4716004272c6f7cd391ab1b694861619b9ff1fb51507b4c744b73b3236765c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 2d90b70ef6e2e9331c66f51b9630bab6cd7a91262c4191cd3dbc4663d2e18de3
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 124e3519805f4f38bed97a5e39622876a5dc0f525ab5869f6ca3f1f591491f10
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 ad3ce361d3fa1fded22841f4353f5481b954e482c631f2bbcc565f28b2529790
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c9c38624abe26471aa8a98bb55c0d5b6a45f7d6b43e59be5b51ffeaf7b82f16c
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 67c061b65801b69650d5befbf054f5b1270c86aaef334a7bbbf8282bc89a757a
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 b26b1897b25f583cd3140b3a0a0465024a0754b1a84648bf80f379bce88c4ede
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 169ebe78173790b2532401984728a5d58ad65db7794f011c377ff859fe656ab0
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 74d16e05861102f5faa8ba356a510d04b9ac1cd1c7c59c968e0ec5a823d804a6
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 d3a6b75f6ac31b46aa447c7302a2b951ae44e67b709252c06329c0970737f642
                • MD5 SHA1 SHA512

                XxX.xXx

                • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                • Size 8B
                • SHA256 c5bd7e79de94020781ec773b5fe2bb486217218c583b35ab5e53a91ab7226d24
                • MD5 SHA1 SHA512

                logs.dat

                • Path C:\Users\Admin\AppData\Roaming\logs.dat
                • Size 15B
                • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
                • MD5 SHA1 SHA512

                server.exe

                • Path C:\Windows\SysWOW64\install\server.exe
                • Size 272KB
                • SHA256 bd772e1f284f4766c9d15a63fc8558928f2280752a300422db83543d7b3d9850
                • MD5 SHA1 SHA512 SSDEEP

                memory/1276-1340-0x00000000240F0000-0x0000000024152000-memory.dmp

                memory/1276-136-0x00000000240F0000-0x0000000024152000-memory.dmp

                memory/1628-162-0x0000000000400000-0x0000000000455000-memory.dmp

                memory/1636-64-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/1636-95-0x0000000000400000-0x0000000000455000-memory.dmp

                memory/1636-0-0x0000000000400000-0x0000000000455000-memory.dmp

                memory/1636-137-0x0000000000400000-0x0000000000455000-memory.dmp

                memory/1636-4-0x0000000024010000-0x0000000024072000-memory.dmp

                memory/4720-67-0x00000000038F0000-0x00000000038F1000-memory.dmp

                memory/4720-163-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/4720-69-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/4720-68-0x0000000024080000-0x00000000240E2000-memory.dmp

                memory/4720-9-0x0000000000E00000-0x0000000000E01000-memory.dmp

                memory/4720-8-0x0000000000B40000-0x0000000000B41000-memory.dmp