Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2024, 18:06

General

  • Target
    cc12fea61b3e3d36b1c754b521211e22.exe
  • Size 468KB
  • Sample240315-wp5kmafc5s
  • SHA256 10e36b0c5046cc44327bb1d28f5cc27e7b1f6bc595759ecade5d45f4fd6b24bc
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3464
      • C:\Users\Admin\AppData\Local\Temp\cc12fea61b3e3d36b1c754b521211e22.exe
        "C:\Users\Admin\AppData\Local\Temp\cc12fea61b3e3d36b1c754b521211e22.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3452
        • C:\Users\Admin\AppData\Local\Temp\cc12fea61b3e3d36b1c754b521211e22.EXE
          "C:\Users\Admin\AppData\Local\Temp\cc12fea61b3e3d36b1c754b521211e22.EXE"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4116
          • C:\Users\Admin\AppData\Local\Temp\cc12fea61b3e3d36b1c754b521211e22.EXE
            "C:\Users\Admin\AppData\Local\Temp\cc12fea61b3e3d36b1c754b521211e22.EXE"
            4⤵
            • Adds policy Run key to start application
            • Modifies Installed Components in the registry
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5024
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
              • Modifies Installed Components in the registry
              PID:1900
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe"
              5⤵
                PID:4844
              • C:\Users\Admin\AppData\Local\Temp\cc12fea61b3e3d36b1c754b521211e22.EXE
                "C:\Users\Admin\AppData\Local\Temp\cc12fea61b3e3d36b1c754b521211e22.EXE"
                5⤵
                • Checks computer location settings
                • Drops file in System32 directory
                • Modifies registry class
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:1816
                • C:\Windows\SysWOW64\install\server.exe
                  "C:\Windows\system32\install\server.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of SetWindowsHookEx
                  PID:4816
                  • C:\Windows\SysWOW64\install\server.EXE
                    "C:\Windows\SysWOW64\install\server.EXE"
                    7⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • Suspicious use of SetThreadContext
                    • Suspicious use of SetWindowsHookEx
                    PID:1128
                    • C:\Windows\SysWOW64\install\server.EXE
                      "C:\Windows\SysWOW64\install\server.EXE"
                      8⤵
                      • Executes dropped EXE
                      PID:3400
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 532
                        9⤵
                        • Program crash
                        PID:3240
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3400 -ip 3400
        1⤵
          PID:3120

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 3b472ad600506a23ebce0a949d22ff2c3777bbf25b727706fbfe45493256a19a
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 4902e5bdab56b783b4bf46f1f8cbb66ef8b12ec92224de5c36a1bb2f2fdc6503
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e19c9a3922cc410cc12740ed61efff10c2a0bcfcd6e6830508dcdec3b772808
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 37776f8168ca18f04a0c2d7404f0fd07e23a8cde11de7d47965e1e6b37e50cec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4b8a8dd30ce35bf351bb66863a297a992e619cd018436f0fd141b2e6be37c61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e181219a32d800e0de21f7365382bd7d2f33aa7c36c1e06a80245be0f309a5e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a5b1b500fd921c202c597102abf9af70bf240503a1aee944756c210bf910e1d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 deefcea13aeca60385b3ee5a717781ecafec626103a88f28530cbde106154d06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb53254e86cff792a4b2ca2b0cd58fd8dee3834b10da887b530f83d6e32dd606
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bff240fdf71684be33eb4f0591627f61d57e530ed2cc1cd0202e34ebd5b7b3cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77a5aa78e3c1c3f201c658897b06f15abe1b60463c5bcc05bf56564f445b3dac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02be7823602a5e910874aaf5bcd3278d7d8de44287e548c2360a5ebcebb63870
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a4f533d34cf11beb3bf2f6cd5f4bde25817c9f11cadb940c157396b937f48b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da873c95d2c6dddbd4dfc7ff36e9ad11accc1793f5cba170ea90bfee3fa7c433
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd0654e01b56856d615c3816a9a3a3077dc7f7e6212f7aa04918315fc50879ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8496a8172f2ec7da14916e20358807835f1b9b8267823c3d0f918f2ece239ab0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 109fe61ce38cd23ee8c563d9ddee171de3ad304613cc29ae2cc8b3289f47fdf8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c80268122ce72a1af25974c09b1976cdef8e86794798a88bc7fcf7d7bdecb64d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 838b4e99a9652d0fe2fc20dd1473bfcfa080fce806b3431a2651c841d234d961
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 460132b7975486dd565c4bacf8277ebaf9fbab4b13fe632e3e362b4d1df24778
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8dfc7982a296468aa53dddf03a4a40354815277cbe1ed56a0c4082dac3cb26ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 168a348b8fb383d14667444b929582e3953215aa04dd3df1a1f21bcc7997cc01
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29f2e4fb629836aa1b221463574b44a928c09e63ccb71d6e0cc08c2e24d8ae2a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2a00fcf2db87a45da41d547a232207bf6e0b63420f6fc7f471900a6f143b81f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f2b88bf0b94e2a336da43ef9a178c539642abb106dee90c73b8394a81852ccc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ffe2e22c459371e0d5e98b09fa8ff6c7113ce82386a583e2817959dd71a8713
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 03e244d83af727953bcc9033ba6c60ac16ed43a6ab6a49aeb96f7f7e554dedee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86df6f78092e985c7eaf36d4f25cc2eec3cb025aa0f693e1d4be4440717c4789
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0169dd3dac6e1a18ce8735b2b8bf2d155a8db6ed7b813f6b1bff9f4d77855df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c029d8590ea9fdcd939b8426509c43a4a02e011ec506c905704f77887fc5ca3b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7bce0f4339a85b1566b7664cf7f891e5bc79de7563d1d7945d767d5ef6e52fb3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b816a04c3e035930760c361d3798c74644ffbc7c2d1c28d0d5ce763205375b2e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e42674d3fe5da5c92c6efe7fba06e3e4749ee7f79b7741688407adda547799c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 023000bb9cec7b6ab19807ed04c7e36a96fe16d4079245c0247f1bf03770457b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c322e76276e94f36689ae3d4db2fa82c2e241dc57f7aaf8d8e826fec66280490
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6231d85bd85167808ab6fa650d20b36125159bca44848c86dbb63c78698c76da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d2e6c00a128388c0f4361f2530c3fd446f16f72aff629cbda978fcb8d80f887
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57a99117960427d14ba77e460686ef94c48a1d6d9b0381dea8902369d2d2d2d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48918ce3b2380428101a11becca3cd42ab3e56846187a4f9e026d05ed742776e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6e88eef994b1d228be199884bdd618a04a58c6c5bde6946c30777f1dbcda01d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b2988886e320c75d3c3110b9c2725bc6e62e989123870bd324068ef51dd23c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 123c3e32ed5ff14621cf0e7118543ec14378aab7e126f6915a1080753df86d4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab5022a2a5e28fb3184b6055b24289694ac4166c05b96037b9110000643f72ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b7dba17cd91cd86a69a0b33686e3bfa04796f9d09a86825cbc86f85d6fcfc32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e64297f5b57ab5cee70afd0131af7706b07fe243cbd6db1a9bef93fc6805c030
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69784a7edb1239de57d6faefae5675f76d1926487a15d1903f4ea11c3fd60d3d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4513357e1e28ea5476d73ad9f3f64d2f52442e63c0f624d1dc6514f42f9b3862
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4f63524913bfbbefc29ec3ed0e1374578b2e959b89e9f62f48654595169e937
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 68d3e7f483ae732c16accd0261d589ca1e99fae702c829730dbd5c77af750bcb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2eadecd44eee507e3c3209e53c8d875e45710a2c635f3d579ca86e7c868eab9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 966e393645d8e497143181d6bad1247ae1862aa4f9e5ea139cd0a3450c8acc2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f851f09d91dbbea330cdef026b75254072ac3a636e4db1e2a6f2359e7f575db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9839ae90d06d2682cfebcdef5549d94bdc016605cc7bdc37894eb192a926b325
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f85f8bb9734b08355c11f1edeadad55d80aa0cea50b4f8c2578ba849d010232
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7198568574252eb0a9be8383fe8960c37c8c2ae70c4a74094f58888cd00a4873
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 62cc11c96c0edff8427d7e76ea71f3996dbd1bd072da702ed89dd671317ed623
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57f9043704588d4908db333f59b6ec2958cf83679e829136555690a6307e2ddf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 658a42d6bd23b8a61666c865c4d19488e1ad852cd72b7ddcd5144e6c5c1ee144
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff2104eaa1e28cb88b21607c0560866f305661d63895739016a478b62a167d0c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a92564f0f4c26c5505ffd9888718943348ea59df599526b378930dd9848e2f2e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2919dc5418d85db67ddbd0730be499743306dcd0d874dd38038a3477f01f7270
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba25754c115a35de01f26bdc21be942fed515f4c99ae72547dd1fbbe9ff8ef65
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc58303a04297b3c8969d2225f59c8d5b6086221a9ace4963f0de268913248ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2c6c67dae1159c22372ee2a8f3bf1f915c64180ca0cb960143f4ede5aac1e98
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f0dee41ccf6d9ec020eda849d8c16c2f587b00ee65e7b25a3bf4901e0888ff4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 258db324f9b4475722d4cc34b54a02e5d4a10ad76a49907bdbf27bc6c46563f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 26bdec6f2d7fc69c7d165353e302b89a9bd26385756754e3b4da265010c5c22b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6db4c55c70513804155d5c123996142d0bb39a897982778296055f5b422c9eec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 478cef32a772722a389945dc5eea5bf9572076b97621e6b716da0410c59c033f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9ff6287481d1d7c3535ce3d7dba04e4f6b927c748aa41f43fd59372b9025af9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46baddbfab24e53c19a74dc3a72bb051b1f64ac536de71ee1c3def22f9ea76d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e56b59c9f3523407f02f551f08c3db79ebfaae8b1832b209b50f665a026971fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 39ef671bf7b4e57195e48ef16eb558fc31125352600518605ff1de5132cddf93
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66dabc0f93ea9d7b7ebf333ac1f07a75e5faba0eb277c6875d7908ec6667cdf2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb66e4baa55aa311f2248399b32e917646d3d6d603f483f12b45f3673c97c222
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 68a2f7490bfb7bf45097c575fc3428a3333f6f0549e41ce2374dc27b6b4598b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6fc9e9a0213f5eb503c8a15e3f285124ee377babb69a5d86324065692c258bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4bc1b452d7145f6d85ff43b89ad6be25db2fbab361210b4813a4b3cf177a8ada
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67f7c7d9d653386a42582d0c3ebeb82659acc30f99a9f0e3563c323a997b4e7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 540377b548df06f838b09118b071439fc39aebc84afd01ee462c21c3e70fec3e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b559ba67e37eeb9b08b8c18df0066ac6e0eb41b7a8a3f92b07ded4abaedad8d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 465ee903818a8c7263e0ca7bd85cfc4743debc4c39499c7c6081e17536d8b0f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2670b6bff7a08df427079c66b8ccc5b4dfbc121822aef712ad9a42b874b68263
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e545c2356792747ab9616f2badaae29cb8f7dec1a11905ea95b0188ac713a0c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d1f0ad1a73a4240b85c516ae4c2dc6f6861f45faa6be65744b8ca630c05c9df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb5ee637c6bc2245108f833e5bcea2807385ca50c9a3289ebf145635e55760e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e11f4fa1483e88dc01f23c28d19a1989af14a46cd3fea9163a2559f7d9886cc4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73f46fb1124ff161af6399b3ec60f439e33ee36d5208e8b30bcdc15ea3bf9f51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1821ab38c23d36e48762ea71546ff945badf4af2fc7b8cc1c6b90c90febd2e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36f56bb1460724994eb8096d2295514f45ab8f6c2f4991493326d91e59f1225c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2323eba12277bf45a1970ebe3aac5660cd8208da74cd9f1d697d160a9894977c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e06841803a028db954130a934a612a5de76ddfd7b7ddb7391de254998c6a11a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 675d527653278decdb6538e5605230c49eee2225c14c9422435b2d9ca65e375a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 328b7a2d9fa07ccd75eb464454985dfb133dd2337fe4bfd1f3131dd955a6dc99
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dbfd590117a6265a78bf3ed7d67a7c7dc09021bc084083887e07e35f9f2ecd85
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78df1a5920463ed432879d49c60b5b9dd6799a00331ce6644fe8a8a99eaa8d40
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 147167bf6a9797f504c52609c96f4bfd1ae500bd665a8b8b95a7af61b7e37107
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6107c98d607cd8dd919b4e77bcf0d604192f0608df10b130d1029f3a8be922b7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10dba083cc30ba3eb0cf420033a352487c36ba97539784b451e6b8da7d9d75d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b15ecf24a63afade500f36269a62adf1d611cfec44b1dddaab05245a0466ee2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11d3a8a3f69cfd17d2f65477d158be47cb3bc332c1974aa059784b2cc5ed2b3e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cb577465c16b14e35d3423e580e362f7ac12e30f56ba1326f1b49ada3d436e25
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c909d68fb66466625c056011a856555503a3783097a72d69dbb9722d12751c66
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c21bc26b7fd7915c0846841c52f864bd134ff2058419fb5f14cacdd605b09df2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f7565f8dee3055fd86e144978fc26111d67573d2c84eea037257b56d41b8323
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a4344860cd8ec34b12f2f4b4f232ff5ad583ebeeffe494c7693180776fa2a36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73c700744b2e1b5f619b7c11a86c0eb062115dff9cb5fc50cc85af3a4013fc55
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 553a54f10c7016b38e8188de40e4cac566ac2fd5bf17c0b656ddada5402f9b0b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7fdc0a1e15d6dbb4af2b59b90df98edd053cb7a16d401bfde533d876c13fe06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e37d5c5aa7038d4346462bc55d880a1e68709954b70704e4fc46711033c96dc2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 414d36ded4efece7bdfebdc5b3cbb503ffa34b159350a875b37a6f0384637872
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13f9ecbd3dd26f98b8f2cfa822c36ccfbee35ef05ced7e2bdc091053da8d25ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3454b14d1beffe42575d153f8eb8d660975d25ba57ebc28aee50daf622b3b4a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63f3bd1c26e0371e14cc9830e30b4d5b6a541d0c8a787164ad93e2e4acd297a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f22368b8d6ae53c34bac272c0a1720bce1327550b6dec9c91518856d4d5925d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16c75924b7c545db9b3d54b1e62a810f772e6f84b0410229118d357aefba1a17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97647f339ea37d2ee48d3fbad0ca1da94f82670ccfc0281f09e50f221a945353
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5f56aa13969e79fda8baae3b8febbc976441b7c8d424231680037b7b2c572d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 841a25ba208f01f075109e3040c9a69166adbaabdf5175f7961a332f97bd1100
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec566aebf825c491015e3e3fd1f46b51fbf0af71c415d1787c2b6507852157f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8aa5460bb0b68605ea19659167587d0701792484649d8a3fe47bcf7274b2be2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a42d897273a0df60be147d88718a4415ff7c62dce26b720a875d0b7d7efff09a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7bbdf92e18ca0baf7d3efc20de77dcaa163db79787f74f0e9cefebe409a2e925
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0ec16d79feba87a682314d1144de11e60d9efa67eeb4561b8741df79687899b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a4d91e2ce94c9a4599f25dbf85bede551260ebac4d450c63dd37e97e456d42d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d19e3fcb44947b255c3733b7ca53e101fe2d70e603ff7cda2c451d44743a5545
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e695a59e857e60132e102dd8c2bfd0eb96c475bcb096e746bc92d111fb96295
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f781b7aeb35025644cc71efd761fd1e792626a1be44678488b064c31a9128b7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4539d43192f1298b07eab4a7612b5faa5aa2fd66c509973457200d31010243d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da5e966ee813365a09fba8cab7dd998237f772ea034a5c04a1b1591c009da57f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6cb7fc233296084de748f1a829bc9e16fdefd12d32be118493ce5e551194fe56
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a63d853ade20f4ad4ffb4543de281d08da34d097f786cf6f824c6e1888b9c7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 155071fc3f7060dbfb4ab7d586b436628e15a5d809997243080cbe6b8fb7ab98
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1394efebe4507574d711ec899acd79a2ad3715020e04005e064eb069fe17cc8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c8f67b43634a4655fa6e6e0d344d9ed3a7985cc777a281051e18c6abb8f2b752
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1cacfe711de084aa5f60cbc27fb481000e978af582712fa3bfde2ebea66635a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d88a6759c7948058f5245087f80f8ab9beee2786bdd158ccac317e1c7e5fe9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0047eb0735b6fb41c028ed03d44d5a8b675631a47a36307659f42e4427e45bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 627d12ed1c1448d10039f972099122efcb2148ff7e785f37d6b04d81dcae647b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0fb02deee3e4a73533d610ff5a67310e1b759252ea62b780e11d7fd1280529cb
              • MD5 SHA1 SHA512

              699c4b9cdebca7aaea5193cae8a50098_d1f2fdfb-e063-43be-88aa-b9b0326295b4

              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-983155329-280873152-1838004294-1000\699c4b9cdebca7aaea5193cae8a50098_d1f2fdfb-e063-43be-88aa-b9b0326295b4
              • Size 50B
              • SHA256 4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\install\server.exe
              • Size 468KB
              • SHA256 10e36b0c5046cc44327bb1d28f5cc27e7b1f6bc595759ecade5d45f4fd6b24bc
              • MD5 SHA1 SHA512 SSDEEP

              memory/1128-182-0x0000000000400000-0x0000000000406000-memory.dmp

              memory/1128-191-0x0000000000400000-0x0000000000406000-memory.dmp

              memory/1816-152-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1816-1157-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1900-196-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1900-21-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

              memory/1900-22-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

              memory/1900-82-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3400-193-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/4116-4-0x0000000000400000-0x0000000000406000-memory.dmp

              memory/4116-2-0x0000000000400000-0x0000000000406000-memory.dmp

              memory/4116-10-0x0000000000400000-0x0000000000406000-memory.dmp

              memory/5024-9-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/5024-154-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/5024-8-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/5024-17-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/5024-13-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/5024-11-0x0000000000400000-0x000000000044E000-memory.dmp