Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2024, 21:35

General

  • Target
    cf2187817a725a4c640a8b6517dde968.exe
  • Size 292KB
  • Sample240316-1fl45scg71
  • SHA256 4c4d5d19a3f6077195e85e931043b5e0d4f33da47f6a27f4b3f0100ae58c9ea5
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • alsiraqaad.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf2187817a725a4c640a8b6517dde968.exe
    "C:\Users\Admin\AppData\Local\Temp\cf2187817a725a4c640a8b6517dde968.exe"
    1⤵
    • Adds policy Run key to start application
    • Modifies Installed Components in the registry
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:4192
      • C:\Users\Admin\AppData\Local\Temp\cf2187817a725a4c640a8b6517dde968.exe
        "C:\Users\Admin\AppData\Local\Temp\cf2187817a725a4c640a8b6517dde968.exe"
        2⤵
        • Checks computer location settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:1748
        • C:\Windows\SysWOW64\install\server.exe
          "C:\Windows\system32\install\server.exe"
          3⤵
          • Executes dropped EXE
          PID:1908
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 564
            4⤵
            • Program crash
            PID:3468
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1908 -ip 1908
      1⤵
        PID:2296

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 b8601fd1bf2edf3026c4eca69ab09b0e6b06d5bd45a8a772abcb8ea9dff76a80
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 230KB
            • SHA256 eaf89ffd74c61e673310e6b71720118d8f0855ee5bde3077698bd842f7c7b7a1
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19d2510d8f5dce6e5ab28890a26670c87a7c55702ece1a628bca15835861eb06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b7d7c9b5c03f9adb4480ffd4a9247bd8e8de392065b70675166b9e0a0391316
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 323e93bb96393f60fcc9d3804c52a741186bf2150ecc0dd57513b09b86d6a179
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6efe38754be45976b2e6cae00aa071a9a9f39dfe0c3a1f92e18d5232c0deb294
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75f3d152ae510f0fe0a2a1604cc71aa1be70bb704d3686f85db2bd39e99730e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96ac2406db1814ef4550b6ff64f88b4ac0179ee325bbba03b37937b7170b8b1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51e186485f720c201c503bc2d0950ab9844aac65dbba05bb871f0e986df88556
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a3f15f083faf8e9af6fb5daef7ca43656958ccffee017039d85d8441c10a896
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 415a63a9825a13b08fa2ff9e95491d98c4450af29863629b7a1b218aeea5baf5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae992087f80e143bdc0cac64daec7a8606789bd5e6487fdc5cd470ceeae93f83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af1278e8bd5a1c2da49bea97736531d8f216ccbb26d310464f31208fee3e423d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cddddaa45ff0478a6ac2b7fe5c0361bad160a22f933c29623a8d1c0706e920e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94ce0c752efe7c0fd3fb2a26192847f3d3f62424a172040fd08445eff0fdc6ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9033aba2d6bb4bf9b3e58633b4a19f78a65cfb2b7cf387717eec786df1dd5937
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b40ce0e56f1c5ce9da7512bb9e32fd653fac956f0f01045e055f81254bee43b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d3795d4bd7b845309820a3b959f9d4eb8daa81f37ca256e0d94c502c577af3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d9cefe308133a58cea049b81f2bc49449556f9a2d12a23a2fbebcb23a77e337
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b62fb68ae8bfaa964a2ebedb1fe1ee5715708c4fd790cdef8541152fd1d11bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98643a39e9717a898405ee8744a40cb06fd28d9fdb5a8ab4bea8adba1f0ede67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0729559dc8e461e21ef9e5313f2c0d9b84e68c0dabf4c2dec0660f06ccd54e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01f70ba735f4cf54b82c061ba3df13aec5dc1e00322f9fb61f5f726ab38b8125
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75a2253b1757614ff1b7898061eb399d774947b10030a5e2acc357c0e3c74666
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 361b2dc46712db79eab1396866b504795f176ba8ebbf5acc96c4d7c5aae94a39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8558cc67895d391d1344ddd7de2c2bac0faa7bd98eaf8db9497ab2ec5a11a0a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8529385a6d42f323d4a4a48571a44952d3dc8ee46170e84351e2c6961d6a091
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff978b6683778a5a02792cafa0744c99f2ed680cf4f471090537ab9b638e7eef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1055e40a2577da1c5b8b3b564a8471a07b6615da58ee5060b6ec90b50a14753a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4748ccf3a1a90520aca96ecf2c790378be96ea98087319149f21575b7abae06c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a0b1d577702e9486c5ba390fafae46c33d5db419fa261ec5c62cbe5bb02e033
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49f41387cf13020dda37ace485cf44ad4710e46761515409120cbef052ce4428
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3357d25f2e0bf576c25a08a74ec9ca59ff47b25cb8e7cbab21264380d1436023
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 265003c828ea1fb17482a73b2666f15cbf464bb5b5aab7af06d636bab38ed264
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aed1e221295bdc33c107fa509cb5730d0e63c43afc9ff1b7bdeb77c6ca080679
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0de0ab4b08a33a89d67fa78f3541a2c4a7241f6136955f8143d4f2f0d9640356
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d179fbc2955c9b78cfbbafc6ad43a4f8d9066b18f4cfa84ba873fb6d8cacb8a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9bdd82e586835e316da59ad8b73494ac9f2fcbd2039d3edc10fb14c4e9d6e358
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6cb8ea1cf5bee4a345cdd3aa46508c8379c2a33b26b95d942b21ef3966e4086
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0805a15e2a483cb22d167194a0dcb936ec9a7092f7c4f2d394cfa18b4370288f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7aa084cbd83955443612ca7e9844f7cd9eb1e04977357f0722eac7b8d48a9d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c4b013fcdd32108924f33de3c2bc82d615dcaaa29c4e7c196bf297ce4f65299
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87b674d78e1285b672a70febf292e3e4d2a53b1c4166d59deaeeaf59eb2e0716
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c62c2b0eb0a01e7b3180999f51a728ccccf9a54c6ad7a6e9018b939121ab868
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45ff5776ba8aa44e0f78acbaa4148575461fa7adce58741895c410fc300caf63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a627bd0547e30652546547a2bb0eea2f269c942a21369a54a2fbbe0bee91f0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3723d606ce06ebbb55e2349bfb497cf1a5e6fc99af81ce0591d77260fb5d7094
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0fa0d4cf0936f1a12c60035a99a6ec639fd03b529751cc43554cd4a8fb42f36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef68d44f94bba3e1c572ce587e3f08a29ad1618a892b458b02dacd5c8dcd2ec3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1cbf668fd0d85b2244cca63e15c43c51bf298ff67ba15546e038bfb0202198cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66d1c6281a16518f6cab0069116a9f4fbd456c0d559bdc0a463b8bdc60aeba88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 286adf2bb923134ec0d692fb2772fc6037b0a1dd0ab08392140c74ca6a7fd33f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9ff6610895bc31818a269a3daf3fa72b885f4f3e2dbfd7423bcbf8ac3437e3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfeaa672da5b5b2c09a40ab0085d50dad2044e71c17fc948a328a1fb196a4c7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff252ff09633783541894bccf75237268773dd48afcc5cefd1621b85e0ef5991
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5dc7b81d0660af75f1e966bc7dead62685383878ab9b779295f88aeb0e8ebe72
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bec7b0eb3001df9757f1850b48edea0043c7574d778e1e7c29ee27c19798f14a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e5d7005a2e31045aed9d821c53c4eefdfdb066963d9afd9fc818fe51d7e1249
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 022437643b5935ca49c3f43cdd71554f4b7b3f6dd3069d0f1fa191c4e8281003
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a915321a12ac79d1fa0b3171555e919495a05efbe53eadab96b4b5e7625e85ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e5f3ebbf4fc4cb60408eeef49983131ff8916f9e865481bfc624cc8ab29a4c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26a0a733b7c90c1fcba75c13dfebc9336dd31b2bae9b007e3b4e01a3dbffc931
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4923d549a9dabae8e26acf49a6ad45a8446ca04a41762585c78f0060eeffe76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea4371e1aeb4d5cbf9355491b7ea7a7d66ee9a4576a5e350bd8ab4f6b6cc16a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca14d51285290133ed38b13285859a866c91b24a3f76ef5cdf2d53b3e27193f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85b25344b079679f32b10c1f86d8caa0ce3898639ea443388820d21304d7d47d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22f242626e2ebd22c00e25b0c841bd55dc5a1beaf7de2d44d6c62800d485b2e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c504a7ce8f0f35bf36a64e71c4d54ef508da2b35a8474fa79c05398b37bcf5ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61c7f3aa13eb454c8d2478ccd2202814356cb4076d0c955997e30c8ff5d4adc6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 378fd02c75bd9f3e4bc8cb1fc7c91d89b7e95659d02a070e7cca31c9e1a6e82c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25bebbc95eb6e50d99aa5e89962c051861b370d4d7910392bf5678bdae43f741
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 859b14ca98442d8e8f89bf45f4f60f7add7d091227753c0630dee1801e92f061
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 615c025c06a096aa69748f1ed7b6eec9b98f0d3c8700bc206aee9287a51dabe0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52646e6402337d3f1dc68812e898d0e68ae672913c6aa67532d1680ee6126eba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d00a7ef6b9931f92e558859003e1f91f2e02354189a7a763c0e5ba45f77dfb5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28984c501b140311d59261c6cd73a65f3e807c8b7782d14d3d3b7b737771bb18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f29b9bbf67f33a110a0325b1d117db4e9c196ebbf6a9d28e26e370e7ade01296
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee66ec2cad3ff2b356121aa6c505cf7b6c52011bb22d9ae6fe9effe822ab1f82
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f4befe93931f3981312df5eb22f35e980977d06668b4883994023b2deee3a2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95479e1443072c023820d633d735a198b9b3c903f55bd9ef2f5f50b837d1c9bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d103c5de588e9c4e98e00c78f37ded27cce28e48d91eff222690a76badf84969
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 308674b9b0c65fb3e403797c4b4c9009c4f47e549e01f883c439fe50b7a6e1f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e9bc10433ccba6a777bec680bfba6a4a9868e50b82105f9ca0b5f8f8b75c41f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adc77a409c5a464f029b895605c51898e9e2a40d12c632cd84da913b82fa4a74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50a114ec3364c3a7ee03ef1331e458de3cff4fe899e644902904675683587c2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d243eb17242aa15ef1dbb112d3d5f49e9378bed334ecd1536fcc5d1ab59c6dfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e1f9d7e940c1df01c5905f29c7b9fb69d56149b81b319e28b170bfb29b466fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d60f069aa8969e379d603840f1c900be13c6cbee6180f997e13813d0dc620817
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0484bd779d05472452a5769299d857f6da20ca13991dd3d08dcf7ab4a185e273
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cd6f75c9c2c105a5d79de97f1b01fb99adc11fb662826200b19927d39be7401
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ce514d79f3bd9ddffc23d8ebd21cde3850604539e7ef6eef51303511c31a1f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1b2595282f1a03dad544ced2ed2026cd83dd28005742d9b3babae3992d7ce22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a40623c4d2aadd4e2d9229daa2cf03467dab931a45d94012498128437e54e3e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2b461464aa06e2b57e186174f24315a7efbae266ad102e6229df9bbc1d54249
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94d1e0ce6087af9ab91c40f1a42d82c54dbc77d7e49e9330ab10eceb848360a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7e564163913dc1811ee2cfa71bab24d8caa12c669b17d3d37aa39185621e154
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e595d1f56a2c41a08a95892056aa0990bafdad734fe89b2c102c17644258d84c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddbc4304cf5698fda60b87e394873bb4b37d3016477d355cb2d3cf9661351235
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df405d0f87228d23c19eaf71089117b87ba2a1d5cbb620d30e827e0e3bf342fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bb1002711effd9ca26523dbb425d5bb9ffdbfe2434c9f3c0b9b08246a0a38de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f757c7b593f150e1113e6671242f70ee6997c0aac451dadbdc401b60c402c6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2a005c408a999a36760d69ed4e88a0dee51ab0e6b61c95ca60a6ed784a1a2b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a26f9808be9094ab5a22f7a1a6e6f14337cf6eb3aa754dc58ef9354c21f4442
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3c0be7bd9ab3f2ef6d05af8ed444b11fdc7c776e78c1379aafa8984c2facbd3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bca5aeebb4d595a9b14ea6f23a75f98c15889b40d57399cc9d52ce18ea2ec384
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0dab1d82cd70f1159dea3330699747834745d5b41353bbe5b20ccf528dbfe465
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 861dcf746e6699ccb746f988bf429ed9199defdafe864444ccc873972b85cfe3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a26ef47b7cdd9786d7764dbe17a61003e448411a44ad14ddbac61345a3c0341
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c045cb1ca86c8bb2e82d377d0ddcd2aaf19b8622c45617f173449570bb3de1a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e975c78c6c16f0d3231de30650e343e4582828556955c19b1d002b5671286be9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b89cd3d583fba356a0b88c8df31a424a136ca395106c27a0d4e15add2bb77d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eba4989d407f4bf940093712cb30478a0674cfc0c8aba54f45c8c3d7bf9da80b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cde1ee04571bcd985bf0c9e92f10ffb9d252df77a96c88733da4a434add800c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e8731a1f18f24a5c3699e57db3510865722e832b5a37460abac2a68c6b686c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 238026f16dce56de4e77963d8083c18e9b3dc2c9fcba9a1ab4f6b41c3a8f3349
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5af533b99f497c2096b4dc2abdd5ebb7fec015860ed4c7875abb5b6b1c47e98e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51f53d5317de4fb8d71865afc025c21bb2724940fa97f689389de042ba0489fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0731ad225746ce26b1b08c94b1a078bcf25fe09d0c4939853f331438ad767fac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fd78119461b5a9d37c88dd5aa07d8b35bc0de90d17c3094e16ac3e718719327
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e20a632dcf7f7fb0fe32e5a602d2373bb62979367c93842a12ce1063f0fc9d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cd96904b4b11900348171fcab387ee6d5eb032ba8e2da00f1d03c7c420bca5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e83897d0d33a37fa4b5604e5c47343208b4fdc82a1e601ccecb9924c4a0bfbab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c87d4215d662b542ed55996b5d0e36948af23638d8c56ae08760c248b8007db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 666d2346e5c14acd085e609e216aaa7c9270cbda7e27657f5ae2d225cac41ec8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 927fc47f224be5ed134ad09802f9a975b2ef4028f90188e8684a7bfb65825a2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09f7697fd38466b8c4ae6ce407b2d38de838c4823108f0fc8dd2a047d4206098
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3944747caea5d51a6d313831e44c569e28fad3737d4977cc246474cded98ddc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f920978aa2361c1dd6bcd752aef3b464bb03161f1e03a74c343df974c3783abd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 616c2306ae1afa1f6c7ea0d4b8f6063efe7e66561436eb95895c68782ea81239
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db7bf5877e63628513ad385ba28994d1eb048389765b3cc522602a22d4f8a258
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7b3d407eeb3fafc29aee09e188cef0f43ad59868d34f5a331f2e5ec7fe1a5ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb2b0e0a287203c0b2a0c3c27ab57d582362949a2c635ab9a365b4e2da0c3dd4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f1169feadceb910ee8427664c06788ccc2098a428c36b51d2b32d9ba7af9d4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76f98ec5c157a916847a82e84c37e8e9d118fb52bf07fc7d4c13b335d21470d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd85b6da22018b61b84d2e41d038b060d7c0a97374eea6f6d409f5008d8327dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6305faeb850a7baf25b08663a2c2947c34bedf121dbbfa0d8f59f1279b0dce3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68fc880bbdc8b4dea2fd484fbbacf8e3e353457139da013a588b74fae3bc57f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2258ca6f5dcbfbe22eb11c8dfe8c07d104e5e68a2e2fde5b9e241dc81d7f4903
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53523de80ffe9939be6e4b20272426aca644466078fa1afba72b116599a55c5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58365553982dc6a1f417f971b6d2fe5dd5a1ea4c9aa25da4018609ab4b018314
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 136d18426b09dbd938688cecd4572571fb8f1649d429e79100be71c50c7530fa
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 292KB
            • SHA256 4c4d5d19a3f6077195e85e931043b5e0d4f33da47f6a27f4b3f0100ae58c9ea5
            • MD5 SHA1 SHA512 SSDEEP

            memory/1748-1371-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1748-68-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1748-67-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1748-66-0x0000000003CA0000-0x0000000003CA1000-memory.dmp

            memory/1748-8-0x00000000005C0000-0x00000000005C1000-memory.dmp

            memory/1748-7-0x00000000001F0000-0x00000000001F1000-memory.dmp

            memory/3044-3-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3044-63-0x0000000024080000-0x00000000240E2000-memory.dmp