Analysis

  • max time kernel
    156s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/03/2024, 03:42

General

  • Target
    cfd6bcae047aeb462acb0b20bb46d66d.exe
  • Size 838KB
  • Sample240317-d9vbaadf44
  • SHA256 23fac4121252079f0b431caed4bbf5351d5718456f577c79cd5229d6cb5b8928
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cfd6bcae047aeb462acb0b20bb46d66d.exe
    "C:\Users\Admin\AppData\Local\Temp\cfd6bcae047aeb462acb0b20bb46d66d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4792
    • C:\Users\Admin\AppData\Local\Temp\cfd6bcae047aeb462acb0b20bb46d66d.exe
      C:\Users\Admin\AppData\Local\Temp\cfd6bcae047aeb462acb0b20bb46d66d.exe
      2⤵
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4316
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1284
        • C:\Users\Admin\AppData\Local\Temp\cfd6bcae047aeb462acb0b20bb46d66d.exe
          "C:\Users\Admin\AppData\Local\Temp\cfd6bcae047aeb462acb0b20bb46d66d.exe"
          3⤵
          • Checks computer location settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2696
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:5652
            • C:\dir\install\install\server.exe
              C:\dir\install\install\server.exe
              5⤵
              • Executes dropped EXE
              PID:5832
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 528
                6⤵
                • Program crash
                PID:2628
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5832 -ip 5832
      1⤵
        PID:2180
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:2012

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 588KB
              • SHA256 4f3ff04c9614840b28c2c217b1bec230c8661afe7c11522dc4862daf56236a8c
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29642d30ed9db36a55b445950b585d08e97de78e9c7e9458186ae3fdfabf976a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56329d8bcdb450bce259d121a8e318c9c55094475c964234d07b9b18b1a1333a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cb2970d1ae32fb9674cd20eb7428904e5866d1d9e823327ce23caee3a3b4c885
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e26cd4c838075d9c5533bed4cdc80753301b76d3d416266ab0476a6cf6638e22
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 891d27dbf6d5128f628431177047c9f8337cc0f0ca68df989167ed85e81aa024
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 45ce3c52c6b6b36bf5bdacbe65bd87e9d9f32b9d4aad2dd77e50d62c83d2c011
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e50de55354cbd400ee33053526e6ef5d5ca345dfa9b30f14f3c4ba5a55b55db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b50d05c75cf55d83709c7afd4deac2de80c75b8367a8c3a0d51247f7539f2fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 594a9f0c3a489704d43a307048ca71a47a1b65c4d4cdb1f61467f8dc7a8c8526
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ecf7750fb907e1f394ec0a5d9b24fa0206f0f866d598a71b663664bbaf157a5c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1f5ce261c96141ffc6e0dd2f25ce3b757028ecff6176b6481e93711f61357a6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 767eb440f4971b8b2b26b3a1a395fd2cfccab406a6f26d7b64290a6f455c8535
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9aa44bb7a82698c8d452bd9b0f5b241a41e4a369333ba5ba27480891771b9495
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73415ad887ba351191523687411973d225de39f1f479c789b52b4983c8718b0b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0973358ad44e11538448ad32a021745186cf950dfc1976f8bd25416f00ff6311
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94e5c9c0baaa543897b205bdf2e58a533568eb2ec6db3813d8b583ef19a5ef7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ff75b8a2ea9761455302560806f8f8271e598e3abf1b0581bb5929964c73fe9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a09285ff552b7c9da23a0acc5a913eb56aad3d56ca5cc8e0b1288ce170da1ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a05cf4466f3a0858e6b2e0481dbf5b69c7a658ece52988d15a1875f1a0f59bbe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9dc4950a013f6984debd2f1bbf3898722e1ab43c465ad3b110693e06bd16fb3c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df6d115907b209725f4c25274cffa0316543e6cf910c0a53c9e2c24ea75c4add
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66ed0a24683aeed619caded44aa04b343b9605ff5675d5f2a905cdf759fe9f6f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd92c8ce153617f7b7c808d99ffe9be46597133ce01b59ce93e9571f7b93aa2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ad8f14c12bebb44ccd651843ad123fb9e79bdbff6aea8baf1e60841a8445a83
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec86b66b385fec063bced8a5554021e9951b24deb379d24c30a1a672712793c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e290894c11c53b4edb7b841171b382e584de6ae98faac73b0fabc52f41907b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b17239f535339faa91222b17c45c07891eea3845391cd6f06f8609366282e72f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53e9af2138827c6464886812c478b339bc731224ded0fcf2bae197482e654990
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 edf5a35b91d1bd848c3fb2597154e5b4a1c9f9da9ca825eea58016ca1e3aa740
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f1a88214100d623f230567ef8773a686a0b63b25bb6105bbc8987a3ad8a6dfb7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc07afb1b38d216f3b1f0eeb327b655f03da8857ce8299b662b254b265594da1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4abadc4526ad3354dd79b0217903eb10cbd96f2c25b2756635d5f72f93f4cf2e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58475b64aaaf545255c1129275a985b593c60bdb523c18fa57b1b7db50e4ea43
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0d5ce18b3106a687c68e17d576dcd4f4cc0fc996b0021b93b1821b892681c29d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 639a64e847adf4768c6e0cb93d32b0a700ad40cbf5ea201ccc2e0f9e56e3464e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef7f5d82936732533634dbc331e93adedd241cc7326a53e3c61b111c865ebc10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 559eb97336d00c0afb309fb4346fe99bfee31757202492f930073c539859a14d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 401199320485299b22b8d8a4caf0fb1cbe65942ef05866a5f9e70c2c7222a90d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a44888ebaa8227f50d57833a2e8612b88e172b1abf7a97acf15285f9981b53d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e09edc588e6a364544bf537184f214aada6a015c24fd5a725425b2a7c05006db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5fe3133af2360eaae1183d9d208b72f146131ef0d12f8b90bc96a6d766db9018
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d16ddc252cd873623426c544dcfcb27b28263e3c60b81be038778c8018a28bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 639fd37576c16cbda448bf39261142dd5c753d42ba99d3c518ab36afc57e2569
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7fbb0b79eefb8b7ba71d9b7c94a63ddfa4fbaf2160b2783242edd93d4e878de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2619f9be5da2cac9160954cd974ba564e591eb509dc55ac0e61d56f9fbece8f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c50fbcb91577dd4168e9e419c9e2a510630c199528a6fec8e110bfbe72972f1d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7adf73785697a1e7662234ca610321e7d9663a4ca401a1f21aec2cf98b1caca9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a193be97184452ef8ac1aecae82b9a5fb54773eb3d5eb3d39f7a2ec9fbcd45e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4cefd1d60e314f0dfcb230a7d1a99be1970560e554353cf7d7681b38675b4e78
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 64a4391c9ac2f69b9748ebf29be4b38892e8bac7b193ea22efb1ed2472f73b16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee7260b35bdf8c75e6c3868c203456f951716ada68a48911497d4da8d9ca1e8a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 95e21fdef67bec24c89d828a46e893d8928da564f4b395bb24076a8ccbc1d367
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e7c9662c82771817d812c298e1e125d09ffbcc78b53d4dcac8b880a560776d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58a4d5f253b4a580ab3add82dbb7be0c75415150ad9da97b833840aa6e175285
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 03b968ced3c6c99ad4da0a50182eb2780bcae442ab9aaa2d93c32b3365a94de5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a79e2312efdccbd906058e4aa3caa7f1dd0fcfe815884c71c1211b0f777aa315
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 017c97c325a58096ddd435d0b081447e0c6d6b4a1e0f1f977fdc2d8c50a9d601
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0f6a5dc2db294f3b1df15837ec70924e9f952d99f94149cc3b23226718dae32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f59318f7e9abb99b0c2b25a97b57a03227666aca1ee60418ee461aaf6ed8827
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c38162c289eca65f62bcc361e54cc2581696f43247da083a136c60228b51bcc6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 410e1485e306232ff64ff3093db0fbeddf6e882abf2372c131ce5e5fd5bb2665
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 057018854879ad2b5ba8caf9ba72ff46295e2c7693bb5e952a1031b69e4104da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f77fc5b161273f637b7a8df963a9b2caad7cb5d1e6d79d2a524a1a84654ce54
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6847de326f2355c52b3289287f9e4967ab145ad4fc07bbc910d61a1323a7cbcc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b11cfc7c723084ff44b5345378fdff75f0cf7dab91819fc3869058f4ec25493
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a6547b9648d1e0b233e12bfed737b184052b0f4ce79c93581c3d39e817de9b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd5074efcda6e2ee89d5210ed34fee3cb42a8605352895832955cf0bb5484cbc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60e3fc44db5d0d63425b0f9b0931dddbe9a6dc872dba1bb4e36692dfe57b1167
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4273e5ee3a900baf33c741e368af3bbd260e4936e95db8278358d113d555c72a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a35a43a78795bbd688f12609809d81b53cc7b49a24e2413c4b75a9537e597aa5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e88b9151fed037d32ea3432cf8f816cf5fa8ab5c8654764b8156ed2edce1640
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67571526e185b9291c004829db64eb8a7bc6121653bdf1d9f2b8ae5d21d010ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9051d3a152ceabdd0f9119f07a599b7fb255f688bdc3c9aa17da5a2a2e278bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 048dc0d2d0d3d403acfdaa391c15b216f0d0c5babd512d753ee8dd535fa1de9d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd81672f4c08631430c3909c40dbf86ba3fba98d93de737d114251f410fa1a61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c5f7070060aa2363e3b86a696e9d7651eb6cec6aebb2f15bb54ba263cbb9db1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b6b06351685fbdf857d5fd923305b811f092f1d5cffb51373ae4dbcc568ee455
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e37cf68c76e110be29bc4ebdfdb220006108442ea9a1d2d566ec2dc5582bd7b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c7f585d15a7f54d67ce14ee9e922f764456df25d37f96cef7ed99edc5669bf4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f44423640a5e4ceddf1802a1bf94dc2ac933f457c88e90755b1011b0759bc734
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ae93d0fe607ba8092a7d22652c10df344612e3291d6155165f3063d5860f698
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e54b7fe9fefabf353ec78c0f84f591aef1cf5408c0fee8046ea2a4cfb60740a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cbf12f5d9e8b495c470e21841776d4d856899ca71d7143bbaa41d336b45ebd47
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 505d63c81438a41c59677f16af93ed7bcc9e0ca8a37235021f84a9f09e8ab7f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b73842e6ac2066263d33d5d5f0cd3a4219c77259bad8afc791cd8a3ed4545c08
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 64afeeb4875bb69ec8f403f183732404002dd28ee614f0425631a929a3b0d081
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 18363beb3ededf8452fbb5dc9f87f605a5c29bbea33af61a353a08651bfceab7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd4727f224cd42d5beeb0d61a8580f6aca5c7b0fe9d256cfd49e171cb30bd641
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1a6ba92f4a6a8712c4a7d3cc91867b9a5c4fff812df7f567ddc57b276d6bee1e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 601df12d22a82b152fd3d571a7b9e82799f8937ab4f50d2980a160b3a2f68b22
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 790559559565650049ccec0402f7cdebcfe458c8f5e86c3f07a51eb7c471e751
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa016e9fed624e6ab79ef6e673b6286b9c211f5f4ce38104f62ee097754eddc7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6c5481eb17838b9c88664fec54b42eb8165b289c8b121dbe4066dc850587f0e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 495e7d2bdf350b9c4f6e273201ad5e1f73887be8b626845054ff5bd31f66e6ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ddf15320fb7f3a1613efd3db8f628a028f7a8db6a62121889d09138f87da7fd4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 47578fcf5d1b8121d7a2f0493f83306a9a79047b7bfd1aa3593e33355e5d5ab8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9ac309ac08b067472bd6872412a01a469fa64d1af338706f599a29261702964
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 340bf7a0df9361dc0f35853f088bdab43f97853f81dfb40b7b80586c28f7ef89
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bef26a4280fb8adb54fe99ec455c60cb1ca0317c5d685373b78428d12b108d6b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 336c1db7cd1503aea32469bd1be2e631983de3c4dc14984eae0d908ec2b8dd22
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7e3c776080f1eb810ef638397b21a809122b0f70430e5a3f9b9473398a002b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 457134be93a7bcd09bd20bdc8f4267f70ac5e8c3eab340084d456cf24c885022
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fdf57bd0dd8c47b668ae5c15465f68fc67b2a82bb82498daec72cdee44e91d06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 faf67f78eb23a9711f925f96ad6621e932528f1fcc5ce53cfdd010b63adde75f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3d380fd3898af90ad0d2a64d70a57588004321333a55da707d8990b568b1cfb8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e9e9e326be06817ba9d87cb2a1b6dc32fc7eb0273014c245c8c531332b72663
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0c8d1c37f85b3e708ea9e19c5561b47eaa0ad08e559c92ec0a7cfc560ea7a20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4773638d4fca95d011729cbc3651354325783dc42758c9dc6191a2c5efc8e33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84fb1e1fb835b5ea49dc761b8c584c181e12c3de9b665758aa4fac3e9b125e04
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85398c783070cbbb8043ec4a871cbae63ad857084541a423099418ce57d34b50
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1d01af74fc96f21b616a490c8908641ba40adffc214402added32f3e1e53043
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af9ca3bd1455a58abf934814d3b216744999f233040cb8c896add7935d3f1ee4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1dbe50dda786005a74ec33ea3637aa096d9698dbfece8b9907ab8b93d38eedde
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85fa164f6555b1a0bc0c5485d086e1b2b28de7d6c142a4416ed851af8ac60ccb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a566dca76af22d430658f728e6eabc20c3bc896b3fe90d72b71f486f448c7ce0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5a61e07f45e0a4eb9f6c6834141d3e06363afc86686a3f02fbdb07bec764f33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35392f183d3ac0a958777a62224c5282803d0f3ae6d1921e893d9d3d18d86906
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0b030311d97d8be1bbf5b18802e2096edcbc5251407137fa0780804ba3ad0de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c67107ea073392f9207dd7258138166648f37fb1dd9f6ac091bd3f9dd722534
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41d8a75af72d10e7d907fd77d8c694bf8228dd9af416c420d462cd4921c7d670
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5e55cea03b70ad63255c5aa173fa85cc8a639880c3cce26acb592ca80ebb439
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 41913e7011daed89527aa07d82de251459c1a4deecf883af878f35073176e3af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 37f6582bf583b1b132bb8ba4a13f44b7ca30712ab7f3f92abb605299003c262f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c04ca8c701f305be04a4c2f560b4d0a5f1b24181185aa9b2b19fd34a36e81f9e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ee0da4b5a3246ea51dd56e8effded32149a76e2ed80430ddd7d5a83f216b23f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31f1e374f1398805cfaf5dc210a87ced29d06811912bde59a0f5cc28783b4850
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2a19e46a44948120150f30ce85a2b51058f25fbaadd18cc2b103f819646c4b74
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\dir\install\install\server.exe
              • Size 517KB
              • SHA256 20a631ef0089fb170ff51aae3a1f1f563d03b8a72ad7e78526a74f1b6031fd30
              • MD5 SHA1 SHA512 SSDEEP

              server.exe

              • Path C:\dir\install\install\server.exe
              • Size 838KB
              • SHA256 23fac4121252079f0b431caed4bbf5351d5718456f577c79cd5229d6cb5b8928
              • MD5 SHA1 SHA512 SSDEEP

              memory/2696-133-0x00000000001E0000-0x00000000001E1000-memory.dmp

              memory/2696-134-0x0000000000680000-0x0000000000681000-memory.dmp

              memory/4316-118-0x0000000000400000-0x00000000004AA000-memory.dmp

              memory/4316-119-0x0000000000400000-0x00000000004AA000-memory.dmp

              memory/4316-120-0x0000000000400000-0x00000000004AA000-memory.dmp

              memory/4316-126-0x0000000010410000-0x000000001046C000-memory.dmp

              memory/4792-53-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

              memory/4792-33-0x0000000002C90000-0x0000000002C91000-memory.dmp

              memory/4792-49-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

              memory/4792-48-0x0000000002E70000-0x0000000002E71000-memory.dmp

              memory/4792-45-0x0000000002E60000-0x0000000002E61000-memory.dmp

              memory/4792-47-0x0000000002E80000-0x0000000002E81000-memory.dmp

              memory/4792-46-0x0000000002E50000-0x0000000002E51000-memory.dmp

              memory/4792-41-0x0000000002C70000-0x0000000002C71000-memory.dmp

              memory/4792-44-0x0000000002D20000-0x0000000002D21000-memory.dmp

              memory/4792-43-0x0000000002D10000-0x0000000002D11000-memory.dmp

              memory/4792-42-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

              memory/4792-39-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

              memory/4792-40-0x0000000002D00000-0x0000000002D01000-memory.dmp

              memory/4792-0-0x0000000000400000-0x0000000000514000-memory.dmp

              memory/4792-52-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

              memory/4792-51-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

              memory/4792-54-0x0000000002F10000-0x0000000002F11000-memory.dmp

              memory/4792-55-0x0000000002F00000-0x0000000002F01000-memory.dmp

              memory/4792-56-0x0000000002F30000-0x0000000002F31000-memory.dmp

              memory/4792-57-0x0000000002F20000-0x0000000002F21000-memory.dmp

              memory/4792-58-0x0000000002F50000-0x0000000002F51000-memory.dmp

              memory/4792-59-0x0000000002F40000-0x0000000002F41000-memory.dmp

              memory/4792-60-0x0000000002F70000-0x0000000002F71000-memory.dmp

              memory/4792-61-0x0000000002F60000-0x0000000002F61000-memory.dmp

              memory/4792-62-0x0000000002F90000-0x0000000002F91000-memory.dmp

              memory/4792-63-0x0000000002F80000-0x0000000002F81000-memory.dmp

              memory/4792-64-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

              memory/4792-65-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

              memory/4792-121-0x0000000000400000-0x0000000000514000-memory.dmp

              memory/4792-38-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

              memory/4792-37-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

              memory/4792-36-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

              memory/4792-35-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

              memory/4792-50-0x0000000002E90000-0x0000000002E91000-memory.dmp

              memory/4792-34-0x0000000002C80000-0x0000000002C81000-memory.dmp

              memory/4792-32-0x0000000002C60000-0x0000000002C61000-memory.dmp

              memory/4792-31-0x0000000002300000-0x0000000002301000-memory.dmp

              memory/4792-30-0x0000000002450000-0x0000000002451000-memory.dmp

              memory/4792-29-0x0000000002C20000-0x0000000002C21000-memory.dmp

              memory/4792-28-0x00000000007A0000-0x00000000007A1000-memory.dmp

              memory/4792-27-0x0000000000640000-0x0000000000641000-memory.dmp

              memory/4792-26-0x0000000002C10000-0x0000000002C11000-memory.dmp

              memory/4792-23-0x0000000002C60000-0x0000000002C61000-memory.dmp

              memory/4792-22-0x0000000002C70000-0x0000000002C71000-memory.dmp

              memory/4792-21-0x0000000002C70000-0x0000000002C71000-memory.dmp

              memory/4792-20-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

              memory/4792-19-0x00000000007B0000-0x00000000007B1000-memory.dmp

              memory/4792-18-0x0000000002C60000-0x0000000002C61000-memory.dmp

              memory/4792-17-0x0000000002C60000-0x0000000002C61000-memory.dmp

              memory/4792-16-0x0000000002C60000-0x0000000002C61000-memory.dmp

              memory/4792-15-0x0000000002C60000-0x0000000002C61000-memory.dmp

              memory/4792-14-0x0000000002C60000-0x0000000002C61000-memory.dmp

              memory/4792-13-0x0000000002C60000-0x0000000002C61000-memory.dmp

              memory/4792-11-0x0000000002C60000-0x0000000002C61000-memory.dmp

              memory/4792-12-0x0000000002C60000-0x0000000002C61000-memory.dmp

              memory/4792-10-0x0000000002C60000-0x0000000002C61000-memory.dmp

              memory/4792-9-0x0000000002C70000-0x0000000002C71000-memory.dmp

              memory/4792-8-0x0000000002C70000-0x0000000002C71000-memory.dmp

              memory/4792-7-0x0000000002C70000-0x0000000002C71000-memory.dmp

              memory/4792-6-0x0000000002C70000-0x0000000002C71000-memory.dmp

              memory/4792-5-0x0000000002C70000-0x0000000002C71000-memory.dmp

              memory/4792-2-0x0000000002C00000-0x0000000002C02000-memory.dmp

              memory/4792-4-0x0000000002C60000-0x0000000002C61000-memory.dmp

              memory/4792-3-0x0000000002C60000-0x0000000002C61000-memory.dmp

              memory/4792-1-0x0000000002C00000-0x0000000002C01000-memory.dmp