Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/03/2024, 01:41

General

  • Target
    cf2187817a725a4c640a8b6517dde968.exe
  • Size 292KB
  • Sample240318-b35sbsec2v
  • SHA256 4c4d5d19a3f6077195e85e931043b5e0d4f33da47f6a27f4b3f0100ae58c9ea5
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • alsiraqaad.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf2187817a725a4c640a8b6517dde968.exe
    "C:\Users\Admin\AppData\Local\Temp\cf2187817a725a4c640a8b6517dde968.exe"
    1⤵
    • Adds policy Run key to start application
    • Modifies Installed Components in the registry
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:1312
      • C:\Users\Admin\AppData\Local\Temp\cf2187817a725a4c640a8b6517dde968.exe
        "C:\Users\Admin\AppData\Local\Temp\cf2187817a725a4c640a8b6517dde968.exe"
        2⤵
        • Checks computer location settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:4468
        • C:\Windows\SysWOW64\install\server.exe
          "C:\Windows\system32\install\server.exe"
          3⤵
          • Executes dropped EXE
          PID:3564
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 564
            4⤵
            • Program crash
            PID:4136
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3564 -ip 3564
      1⤵
        PID:1412
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
        1⤵
          PID:2284
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k UnistackSvcGroup
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2936

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              store.jfm

              • Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm
              • Size 16KB
              • SHA256 1c32cc47069c3f1910998390ab64bd66efcb96ba507d4dcb79d9e4b9380afc5a
              • MD5 SHA1 SHA512 SSDEEP

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 501778dcaf08ddeb25689f6edfe89a1170c45b043dfbe9d5aad453e7b79410bd
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 230KB
              • SHA256 eaf89ffd74c61e673310e6b71720118d8f0855ee5bde3077698bd842f7c7b7a1
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 255d1e4e186b1845f68364ebbd0b3c04332493d280bd9e918ff32666d378f407
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 358d1d07a40d8bd3ffe5206e0aa2871c44961c9f2be11a96492b9ca026b9f770
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08e39fa44339fe73a7d38af3788298fc30d8eb795009dae4cece06f5f17ccfb7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 89a76536fecd818c29795d1f2e73e90e0732b5cbac858a7192ba4c59c405b215
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 989616e833d0b41c07a6ddf529bbf914d8afb1075493ff1170a9a5c608e936f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bfa2724f0851f53940e194656b0e5bda0ae36eb407c0a3717ee653bc91e91f68
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60ca667b34ad15fb3bb498904021a695c3c148b3fa32c52808ae189deb82f50c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a183d9fe05ba0a3c649deb5cb413e3f1ba5a5821e1380644826c9e40ee3da51c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e825bc50b0b07bc4bc067c33567c8ff237c8ffe5024810dd9145d23ad716ed13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eafbc6510e690256b3723630eafd3a062399c668289c87de6a351d2db5c2a290
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 881e58a4c7974caf846fa7ea5a1a7fde4b706c69dd6652663d52bfbb04eef337
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10304deb174a77d44a858ebcd31337ee4947e7ef41f4fcdf9ec1c83fbd6102f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f1c32f78128952950ec8113f5f5730910dabf95b9d68ab55f5d4146307e4ceb5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9cb8577b0908bbde738da43645b547217db4b37ccf52b5ffa577e5afd8333e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d6be4393f0871f095805afffcc74e79e8bfe66abca1b95aeaad99311ddff833
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c2faf88a03dd593ce09b9e31ed0371e205e95609fba522c3a41a1f033c380d2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3892cc584ebddda58889db55f0fcb025bb553773d5af10593d5b313cb42e7e6c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 19c3c09aaf88114512b11bc3250d31ce178f9c1f07d7e80c32ce45abedd4e01d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2458350fcea19024c658f9b3e0801ae17731b4bae65f8cfcffd30092ad3f7db3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1ad9181383fce520f4b9bb1f0a6ea89bff040080b1ef37b1e0520cb81528c68
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71117cb9a804b1231d5d2b3562e4cee49226d914ecba5a6a770c98995046d06a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8283f1f24a318cad30e90511951c89a00d8419cd0b9f04f32703489c07c46d9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 81c4b0c964e8359503ff29315308c1f4943dfa06f15f46830138dc6f406433b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0083b9ce09d910f6e4f4136509f582dab54854924f37162635e652760f95817a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11ba8ac00fb9ed96ee5c70ad81462bdae8cfb5389e0ba36a6c5f9f2d42ef700c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 822e5586f3f616d087c72511eae66304e06652651c04f3351d896a2a2ce63978
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec23433623f3eb26c8e35d332e8cfe769a9385011753a18453fe61f50c3fcf8b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfe779ba8c1db73874b8129b3e6cd6afa7c5f63cf12bfb5cc3584ae5456d105a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29e912ca0bb1dc20e350f2d8451fa7a1885fbabb9cf8c4e24e3ae281ed2e1fc3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9c6c22264aba042999c4b090961e2021dbb2fd002d4438c3cb14b75e1f61d7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b70d4c11524d4d58e3ea762012206b3fae1d05cc01bff626e48612e747328f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ec77d06e6216c84fbc00717310fc27738cd86eaad1e0d4b3edda379dac79a62
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a778b8ad5031b262ac5a3f24c5685e819351881d0c6ad363fc0a762d0c159aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ddded230f62fe5a646288ef034c44ec1382ee380c4bf90150bba48f2f971eb5b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b10f9964275e3041294f62ebaa57e243d0e481fbff57a99de67b193940ff0cb3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ebfe688df6a6619a9389a0b287957985710ae36b6a2a2427a9c91b963bd35aa2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad2bc68ed0f79e7c936e600216e465a3133a1ac0b40cbce45f401e6a3072928e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f016db156081d899f8b267d8d7ea35a08468efed12219eb32ae22079fad87b9d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f98c03f5ce84bcde2dedc409730d676e06be490a7c99352b239d636d3bc7739
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 76ad93d088e034b96d21446e8ccafa0cdeb99cd765ff0e19dd301f9f67e478f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 138f564b42cd1838f014083cbb2f92e986f996a45dd9f8c60b37c4d58afef583
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e09ae1bffe7a28c3770787b48fa7f9ab92d219d7376cd7d6d8a3f892465890c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e7fc828a983d498bb3e47f95bfcbc3f600ddcaf921110d7160f4ed43c65c0ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 adf057eac073c603215a61349403fc9fc90de7c3076ed23999fc2c0b4ebb5000
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb0827cacb8f05829ffc8e4af1a6a0a6d94672e7580e350f5da2390c7adcbab2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 904d7399def7b28b0b3f9c781bb4982a240fc87fc629ed1c09fdc0c9e742f60c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d19440718d7cb1b10594d7565d5130c8309c33f587a47592316c9da75760fa04
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af1c2f10538f14c37cffb556e4bfa7c13bf7aa6b4e24afc059ff00197d990fe6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a00c8c05ad9161c204ffc9a06e677fea5993e3f29c5062d6a4ef0d4399795c59
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c290944374ab2da72d3bb84404a66d341c6b6a8bd9e9da53deb018b29177d423
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2b8e5d6dab1fe3dca1fc84c5a6bcac4706867ea619cbf5a4ba808953a051c36d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 90354c52f742a11246940af7309518b84142f98e316039574153b855c2ccf374
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f1b44dd07766a53bfad45814e971dc3470b6de9a933016baf05094a0d4561be0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d3c5613cddf691631dc8d3035e0a0f8c2323315c2b742372b94105cd9600c2d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 075f6692cfac88d3595a24c761f0ef875abc4cc950d98845d8c23d2fd920a4ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11d168d77a146f15e9b2074eff8bccffe3e18c70a39752a9b606dd4e813898d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73dfa94505261455f683a9eefe0a4b2a82a065933811f66867fc5a46eafa299b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb944020ebfb6b3dd9aef0b37c21bf033f3fce58f682180a2d1974102d0ded06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb4e8f9d74625f473eb3374bb1ac72052d39866fe67934cb966e0175eca901ec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ef74e6a56b2f1184d94952e0e94d28d60b4eece8aae9ee4c5af2bb08a56bbd7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa050207b59cb26de52653f45bc41630ec3e5d32e9100fb4b3544104dc237a32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0df086e2dc7769399d586f0402fc48f9df572273a217da7a995a973dc81c05e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c50812c49669effab72ce2422d54a96f11b5bacaa98182bbb264086dc0c78b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c5f015411eb10f11bac8b311a3c44d837da97322f0406e2e8b0e33e98cbaff5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e20c12ca38fcee9117f6a65482a6ef4ef8e12bcd394e98a5ea27665176460e44
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ce0c23ac7b0fb0475d1280c2bde7f814bebbdc1b25bcdeb94f01e4701d4d0890
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 201ad4daee9bb13dddf91c1aaeea45e040ad8153d2dbabe485f6c93c1c305aed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e508a70dc715b68f91753e1431fc58540e63a1e93de428f0abcf7a8624fac28f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f4492c08a77df499daf8dd8af850cd736f993a3be35217f6bf72696c37fc0b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 488cdc836aeab4ce21128e23f62cc9a481f4164d6fb3f81aaf8ff5ea118036c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 176e2971bfdc144792dcd5451f254220ea34868d1712112588e70a1daa9d2fa4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d773ada84de31a3883ca71a57f4f92924b30ade3d19171ca2f39b41569472482
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5593afbb607f0da872c57d35e034ae69b7e46d6d3ae58d17456515ec4100ef89
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59b3875f37b7130acf9c1128e7993e516019afd31ec9fb4bc9c5f03642c8d731
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 327de10bc77589efa2c03d4aae90fdfd26583ade00dc59c1d4661c1b82d6fea2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9b0d9c6514d7b4caefe7371c5e49bb2ee3614319181a1f69c9753c20a12acda
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2956cb195c072dd607f60c9913e05fa1ccb4cc962f48746fbf3d12992b9cd37c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f16f033a4ca884ff6e3bf8513f2d3eee62bc4ed52e9d39d220bac09d5b7de0db
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bdadcc7a6581146faf60d30b0517a48a50d6b45373143e621fa0fff455a54c63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13e6eeb233f394246d6c3bc064bca04940a75948c7c48cd1041a34b054df3863
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be207cc7637a240fd850f27993c055a191d28bc48cf46214f833cbb345d980c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 39f9347518362c4d7704a6157c7637276f5c9dd82bbce67fb20da5fe8ba0792d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9bd34f09cc03dd8ba3d7fbb1812dffd52c3a02b20c51c9302ddc996bc0fe137
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b6bf31ee76f2dae9e1be6ece930961b859daf9f6e7fbf364359f7739ece49f98
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01f695e72b0b49a0328aa7cf55e66ef2004dfb252c9c6de83e0f4d3c31afcedc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d170a63b38eba68af63bacaed75f06db7a959f164bdabc56fc3b9b1f689b8ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c12c33d3f40cccf439669c77e9b6c90aa3a9c93efec57dcce04171ac04887f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b155dfa0cae1af08cdb21dcb5b97c428122ba7701fb2e58203509461ab4cfb51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da45c29b6320ff2396e2c54a11718b19efdfc009d7458bcb5ead42626d275a08
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 965dea512fd47febc19e92f69ccb1ca886d2ded69ae53eb0b7aabb57b9cb3352
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c452e7a9f3a433435833cab322ad8ef27b7e7fd3a78f5f6b32b3ed7154fd0d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4cace89f0d9b2e3f8860470e630a7c82af61c6e193889c3d302cdc416dca638b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27bd4eff09aa090c15204f88db4f6e21b96a86dbb02be6c4ba20f18284185db1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 283abc87385256c7ad06fcf58a26b7152ff2dd7670af7fc3577f2cdd870e8b1d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e93a6352a05febb8d62e5aad466ccfe40b15517925fa06b2ab3722f7b25bbc03
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10c215991102b9a985eb839bda52fbdc65bae179219c40d5b8116c4e85ca2943
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7e899173dd6a0a687034be4abdeaeb7388a456e407d3bf8625d77c44d7445b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c829f2efbaa707429cf28be72582389839643c816bf2884f6465419863559d3e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acec553903a5af207cf6170b096925c71d0dcf0d4d5b7b536fad8beaae969c3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 180d9b68045b7e49e8fad13ab641ba1f4bb191d5e809e5680353dbf573475f9d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6105fa76267e5d5c789c3d546c54259ed5efa5edb9e663646ebd2f99828eba00
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8730359d8a9a1b6f4c63a06405084cfbf0df3d74a4b1e665e4971f423ce5536a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f0bbeb7896cea5756372d5ed3837f9cd95872adb1fbefe92d0e6bcc010941d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff697b118cd13118f1e7433232871b66bf4a0709202f71d529b13821b392cbd9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f2c2aa30fc3e6e99ef04c0247e3ea29616222d4c59d95993fdcc3537bec688e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb50ab582cdbd27b46584eb9739f6c45833039f1418a5cc86d6b5ec2a888d46d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 824c46290388134d5163c860f9a11d00587bba6f9b3ee32824abe249456ebfd8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e09c3dfbab0184d3d71b4654a9aaa3cb43f613ab9c5c7cb15d53e6471cc907ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da0f86ebe8916e3c1840487656a6644843c68d139b6c08280bb8d9a38fd09a1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50f7699e75d8d481e736fb36a897712c0067fd36d5862327269163d993cf1c16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a277887f3d05e4254f8afeb1b9db8f1f9a5e2a3d524e62967146617167455c18
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 96f6b9fbc9e692ab0c9276a9a72df99df6bd9f2e2b688d9484364ea5ed518be0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c824e2fc569d11d476592739b5e4bc34b901d49789bdba9b8d8a143ffa0ee7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8683c1be0fe87b5c27cda14ee26d6024e6523e955e34a43254ebaf72de44e885
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9670dd5524bd30932c41103ee0cd4dc2c1f9bd45f437f37820e9f0c81ef4fe31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5f63a0cb1652bf1918c8f4f996e09c3a0cde7b19276b08530ea90402e444b83
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a636a0a30814a79f4d88005878f8f8610e625542e9b76dfd876833ca5a8d46e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 988247996248e259aa4e9697172ed40db0674760cbd6bd57b9b851a188ddbfea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 907c51e2adfff18577de1852b776d60e58d154c2637c4f5d63495785da8c5016
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ea81f644d491722b36f1eb601f935c6a52ed05c67918b8ae750a7f64664f45c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d410e08b8047824c696b324a877671ff7a1af25df43b3261de1bac0206849ae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd69b4e5a8ae4e9218d4ed402bfcc35ded165814ce7c5ab5f7ff32673cd42c37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50f29b0970a6147d7cb4047a110ab63d3c100d375816a9655f12f2001ad79a8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cce44c20095e7127a430b4875bc64f544b4e6eb6fdedf2953ead44cd02423739
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5fc7cb3e340d0c46272bf031beba173173c9a779c812f9d857529575d43f7ee8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 265db1d223d183114d52d54cfb16119d3e517b837714fec2be1dcd7a4d332813
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73858e40fc24cf90210ca965852fb5adc8ae53fe4c7086477d4cc71b60bbadb5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 637c274048e7f4a0f797aac4e90a96db12856cbb04eddc98ddb3c3a6feb38d06
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53266b1e71d8f6077d67a2b27ad56859448de5716195419e9e10ebaf4902bc48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f5cf3d709edd4dafa9a4b61e2e330643691c0d3003cc22bd1f784889e5d2284
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59826b750cea79361ad163b2a8b3f1fee376b3ad5bd9694831cae2955b05028f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d386dbab7f3c0f8da4e6e3777f397364971a68be8577f34023a40144f133acb4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1386e3cf268d0561a20a30772f326f42164a34a25b5e1f78ec72ccfe20d4e5bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 880f41ad830dad7125f0bb2e7fd035135277840710bd61b88cef2e6f894ada3d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a182888cb09c9de0f035c0b671a796cb4579fa489e997caa071946436f240795
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afd8c085c2a0f39248bd773019470a7a8840d73981ac76863425ba1697f0ccc6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e4726e4a43fe8b7c57eb2df6c8570537862c18178bc8be33e63bda68611ff8c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 082cc599f2efa40235873293bfe204ee1082b2aa0d492866d2fa51478e28d79a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 167c452fbb1643f3b2716fc058c58cffd62d94640e5c76c1c3753a0a67b78150
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\install\server.exe
              • Size 292KB
              • SHA256 4c4d5d19a3f6077195e85e931043b5e0d4f33da47f6a27f4b3f0100ae58c9ea5
              • MD5 SHA1 SHA512 SSDEEP

              memory/2088-3-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2088-63-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4468-66-0x0000000003CB0000-0x0000000003CB1000-memory.dmp

              memory/4468-1380-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4468-7-0x00000000001F0000-0x00000000001F1000-memory.dmp

              memory/4468-8-0x00000000005C0000-0x00000000005C1000-memory.dmp

              memory/4468-69-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4468-67-0x0000000024080000-0x00000000240E2000-memory.dmp