Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/04/2024, 10:11

General

  • Target
    f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe
  • Size 566KB
  • Sample240415-l8a51sec6x
  • SHA256 7a6622649ae3ec1c2b84091ee63256c3f563f70846ea510f77d9420168bafa6d
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • x357x.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3488
      • C:\Users\Admin\AppData\Local\Temp\f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1612
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Modifies Installed Components in the registry
          PID:3264
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:4416
          • C:\Users\Admin\AppData\Local\Temp\f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\f0cf78ead16c6b7577d705770a0b6ffa_JaffaCakes118.exe"
            3⤵
            • Checks computer location settings
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1072
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\system32\install\server.exe"
              4⤵
              • Executes dropped EXE
              PID:2232
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 564
                5⤵
                • Program crash
                PID:3036
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2232 -ip 2232
        1⤵
          PID:4148

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 8fc38f0ac94bef3cdd3e0098572869413c7399b093910ae57e980604d8b1811b
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 c5d7016f097f166d309431e98dd87d9768313bb369c63ca2fa5a4dc073737cb1
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30e502924a52ea336534557068cae3118dfa47671429cd7f7b9bc16a89dfae94
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e3bb8ff7523bc8614cbf587624af31f079ce9259a3c45bcb5cb629d54712a104
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01fa6549c6cc30ea135082c97df95a05a149d39800e46a5d3fb1791dbc0e6e18
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4f0f9c81c252a048f1fcd3c324722f83abfedac5ce0ed486c5c14e6babc976a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f43c28a69c95d666c62b0fe8c4dc4e3eb23fc5264e3d9ea102e3234628556e97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ed03738349b6ac450217c5e065b6485312375279a4c218d0f94f73d701b4caf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0da9f909efd167a02a2cf80d4ecf67740cbfbf25448d079d37d4cdac5f19e301
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b571276a4c9ba2d0cf5f752e2d4aa0985f69463277a00484b3cbf7ce7ac485d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e118eb87b578e02cc4d727f50ed66b0e48d80921def50a9df67bd783c735d090
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9526c1e4801d1d80b285da2feeacbd0ca150ec5986fe9c837d79fb3b1d3d7017
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb9cd7a7b9ed21e22477d3fc89471ad8b2315f3a4415980120ae39c4f7a96b3f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a43d07d39e7bdd0f1b3a900bdf5c3f0092471854f5efaace302a8e465944dbe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc8a2eaa4854c92f74a6407b253735a5a7ec3d4ae69f37400d77f383a0d731ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cfe083b1c92ca7345c6f845936219be8a9d4917be03ce2ad9737f7475e19cda2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c51a64080b24df8d7ca5a0164ffbf2514b4e53625d45a3289a145c01d64b17b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a5950bf85f61d414ae7204d6359fb1b8f5bd3c1968ce32f994c3428d4b8e964c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b27f4b3ecbf6a2e7fffa016dbab0b65c5917428b8716fb30c88acf44cda9f6a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c5063a060345866584cdb3c85d17391b9e2396545b6b1e3cb2f574a42d2d954
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9d69059ab075396517d96bb22b381dd702c5ad274d304a49198faebf7e3487c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fec18bca188a093a0ef232216249275ce144fd4972fc485ad60d364c400c8fa0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ba112769f114c0dfdd3a5b56dab6f7c1444876ca4c0a5bd5497c96c3716523f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ea51e40be6a97fd37a810c6330eada3df3fc37dc14d0c0a62331c22ff91fc72
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5d8fe1c124c6cc368a1f91d27f782d9323609a0e82f7573e3770b0502921dee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 150cb29fa86c2a0c11d90d8f2ceeebb56105a5d9d65d84c24783e0bbdecdc7c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d30b18f5ea878f8a66baf81850b4105cfe45fa9a5005c28c662ed839c32e62f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 652c940c4bfae440fca3e362977cacff6e85164d1a06047ce25a2e0146e5783b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca66c6876099e8ae77ebf1290afce00a4b57df946fb726a5f27634695edd8585
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54bcf7e75f61f787a188ebff9d15bd959cec2dbaa6c384c17edd5b9a9d9a66b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c2002441445d4ab9bcb0fb87743120c94c099ffc73971ecd4ec84803b8d8f829
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d32d76d3f10a89287911ac18a460f642029c48185917b316e917b0dd07a615e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b295518309b56d9e1b2466a70a87f422250c9a60c2353defb6cff31688046eb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6518e078e03e6e5a43afa8d319b5c6ffb6ef4247671bd020ca1717b491be1e87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 23fe4c14b1794815c9d8a9e4ca7678f252ca71b22b4207df18471142928c1ca7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e7171b7158e2fa7487c342ef2c1d0c08333f05b6dfd3dc22cbab04cc99b35b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ae6cebcf73f173410f21bcb561646f15d2439dfe7ff22c51913740da5c66ee3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8e99d335b69ba4e59daa52699f42df5f1ca665f585f810be1ff0099ca169651
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e2e4af18e6992a41f8832faefd4f324155720929a1cd10b5707b99894846e05
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 45658373d2fbeb8212e51ec5cabd5933699bb8eebdf366260a2d2c1a57d5fc51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab60529a30c3c28afeb8625292a1d9cfeac4fd8ea2e2d1f763d483486e137723
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd761def24149bf20c4492b8fbcacf0faabaffb8dad76f30bc6b23bd321e62a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28f2adf9912bbc5907d00314b97f941b708e6c4766ee316f5a7fd0a45aae8df6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2869dbe1ab57ce6068e189de42d033e2f689122e8dd930a97810a9ae759377e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc6a6fb4520269b936947512d058a64e7b936bb4221640c1182d4341bd6892cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6930724762f5df7a0bf647cbc57bb23706e73c68319399a9eaa92d6a610af233
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7864568789b0243e38cd2652fe906f5a119dd4b7c50fb9eadd1cc9be3bf22616
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc7c4c2be5962e3854b0570eba1a5af43f11af0f30d65f18bf2cca7fe399ed5a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7aa9c051132ee2561c921d88b0c480f663ca960d5c6a37bc24a267e0d4cc5c26
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9feddf4e633236bd7021a6a33169990a6fd51a167d5d7f1fe666600e613c8d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f9cfd6740423b3c3f8908b70b5e9293353ecd543bf894d10fb20ed49271f796
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 071a61b4910ce55166e866a32cff99dd753e505963de28470e8ecff8bb002135
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa645e7e01d5d63099e36d48d9f02608f202cb1a3011723acb036a2681aaa250
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1aa3f7e6a7da70b111a9b62349b7d351f765200cf1d7272322877bc2e9ab7f28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 50a5acb3ed46d31967f93b6ab27b752296e1d5b981825366b891c89397ff9709
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ccb01f4572a962ea9b18f58a86e4057c3185174839dd6044b928915e28b9fcc8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5e6905cc74753c4523c7c6ca97e8ba712b276e09e93f7fb17e8867e16f261bc8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3fb3f07e220112bd34a4368f2dd17a0b765044afc52335f10aa86519c3fa7277
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92a697630b24b4b2b21ff24853d2ecab5e8e38b3b079dc741184b4c7552ab071
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ca194a673ce2204331c8b774ec34efd5236dc6dc0c9b5b93899bfe3755a9011
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a46d20b8c80cccf756d34e5739821e9862b32398b2803dd3c2ea935272698b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78d8b05232da18d4a83f46919192897bdae0aa965c8e96ffbb157e6075d72f36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d1d06b953c37a331e7d3338e976fc29f16a65513829487da2dbe1b7a453a385
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55e86ecc91c057e5eaa1e1f049a9b72ced644957e977060abe82519f804912e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53984cff1b3ae867ea329a035c3542c76ecf3b3aab4313d71a846c071b84ab30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 481d36d0087570acca942cf655714bd2a374ee359d02987144d5cab7b5c07518
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 90526fd41a8b71ae446bb70f650e57be58cc5110655f7dba9b477f2d5f5a3010
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c357ffd28f970446b31bef24499db66c19197d6c312b4bfd0bb3e931dffee19
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6e07ebf6d521bc2721dddab64e2f27470bb9415afb5a58cc83d0400d38acb15
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0990c121dd603a82a1647568dad1c0305c0c8b4682d2be1516fc94f51ca0f41
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 551ff6ca71213742676aa79bb62d07c10b26fc79608f8ccfa655db8168ebfe57
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2bc0c2d4a8673c542170e85ca981f31acbadfcb9ed690cf035e0001cef2d02cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9727c0291698bc558472c628583cc9e63f0d57ce9cd1ded86abef013eb125cbf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b983c7da169e54f41be2173b9f1a7c65978272babc48eb76c0f2518f92a9fe5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 200a88bb97aa6b98a259dfaf8a3745e2f092784b064d6f4008aacbdee43db93f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6ea4a9bf49c271d5d331d0c4b8b937c9530f834d953681edd2b7eb464bb8d2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93688461b334f34b1aeaecb00d739abbaf730a9b16b2fd014a09211cd7931822
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33faf10f98063839821470ce8d8c799432c61549e8247e0ab23b00d8b56a3500
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a5311c3a2d38d40ab92bf5be6b9f619dc9289549330682e07d682737ebdbec25
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b18b873bc27eb87bd37c425d6d1e6860c580374031737a516cdad7109626994
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d97bd5d4a309d11e7981095815beb5a4f135d529120212fdbd41ffc98ff622ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4dfe30b5089406ce5ea5d5708bc5ba8a6c2c9ffa24610cce46cda2f5e7d5bd52
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6046d2ab5e527b28c348f0dad4e4ca1f6d23380ac2abead10c70fbfdaafa72e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e3be6cdc18769c695cab970f621b154f4c767a7dd374bd6bf3d552c3c2f19bcd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ace6af1d3273c62ca963e8c20e21264889a30b10132c30fde90bfc1e37bbf0e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6107357e300b8f6ff779b7fe3f09bf6df38570627ce437e4a078c0f95258ae18
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb182a2b9109e3f8bf381fa1f4c94e49227e1a18b43307b2b31aa5de3a4719f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acdf253be1d8f2975c3e910748694edbc46b8fe07e1cde1e8fbf3b7f1392fec8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3d0de8b805caa76ade9d51da948bee29d795931ae15b6afab3338802d82cacdb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7be6c8b221ca8e98bf598969c7d784645bbecb5e2cbc1e135dbb440d0d0b8ad8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 206a1c48d1ee603208d06b9bdad5acfc7a4bec7a4b6bdc6261afe7b00c4e4fa9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b3a4ed6c695573a9520be58b50756a70d81ebe38246d9802b38bfefbf871349d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d629a8553ee40d11290f1b6060bbe9fa3785121486afad426a03f84c21bb15e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a2046f5c8f240aa68a36a7d07c24ea89aabe263f9bfb11c28825f97228dcb36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08482eaa1b587ff5ddd3c4f9aff8d24d4ac7c974d21758a97855e398f3551902
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a2ccebfc203e7cab8e45b409e8eaf3d56f4dd51b379d007a147f17aab3f08a70
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 103e25025bfc0d509e2622737efeb5bd466c7adbcb2e78987f52cb58224fefa6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 47c910d61178d7c491f0fc5928a055e786b93f65ecabfefd0f893ece77cff819
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83e6b6c560fcab05822ebd46e8c4a06213824e7117f3abde708cf0353d3747d7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aeb88923c1f4213b0ca5ea7d131ccf566cc88ab3a7ecc530f8685719ac7c92d8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13a0f9a6386e01c83b3b1cc114f9afcf80d955c70e4cd19d04afa9f77a641c7e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ae405dd9b27ed10eea9585f6956a1f7f516d53f7294b51c5f47802d89ed4a67
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 186556c35895a54e9f2f1766932a241b822a0eeea42669c1d53e57ac020fbf43
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02d643d2e2c1329bbaeae1622629cc3eb444b268bde0061c024de2d69643d196
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1216e36246dff7e73dd16f44f372a0c28f79e133d6e3363855955da04b716d76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f423d6e0433c8cf02242396a0aa1e367f2725c7a4c36f0dac506c0c4c2e8311
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad0e81230fa7b9e779449ea7ab856587ff742aba903fd4f8be29d3e9175c547d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9879e92ccf81737193be2dfa418a4ecb4d0973aa270fe3112bdc7439923318dd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc32e55fa9cb42aeb62c2e62d900560967f7a2d2f136d35c3ed8a77492806b4e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60eb6da6193df1f4702ac564325b15b4557e8116a1131adfe0e3de0867409f5b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b99739f79d0eee95f11daf95af50bf81a11099e3a60e4a9ad159fceefcf3e6b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 51f6df218502933f409d120fca5d703de2e74da41c63ec3206fb58ebded08b18
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a0c772912ced7c58be7f8b2b260ebe4f1f7a912b06fc6c67166b549d0e75d7e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8ee63a60603a674899b21aa1793caa1ad19e660d507216e8ca63b2cb1eb7a76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0638e65dbdb6a88b2a18fbd55a107bdcbbdcbb9061ffc5271c2b95ba4dea7288
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 adf5c0271bbb543f58de9def1ea7c4de7f09ca82dc2658b6d760ad03dc954a4a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ef4c21eee6b2f620123e3a689b7ef989365c6ce5e1fdbe734857f26d66f288a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3410d3db7b1e692c448e89ecd65e39f74ce6999cdc4ef963ac1dc50aa783cd67
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8b9349e3c4795cbaf422fb7b59f8cd76683541a5ffb7da6cd85f1863d8764024
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd54488ac2ac15129e39bc954dd75caf1da6ebcda551c54baeead4e0b9179dc4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ef464f7648de050eeae0e062e10958187cf2514db3af76736ab2677f76e6e55
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1ffc28ea13b72a0ae5ca9ee8637d5b770967569da3bb5810a7352f5c18bbc6d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4586168a4d8b66bf5805239dcc9269f8d6d2cf5af3861372a1c16a9a0d24a232
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a7460ea24faaa6813bfe15cc428221e74c2c46f54a4773ed92e2468e7969dae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d9d3ef5159e1c9d5a3dc3254ee3fe2419e9ceaf3b02aecbdb98ce9ba4863b047
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5b9a96a913191f4ca39bf356a5fbe807f2d96bb79f17339ef5484b77169cdbc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa2ea336e4541ee9440800d665b2e93cf035455326b7e6d92c1271ebabf68e61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b41d84c6a6ec9e0027e617f734a2c7e83d5de893a39417b2f2cb918e2dfcc2a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 51f666030016b4e5726d4a64d43aa50812aff02aa1e30f4e8aac8976d194bde2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b02dd40bf3f29e62aec415e6b3887bcfac86e3f4670c2434311cfdcb5b4d22fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6ba90d81ec8ad7b3825f6d3e2de01efd55278436abead44ec17cdc3e5628fc19
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8beafd453727b79356d65af349942870ef2ffeeb5e6b1c9f5a96dfa79a0934e5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acabf51c4dadf33ee28401f9632c65f94c7295828c55f5470dcdac26e95e350d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d407e82e0b4aed839cf0e8f0d5c5bbba21946dc31a8bd484e09474fd4681a034
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b4e57bf56eadd6bc97afb7b609c75440a108d504443ff04aa76cdb6465add30
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72d87ccad1046a0274569864b50829598650c745e375f55e8e720fc509e17ee2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a784a2857d00afcf81abe242eed56a1469d9a12437c2df831cb9777febab4ff3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8a79c91c0e62ec9e3e379af71e4694693714f8add99e3d8447c0b76b31bb428
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57991b84c99e80ddc0c02db8d7d5a8d16945d4222dca69f500ccedcfee2fbad5
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\install\server.exe
              • Size 566KB
              • SHA256 7a6622649ae3ec1c2b84091ee63256c3f563f70846ea510f77d9420168bafa6d
              • MD5 SHA1 SHA512 SSDEEP

              memory/1072-138-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1072-1469-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/1612-63-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1612-3-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/3264-164-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3264-7-0x0000000000150000-0x0000000000151000-memory.dmp

              memory/3264-8-0x0000000000410000-0x0000000000411000-memory.dmp

              memory/3264-66-0x0000000003330000-0x0000000003331000-memory.dmp

              memory/3264-67-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3264-68-0x0000000024080000-0x00000000240E2000-memory.dmp