Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/04/2024, 04:36

General

  • Target
    f50c791aabf7deb4fad025432966cb2f_JaffaCakes118.exe
  • Size 276KB
  • Sample240417-e8c62sdh72
  • SHA256 59b7a7ab55772b85310b57f8f6fd81afe33bfb68e1d075fa4160d25a1e8d78ab
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • moof1.no-ip.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f50c791aabf7deb4fad025432966cb2f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f50c791aabf7deb4fad025432966cb2f_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Modifies Installed Components in the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3964
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:4392
      • C:\Users\Admin\AppData\Local\Temp\f50c791aabf7deb4fad025432966cb2f_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\f50c791aabf7deb4fad025432966cb2f_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • Checks SCSI registry key(s)
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:4532
        • C:\dir\install\install\server.exe
          "C:\dir\install\install\server.exe"
          3⤵
          • Executes dropped EXE
          PID:4488
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 568
            4⤵
            • Program crash
            PID:2308
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4488 -ip 4488
      1⤵
        PID:3108

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 fcb07ca3ff0e30ff9926dbec39de233d538746a8b32145dbcfb164f35c130230
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 782b0984325d3a97dcf6d498736c8f1b8d0a272c2d1107fe7c931fb15152fed8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c63842d003b077dec7fac2d54d128785027cccee037a05f9267f8473883bb27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 090c3d0c231d0917ee4bd92ae37f719e980f6211089a0b7671d23f84b484fdb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c434a324f5f392e727828a889c114fbac760c4d9d9f950e72eacbf63f808c855
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef43450390157ff040782a8d06c02735341e68e17b200beffc569d489e2a216b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22fb8740310bf00bced429f33ab484d738aff1b256c0c5e6c9744cf95369df3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6136ce613e7aa1be2ba4f89302fed791c55bfddd12933e2ba2726c16a79ca51e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3eeb363539be36fc846956827c121a4f1860bc97b40025db70dd669253577f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae95de7eef4858d83a4394a858bdd4d78b805f611d2f88a15d1312f95082d86e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 622d8c17e5fc13b36fb63fd27670075394a1a7a38d6b94f81e81b1dd07a74c5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96f7a9305b98f161819f9d356a7029b11f44c45dc18eecf7669cd5d880d7c1a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a05589238836b645b74cf265741fb7ef702a6d63504117f103dc42abaa6ad65f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b4dfafd5a03902cf8547a12c6f94866c40f0ca23db68a2084269536c93a5ece
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 540e547cdf6bd4195255004910a23dab61b78b196e08ed0ae5e84185267aa966
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30db7d35b35252dbc9a877e03ff3b0d36dbffe71042dd790877bb6cc97629b5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b86963fb9947be9fd9b96e1e17ae687dfaa264ccc70e819d6634497291db52c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d99d221bdd1059bbab882dab7eb69b1398902139f41e5399c6198ef98d9d818
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ec5f2a5454e6dcfc91d31e68a9dad3175617e7df586d81737be030888244795
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 330189cbab7d8fb1cd44666926d8b2f58e28cbcd8637871884128c87f4cc530f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 011817e9161f9270847eeecc4ba10746072dd64c1eeb449093e8fa82483f051a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d6ee867fee14a738fab0681243935d32df099dc672ed5ade5afdbc6f429e0fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67b70eb90bf58aeb826bfe4a5276d04225210714773e35e7250ebcfd15e84641
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a871c931180bac126fba04b1f455b0bd668d28faa173b1b203c9568d529359b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e66b6d9f4c34f5d6507f7adc9e2edf225060f258053d5468410c925e3cb9ddd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 870227c20b711558b770e1ae6f741d56c187baf0f85c6ceea41e76e53d05634a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2cff589bca46523e22c6839693194fe0edc1cb9067493c578442787084ee329
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1023ec0c42eaf5a864aa0dd22eb90ff0340c4123c62d07a685f2d6191e5f8275
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea8b74be80a3eb30b1438aeacde806cc630f4511fffc7b00641ab500bd054f5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4d36e837dd09b307a8d0a3ee908c73ae5e145d113ba4ac6b91705efa2ff9ff9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83983e3068ae502137b330f6923c57bcba30fd92987223b90dced339686c1797
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21302dccdd4a104dc292fc0e06bddd30e215c527e39ea5ec099e37e11c28fb90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5487b98968dea83ab3a1143acada64c799e97d519d47b0f230871bb2076377cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5dc7bb00184930264fb12470d3f2b7fede9e49c4d63165a6638026223efcebef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f41108975f3c93180131872af537ec83e88071b3fa6bddfb0b29cc363d6585b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd7a3f771e3ded0b285ff027e29503068761b488dbe9cdb22e63bb101676bda8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b776823235e90842cca1a01306cb91edb34fa7109ae6b8b87313779e5d6b3bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4f331ced3546cf0dbe7bbcd4fcdffa4f8f0fee20c982c67c1e18036134365f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a086392a47ae2459eec9cf6fcab39f6b10cc06b4da2238c808eb3e305757e0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79189c900c9e1b1aa3e3df87fdc1fa7c56d680bb0e5b5b18cfaab84808786fbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce452f32b1244cae2d201b8f25d01396671df47630de656ed3704bcb0e7ba6a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3cfd7dce778f4e2ff2882b3ff26d726a7b3a9846563bb2045f99028261027d22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b1e712504db5cb385a8146bceae156d49af0bf26051a543720b2b2cab8d4af0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 276acae68150d39b5c4b8ce8acd510bc30e48961308e7565fa551823e515e57e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25b270cd07e3e50fa6bae60e7cc5ae43fef9d9354983eb97e3f8d839928aa492
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f813c3467fe8b85579ccd69c8524a7ade101ea093b89b4fcabdaa2c853c0a5a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c27db5a8705577439d6295f9c20cdaf59ab912fecc691b33b07f27295be480d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17ea43458f9ba54c3afdb0ec32462098fa0980449b94929c9763158c03ee7974
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddcf4d2948baead6e765da33a425778489706eecfc3630ddbad8e0d4529ef455
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b77da013e373e0320439b6aa2ac856130b70cc9c1791a03c41f7a1d249ebd417
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13c3aa354cc22467f6dcdbc7570404af239dc7287e98fca7cd8ea77bb411c7f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85da4fe2b8b71c4b32fa765eac43f365622971ea3701da1c339f458e88a79368
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3e946d1dc25b8a2fffcaf809fc91f445db266b683aaa4c483252bf26bce674e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08b2122f0e6dab959ab0c3a9da01613df9507d9a555c7646e12964b43789fa4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4bbe75b048c6bd93e35ef5d1d2fd5af7391e637f0bf3a02874d1947fddc74551
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1cb39ec395677fce4ba3cea9a40c5e8982cb4d475e3bd0b71967160c38b34da1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 869e9137e785a751b5432044120739f810d5c1e9cfb4843cb3546393bc29fb68
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d44ac19749840fc8422ca3032bd4d74430efb2d97ecfd37a4c8da579436f6fba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34403b25b87bdd3aef283ff49bd2e11bd406da28da38ff1b3a6656e7b747f26a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccdbdf2c445fd83d7b5c8224b3b0a210c8b4852bf4d62c1ab69a000d3f1dcef6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 206fdbde9fb21521ccb986fc479a0f8e6c1a9c67e0f1e5708afa0b9d9906e2c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d4aff78d884d1e53db309a218ba227b1c0eae5293d0d00f0eeba511a8619efc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1170ec9b9aa6f7768855faf6abf10e84e664dda50092959e590815f083085f16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e18f419a8d93be88dc159fb13b08f6516a9d7a065b7004c95694833e129a5b8c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88a3c70e6e8dd6e34fba4955bac61df5a70f8b763f5fd314eb51ddd595963c28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff3547834da0b4d3cc35710a9f5449b1cab2090c912c43f7befc0c87f2201d11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04c48c9ca62908d6001f6abb8e78873fb2b8e81d8768d9fac3e831265deaadaa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 914aa6902805b9677c124a7e5d56a54cf9a72f0c5c88ab8ec7b7dde143e9d5c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be0cf2156490cffcb4b50d7bc9da4d59fa08a7368104425efdd886fe4b20203e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2b27c53530a25df529264688ab6e60c2e50c37cb161ccf8932cfc8e48fbd093
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 955cda7d86937313f49f442a436fce6483b781d28d41909aaab022d17d3c8929
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c822eec51653fb26e52af104b658033d276ad06e52d2a8d3bee16ac373fa5c9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d334b96a0b58ba838fda0533b81dcbe06d900f870f6c157e8d2c360117e6b49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1bd4d5bd9fa7b313b6733f415f37ee9a8127c0bcd3c75d2e508a0d8d15ded43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4daf4898c391bf6656e07130645760af5855c3faee86f88a1c4151d4456d86fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 473ba9fe63c1d69c023b432a4f37d0101eb81712590d438162a8c43ce746c519
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edba7237c0c2e62710ce0b894a9d7b557252679e87178d0804ad04831e3b9382
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3556404ce52945f202ecd5c61f18c9bc92b48df824405838b617bd977461abc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06da4f52e0215d32aff8d39d61213d669c86458613726b14def3f47f00bc8198
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9d0e657ff033df53a993f69f303ba1692f56429cdd45469fa0049c0426eec06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e102da072fc8904adb8b7386a86807492b0ec5508b225e9fe3235e7d5dd525fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66dc088a9b1a07378a66523d6cc718bd5640537774b4f9e9feaf560b0279ff87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc8c381b3aadd0d2ca05f68b494635669f11a00f7a8d4185f564bf2480650c4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eecdcc79be187be7e7fde8e98fc52be9807d6535edc28069db128c56cfb373ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7a9099f1d2349e6a6fb11d348b8edee25a4e977464cebdfbcaea415802259c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33f48e9b99b58c69d3c8e6c23742524ea618567f093079a2ef96982fd7a15f70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a993df1143c74ca40fc59dd7e38453e25625e4bddea9e741bfb2e45377ed68c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76882558bcadde43d1c7f5816acefb822d194fa14ac139330ae4bf828defb631
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cadd8254f2bbeb754f3d2fe3ffce78840aa733e855a0b644eb06d93cefa0f29d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc66df6ea61f1aec129d5492c5384c647aff6384fe2cb757d4f068b12693ca57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfacdeb44caaee1c7cb9bb6184b89fb73eaa57a9ce1fde5058c65ede3135d5c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebaaa5ad54bb57b8471318dd62d533bc93fa96ced6292a5fb2448378c9caea01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74d24a06a20eaab3a717da60e0ce21f54dc0ab42276e05a730113f500ef87bf8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd1204e147deb846960eec8ee42b7637138edea3ddd20b0186802bf036418f16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ce0e30f39149f2e2f4034f458a69f2f8d548f17d08077dc0867d63ff872916f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb58417fdcdb1658634129da2c6d97c3f165c90863d527ac6dda765fcf055310
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ca6eaece292da97e222271f888972a508d7ef2bb68f1805981e2a04e5c77627
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6380334c02ea909662dc424406c7fc1413682940b7331b3ec1cb2c15bf20feb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80d22117b760f8161eeb49f104879415d4317d7a0463bca9cc51444f4d3d3e54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb87c5c585914fb9d895f1f23d648aa01d2f2d9f03489a8b914b6f1c5f6afae0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02fba1047febcb188fc62b74974a2c856e2a4e899b5493bf25cb87540d820588
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94458e5fe7225ea91982d9528a340dad7af454a0b9441d617f1f87cce3cfbb46
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1248b5d9c67e20e7d0ec093fa55edeffd4876c9a721ac347ad1a5d79bd1af3a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 651a8440b275a7c87b0abbee55d37098ceebb2b26c737d7dab634f52277096c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f26120e6acccf51a91e6db56fb13c856269ae644534bf10b967fcbc2b9139e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a42d88806ae2bd0081861c578e21d5d6e8e0e602028874e5159d960b1bf20d45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30b041698b65e20054c38818495025b0467e4ddc1350396c4abefaf1b1ef1030
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 299bcdd505024afe43063db1868f6071ab985132b9205b5020cca8547e99b644
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1687b94dfb090b01a4b1e873493da85f124d51afba5bc126a811617a8c225c1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2c484589eed0148b709e9ccc805a2d33a0bdb790c737ddbc83d3bd89a94f8da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08a6735b5916534ea15e46a200cb2746bbe6b13ded2d655a3ed5a3abf124757e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7da51eb0036df6ab16951acd082168db6608c3b2d31ac5dfb6ccbcc96c7bfd2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f0b42224f8431c0d2f98209bf48ca192750bf743ca7be6c716f6ec962ee6d8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6bba96a3094488073da5645142da7a11bc2b3381e3f57313fda879d1417dd04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d853d12b3f877c08273f3a07d5c0716dbb063ed8e23956e07c880d1c4b3c7f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e036d6a6acd54fbaf8e3693738e6a836a02c238ee86cb325e4ed58c85bdd4210
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3843d507e844c5c5fa6bfa0c60209b0d2b4fa3bb55328464382f437d82c92372
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f52279945f55d1ce0440d17e545d2ec3ad0e8c85b19a47b17e9f1abeefc0134
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce7e5c513f552db41fb0e2e3c980f6dc367565001f0fb1a13c754e53eb3cb153
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63d2370b38739f650dba68cf723d97feee5fedf43f30652e30bb3077c86ca885
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3274e5a6fe12e9a0b9f3191554d57c4f1c6c0a48a64fb832417ec158503366d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c38aa7ffa0eb2d9b69069c81baf998ba95d7151fa91e20f68b73ead5f95c0cc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cbb8a2cd3d16d8773e4a6bbe7f35e921578d5627875e0bd05624c0a5304dcd3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec845033657ad522ee2aa5dcb199bc7c6b6b922f762a7f258959a9ff2f42d81c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 051c2067fa8657d6838edf8c5e6aaea51f4ccd1f2c02a5d067aef25e61e5255d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dedee78d4e37d82eac96a8ce4cd705d089c07ba0b958d229df53b3008a03e166
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f43a5106de97a4d54687eadab7fdb7615fe1289780209ba01603f0645fc380f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 094a99a83b8e2c6da567e64d4972043a09bbd75ad18b4389701fed2ba0ac5f89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10312d1f4ace7e44a83abb2301fb2d9667480bb50a7bb87ad78a301aca69fa18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a344daa9e042bd8d7e5af64acfaf41d8f91f2ff9d72e0fb3a8f6f6bb86247580
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2babbf079dd5d463086fae4d17786401916c289786269cf544fda89a5ecefa58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1b84d0e64d98a7fdfdb9a55759c56ef224965b21f51e31e4ea77bf89f2ddc98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba19574490b5f59f1bc1f5dc6bab8fc3bf3c754ac86c0bb2db2539f1a1c94e4e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d40a91f74f3bcb060862c1dc5142170968229081abb1497c34ca4a40ae0de81f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32a250cb1e59a195190e9d555c87befb4b72e6eb3b581882d259be327c4c89f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aec5d0916ec1a3272939baf48cd1c4c8f546b2ab98b62c3b58d1d96dd9cef957
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c43dff3de871934cc74d9820285951c80fc216b326317a2b804fc0f69a9fe231
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe5c0413ccfa4e9438bd7b660ba9cc3e622721a795d5882f0c02f6d7c6bbaa6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61754cc036f4056634a807db79c3ec9dc768b89c166c903320861cd4f2c2855b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb71e228b8b2f36dedd6daf41765a88a191f6ea2dff23ad25a094ead43856af8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccbbfa3a7785bfc2d09471d0068c703dc8ad7cc214cb6d846853e6bfa1af0ffd
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 276KB
            • SHA256 59b7a7ab55772b85310b57f8f6fd81afe33bfb68e1d075fa4160d25a1e8d78ab
            • MD5 SHA1 SHA512 SSDEEP

            memory/3964-65-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3964-0-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3964-4-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3964-72-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4488-98-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4488-96-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4532-1365-0x0000000005330000-0x000000000537B000-memory.dmp

            memory/4532-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/4532-9-0x00000000005C0000-0x00000000005C1000-memory.dmp

            memory/4532-10-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4532-68-0x0000000003CB0000-0x0000000003CB1000-memory.dmp

            memory/4532-69-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4532-1591-0x0000000005480000-0x00000000054CB000-memory.dmp

            memory/4532-71-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4532-688-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4532-104-0x00000000055D0000-0x000000000561B000-memory.dmp

            memory/4532-102-0x0000000005480000-0x00000000054CB000-memory.dmp

            memory/4532-101-0x0000000005330000-0x000000000537B000-memory.dmp