Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/04/2024, 15:37

General

  • Target
    ff9b5e7c51ca0d2e33122049004fa4ce_JaffaCakes118.exe
  • Size 584KB
  • Sample240421-s2mc2aef9y
  • SHA256 52a282648386b6e0b87c10e38c8c34a3563030169431545b02332e537e83eac1
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • MOOF1.NO-IP.ORG:81

  • moof1.no-ip.org:82

  • moof1.no-ip.org:80

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff9b5e7c51ca0d2e33122049004fa4ce_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ff9b5e7c51ca0d2e33122049004fa4ce_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Modifies Installed Components in the registry
    • Suspicious use of WriteProcessMemory
    PID:3904
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:4512
      • C:\Users\Admin\AppData\Local\Temp\ff9b5e7c51ca0d2e33122049004fa4ce_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\ff9b5e7c51ca0d2e33122049004fa4ce_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • Checks SCSI registry key(s)
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:2452
        • C:\dir\install\install\server.exe
          "C:\dir\install\install\server.exe"
          3⤵
          • Executes dropped EXE
          PID:6060
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 564
            4⤵
            • Program crash
            PID:5124
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6060 -ip 6060
      1⤵
        PID:6120

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 692KB
            • SHA256 ad8d320b2795d14acc8681c9fe687882de348d890bacbb0fd3e73b9aa076a378
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c69c5e995aa55d68a0096fc02b254df442ad147cdebcb10e57292e7e9c253ed2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f890f5fcd0870953ac00e3048b0ad5cefce52625cffa001789f599ac442ecff6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ed2737c5ee0c6321e43615fedcffd10455c189e662b81e9f5c595a48333b635
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15eec7ab8a242356ff013bd1515c04b3f429612194dc2b79a82636ba7311d487
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a8f9b2620dace56d57507e96929cdac197c9871cd47fbb2992a5329477b8c90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 035e81181f19cd0876cee08419c3556423792cd4600e00ba119ba2bd665f7b45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c433b75a51bb05a68d0d11ba8b8083099797e952c45d9a9a66156c10ae2f51ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f4696ee086707afb76b5d074631acde668895f48fe5453badd8729fad3c10e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6be735f211655f0d74fac52d1f41b2a9cea5549dd68a90b4e6e04e3ccf1f1e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c92717a832ecbfd21768c880149d889135d51754a29a9690c332806cdf6a430
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5073437b946a95fdd2c0aa56bb36931e1677189c00132646eb27bf3c9a214302
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 177f215519bf4dde38e884550f40d0c06fbe8e7708ed1d602e9ef8c209d84a17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3ca70eede414b707b5d932d7e20603b0e7be6c6680ce14d1062ffb4c305a99e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 216d0717bb872535d64f8368c292affe4c57a3a2b0854f676e6ec74c52175ac3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bd53eae9ff7ad7fdf03edf33299cbe182bbd956aad405d060007f1d691e211e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 464da7227528dd7d1f8adfc07fdf760f35ba3a7e70224ba9f3f7a99008249223
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cff5d335493ec4dd5a03d82470439d3c0baae1d1a2dc51b02beaeb89831c206
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e376073e066331f8c281be12cf6470410a8335a80c92b1c164b46c69e35106f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19049217cc71a92447dd6cbe821b89dc0fe46df170d9acb7eab7ee9f2bc178e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c9010ef999e8aff201940d85cb888502b224f6f434c45cad54e172ef00eb87d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4d54d245160d7a5343dfee023b0b3e14357cf964826bd99b1bb9bad42c9915c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 404882b7230d01ac3577cd3dbacedb8795261f9497c614034f6dc2a1fc92677c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0bcad2bf49326baf6730c83f0cbb80603a017f0f0a827ff6bd1892288400ac7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2853b2653c69840899dd83d9e8a0c0c8f9dd2861ff7e9c93d1735312a722584
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be119f65bfa2be1bea074e1bdca10a57913291117bb3e587b3dc6252094bc46a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33c48b10042c97547e17ba416bd38d0770fffb3793718854ee3b4a845b265d0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddc7cf38a2d8e9a26d2bb02571a99308cb29dafa2f30e9d4002881288ce803fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2797573355c703ea1823c26e20470c35884a241761ded58e26f6f0196138f530
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9508202fa74412f42ddcc38db31ee9d2bfc63e5a2004e5c1fd043ce0c0ffd8e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29825694d8c6c3f44d98e3e9b99bcbcc6c59788c1fb82a9f085c793a7af6db68
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f772c6332aa0fc069f0b9ad475f6c4b4fb837b25e06551997ed00dfbc8ad854
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4695b7c8e060ee0d0ec4b8b730c653e19b7c9194a35fb1d6ca35f7e563aeb42a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb790ec2ab903c79f36566c886eb158cd5814adad3d5e778e6d9b782658cf5ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc64321e33a9428dd054ec2838145116ff93416876e6f81a45de3ba27efd5d76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10085020bccf85b20e806134233958159886780573bb80d79fff28431a1e5d7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 122dbe1ad19edbf97056ccaf8c86bf898bc99213f914534303e6e784c8059e19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cff2f9a9ae2f592fe24ab2e24195ac721def552a69d40a28881fe2fb1271338f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3babd48acc793b307cc80ec5d22d6581d97854428b88e38c576ab3f757b7e7b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83bd56c413ed411bbff6da73c4fea67fad57dca159e994d6ca0a7e2ccb26fa44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0da3ae2d8ace4cda4ea7a742e7ec2f019a2c3f8640966303d6302d4b85a7f152
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b348e4ad359819d5e035a03802ce4c51f1fc6118684e0a1244f74ee737df034c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3f1c16197e4b9112c69be0950132fc80e5f0f7628cb3c8d44f66a97f5b6b0df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 163588f65a9bc990a8ab86277d3d6a900594dca9724477ed5d62438cc571272b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44f412fd6800e59741f3b0498cbba65a30de6bda71a5a74b4b833ab8dc7ea6a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac2b9ea62ef83fdcaeaa8407decc271709a254a84dfaee75ab17c3e3936cd5a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10184813c5e6c0a4ca7e1bc90ea36ded4b56c52b1de93aee9fb90ba97dfd291c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5905e5886b70dcb590af0a4f0c628d8b18c8e2c07101e38a9060105e238bf519
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b9c9f5be1354387b466ab3a7a61d92b7f9777919f248ac5a95a70b1e5c39969
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e701c8bae578ee32eda45ad9fa5eb4b355d9c936825a91803b72e8127f8a06d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 351f3feeeacdf62fc077280c22fd8201ae8e90460579238bb8ad5bd58fa23758
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1702eda716ece8937e841fd6332e1c241c021e2a0c832d6f1aa4d829df0c4054
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f1129e22dcf01ae961f0af4f2d2a9f3329908203550300534af6d60cff737e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88e5a8e2639504224d690cc93d840b5becd43d5478c3d423ca811696b457998e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afb1aa057d6946a178cc87580283c018d45826ff35cb1ce33bb5d9853187b5b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 116c129af053348df7445348c3e1026f4b825564ae586b58a058cf8dac39b5b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 212e3685965f7491d95ca4dc99d3373e113a93799c2076560b9cba654b80c3aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 158ff7e65f8c4b0bcf89b267b163a1acd2034a70be284aa1a46f0de492fb083c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45726bcd3c62b8f7fcb5a9e87ddc5d61cedd0ff99e9d0533be9f45526ea50ba1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cde77210fcb578f385c91de98d89510de72fc7d74c352c70b7e22de36111ca61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1aba2fbe46fdf41c1b9c7b1a9daf2a168aa6e3b67bed9b2b9cf58432aca2bda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa52e24ee36b5d0e4c3c53cca062ee0d848496391fcc7d381f0ffbfd26dcccad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fba32820645236ac7ebf1b730e86595bb18253f9b05dcd124445d3e0b7d4bae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 049e6c4ab13bacbffa5faabad0c5d537d85987e167521e0aeeeb74b6dfa05b43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5446ec5b6658d8c3b2944649d48b951d1a89d3cbe2035a524a858bd29f563d17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f658466af174473f9b99a36df5e880c84bfc1aaaddead5d9739d4e5396d4e950
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fa0f799fe357fb2fc7055e71f3bd6ad09484b68e6c7449f9ee01518bf1e9fb9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7683291d5083b594450f6d7ad045a1e9001b9b94a75ff34c1dbcb2ea87e25d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f8f1c8e93922c787667136339a90fcc52fcea9f3c9d32ed3eba80077cac201b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c103cf684aaabaa78f9beb9de147aaf85268becbc8b4b7d7ccb55b970783a04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17fa3e2702b314e734bb40e17ed53bd077e92fd3a12aa9b9f2090fc373ed464c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4ec66a3c8c8d0e8a76d47320286631a2505f25e1496f6f04652a32b70ca4f20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b3ca8e0e67362b4ed78f09817a37fe527ad390dafcc17adb1363ecac27bca84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d56b4c88fdd8d9f87c7041b917fac6f81398f2f1e84e1bc84fd6d29886ea2cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0efbf4f387a8698b1672c20b09c2692f58f531d2bc51321fe8a2e71161dc54e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 327d3211cd36867af30a37958040362f4f5358fe640ab7ee021c2978d4a10e0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edf3358456546556673e9979d81ba42cbce920ed6307f43b216f75dcc9744e00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f7779f4f2421f73ba3d371cbaa9563662aa80fd12ed462e13176b9fdf681dee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1c307d7bc056a919337a6be868718acd7dab7979e344ef6d321c6339473bfc9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da4f2eefeccaa61ba0f5d900cd847b00d6c351e74ccee74f1afe7a73e83d9b10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0df8b98e0f183e37a698cc3665d087acfe9f652ab116e61683837959c1f599f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b5986f696fec0aebfdcd54fb41e7a93ca78ea31475b9f6ff870f998dffcf188
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2447c6e838a97b9adaffed2b2ad5c41ae57f25a32d0004d89ab89f11cfce375
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cf5aea62f90b8130479aa75e79c75cddf6de379af8f1dbca40aa8c14115ebba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 766e34ecb0a5da7c945e49dc0ae2c787d7c656d2a1f96ea75c986365ee32c3d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8e0265f6c2c33891192492f318e9ebd152b1edbd0d925bf17f917aedd515cc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c44eae17c16737c0210ccfeeff3df2700e16c865cd6527dc734eadebbbcc33d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98004042b5f0d30cfa40a1b0b6ab018dbd3c42bb535c83aed065776d2d10772b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d963082a2e6f6d05d71c59d33d87032ea8cc7b84ea3db569a49a1b52731d871
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6e393ede79621e33249eeb5827731b8eaf27646d94bd733d28627e68297a69e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd2f752390f9bf74eda8b732fa0e019916948c38e30fa0a62d5dd14acc56dc6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6922d5cdf57075492a5ff9975f4ee68fafe66bdc9691aa0411fcbc0822b440f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14a234479b05e355ff1ebe73159fd660df0eafa459bdab8dcde41115469b9deb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb0694b424c32b444d1dbbcfcf2125937eba8f759fb8bf2607cbe2e2dade20b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f29ea48248054dcf97b9c8a3d4d9408189564c8d5bc01a5ed556ed494b018482
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eeb0e424babe141fdf72323166ca7e716cd97442c230f06a94619b5e385d611d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6c2b63b0e06ba1a3d2d6906ce82e95f52baccfa0f458240ac03af6ee7c1d39b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d747268c6e33dd857819412b3f6bc29ff3d72db3cae8f516aa21301eedd1253a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a338be348bf06135e5d1a449648a3045afa5ad68653430dadedc6149b7a72ec5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 238c08affaca2581d05beb59af393339f7960f57b4a9e8569b803137e8f11ef1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cfa2313a01ebbd67ea51cf3c79d1c14c9a613480ba11fdf818afd20f693a3b8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e71ae9bfcd89e7a301762af9599f67e7864b09858a022e93749801ed155bc90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2110f73b6ee3a895b3eebec608737e705f5b1524dd5b71ed76cc661ebb3e06bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9ea180fbcb341216ebebaaa23fc5d7fb4657131eb92cdb8c2f1e7547ff01bd6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adc748e4c5d50daac53a7badb0221e38ec49d6696a490d47aeadf1c7779ae99a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2598d0466e16ac64cb7632d7dcf11e36041bb0649b23d9b72d7d3b17249dd0c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7087e5eb2dfe86b34352cdcbff65d4cb15ca99d487e2d23a6e67e72b21659456
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42a8c767f42127412376151753d2146be81ff5da135da6a93c81129f70925699
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3fc476f78620744a137ebd1258364009b7706291521e6032fc5adc3e8cb5df6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 548dcb3873460d39c22513516268a689bdf8106beb5060be87d2d2885ef3ef4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d759f0c762a0ab0e0b9efbbb376f11196dc94fc10bd939b760298a9bd58b766b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e70c507b6d62b66ee5c541a34afba620339b8f7495e5d89deeac9f337efe831b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d01a4e45139881867b14ab78b7d13add2a095f5c05978752f36b4236c2735b53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce34b4a4fa5a338d48209a472fc7779d832e8936f63dc5df92dee58013d128be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0d5ba9cc6884e3bc695d1f54114827bbfa1ff2a507dab96dd40c9f40063c000
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e4922300d21715c35e833dd6fc66471e6879cbf8bfac7bf7723fbd63fc6a56a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6dbb224bd7507a6c9a872562a198dd1d002aa85abc25e651e6d66c1a94b8262e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 449a18d4413803bb0d6d73a7514332c8399918a658c184d00526ea7191d8ae4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 357ac73a91b80ea8edb5444d970e48b33ce747e6b3192ce043b8ca419bb21391
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ebf8b62394f894e199515e375a652827441383a0bd9ce93a27d50fa686f26f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d698d42a8a2e6990579e291a9b696b4bcd6366d2e4a90b0eb16e47c1879f854a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62d8f3f737ef19a6d0bdf9b9f51df75567629af3bdcf6bc79b6022608edfba9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6cb1e4d19aa4183aaf2434754ac348773373fa17499612bda17a652e97b932e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b1a5030685b83e69ba47d5539b70d98dbac145d5f716a2b5e38cd6bd46d716d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34ec6c182eb2833f7733c4b3d3dffd5381496147ebbf57f43b46ad21e0741ffd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b092bc09b7b76f68d689a3a341e70e0d16d9a9adf9620f0df5f92bd644c7cbcd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb2e13b20b27f504e5863d870a82a817f0dd2be95c11cbe62fbb041521c18202
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8f8fc6d17f3872021f04d461c07caee086522e757da1fe1a56a5845d18fbc3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c985faf5d65224ff7647f9c9e66e2e4afa240508557996e1b5a7c28d3489175
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a65ef191526351b3150fec3de5785a4e54e782a3de77e84726e0310f224cbf16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 723bc5ac08b0169701dbe0286d73a95744bad1023bec2d04aa70b2fd77246344
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1657c19d347d4b7fd7e3ae9558a9b5410a85318fcb54f97b07bac7170e492e99
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 584KB
            • SHA256 52a282648386b6e0b87c10e38c8c34a3563030169431545b02332e537e83eac1
            • MD5 SHA1 SHA512 SSDEEP

            memory/2452-16-0x0000000000400000-0x00000000004C6000-memory.dmp

            memory/2452-712-0x000000000AC70000-0x000000000ACB6000-memory.dmp

            memory/2452-713-0x000000000ADC0000-0x000000000AE06000-memory.dmp

            memory/2452-1730-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/2452-711-0x000000000AB20000-0x000000000AB66000-memory.dmp

            memory/2452-681-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/2452-12-0x0000000000630000-0x0000000000631000-memory.dmp

            memory/2452-11-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/3904-0-0x0000000000400000-0x00000000004C6000-memory.dmp

            memory/3904-682-0x0000000000400000-0x00000000004C6000-memory.dmp

            memory/3904-4-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/6060-710-0x0000000000400000-0x00000000004C6000-memory.dmp