Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/06/2024, 10:03

General

  • Target
    018c7ec648b95e6f376335cfea858379_JaffaCakes118.exe
  • Size 428KB
  • Sample240622-l3kr9stakd
  • SHA256 b9afdf6069762e29b7fb449a5b21b4f9c613129e8fe0423cb0cc533f550fe57d
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • 127.0.0.1:81

  • 5.77.19.135:81

  • 180.70.202.215:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\018c7ec648b95e6f376335cfea858379_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\018c7ec648b95e6f376335cfea858379_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Users\Admin\AppData\Local\Temp\Anotador.exe
      "C:\Users\Admin\AppData\Local\Temp\Anotador.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1496
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3620
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:4656
        • C:\Users\Admin\AppData\Local\Temp\server.exe
          "C:\Users\Admin\AppData\Local\Temp\server.exe"
          3⤵
          • Checks computer location settings
          • Loads dropped DLL
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:5056
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            PID:3636
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 556
              5⤵
              • Program crash
              PID:1316
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3636 -ip 3636
      1⤵
        PID:3136

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Anotador.exe

            • Path C:\Users\Admin\AppData\Local\Temp\Anotador.exe
            • Size 32KB
            • SHA256 aef1a323eb587bba9937fc09844c54e95fc894f7b23fa32cf8c0b22dcbfda856
            • MD5 SHA1 SHA512 SSDEEP

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 230KB
            • SHA256 31aba5fc8eb08216e08c2578a491d3d75c315febc783548fd823c3b241f86dc9
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c40ff6af64c21193f4070a6cddb272b0dd38c4fed1264b1c4b86ea1ebad95ec2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80d66b878efb44f6ac4d279e7041c0e09ffcca377831528c01b5df13d7ea1a3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63c71d7bad2624cab6418cb7822e8bb969d6f9e69a661c42c008b11e9af7b81c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96e8f5bc2c65c165ef05c744d0069dc53be18906669011871132c0254d0f8da6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe4e1ab6b97b4d5413b21ad177c3dc65ffa2207617f2ce6a8dc5d2e3a61ea61b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e1f70993bbc162508c1781998a7a8250b7e1a0556301991a8b3c8772a282b47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c55bb9ab94efb00f09859d4894bbb0beb284a11e98548c007a09ab231cd22144
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 915cb7a98a69f8750b9e5eb71ce5b35f0293805eab546a1525a0026d328e6dfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11879341a5e68a8f949ed150003676b2b24439410353451245686085090483e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bdc1df4b6a58e0ad5cff72ee61587832b6b107c40d5235c8886ec4c46f426bfd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17474e1f15ebe41c539506b32ccfceb35549571d10e7dbb9c4425d99ebbc3ade
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dcdbf2ef22d69e24eb2561e388f6f101b8feb8e2925fd8fefcbb9661f8265385
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa68783a4d2a66b3503986d3c4d1f356ef196d5f513d821c54346945b84e359e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03ae3345787581a828654c432a6aea49cf77e05351ef788579b60ede44c2d280
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad70d1570cd6665414b11e991337645f62bbf51a7c4ff551692f7efd1ebb9b10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47c104b2d634ab2af874496cd98d7a18d212b7f931ee6767bc4baa6cb1e4214e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b46f2be7c9c3df0ff04828aac70bf3ff0461a8ebbe45780086ffb42c266dd21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecb58cda20f74a11ea63ef238c50d2611cbe77bb4595339f341a8a1290352a53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd262c9fda91524a1972ed9e3f8d72500bb56bbde58e41b58ff5f7da957402b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e54e0e569c2bcbf374715c0d1c69179b049fc9b8115457b2eb7a4a98a9b440d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88b379837078bace4bcfe91095eb534029aae3d574f7bb5456a193b1b9ab2978
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca318cb96a6bd8ba6e0845f064522f5fe3091301c1914041068bd169785c5cc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49c56ce1cdce14d263d9978474514c945a4fd9fa4448c1d6fb3be34720b041b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 408a1ddf1264b53abc771264c07dd9c0169c2a923f20c14f812bd482b30e8833
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54034564b133a680b6e643512cad7a50613e3113538dc2a1a92620f69cbdd1da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ea9d89d69c9870ce50c769ac200582d8760d5f62ab30019e56a59d221c8fe6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d280f696c676d3851ddc5f2041eed3728590e7d2307df84a1acbd1a673eba00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 032a05e07c1fdc0fa1de3eb64f12aa818f828f45022586ecb2485c8cae14c5ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82e37bbca80ef4b36fc880813cc12be829b1ba04ab061b6df8b5d6d45437704c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b111d1332aeb147123d724f2b7fa0f84ae2b8fec38ef7f1bad35197f967f3ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bad2695e744d4f0f19e0f33eb72fb7a85b15a1041c15d625c413ff623e2997e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac939ef27eb5c34ebbbd494cd80df3fd0d35f63c4fc4148e71e821bde1529700
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4b6a0c8635bcef339919d55836902a90815ded2204d84a53efaacd0e457a3fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 888e28a7a112ad3ecb2530ad9ae68598d5de4101e880c05ff1c29461e9b2b54f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e4ad4eabbe35b274241333671aeb5cea5239f5d30375c15b5b8ff3106dcfda1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16e609c3cf64accd6c819f9e0763ca32286b0f85476df878135afb2e95cc59f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b61ea17ac041f9c5552408290465afaf075166b1bbeeeaa49466a06a686398f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3549a62e1641443d0fa5e5939f02fee123e03cc2fa6fb98d86d09b3afc70e56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b78bfcec7d8e09338ac2b9abb74063ffa4f7ddd84de0b3ac18737d5f1fe30ba7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7047a8b6ac7cadc6c347315e9532560a78f6ea612ff2e459d2ed26883177fdb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6787c85ba83fd77eb44170699c5dce393460cd948f302b1ef49be7c5e4e08db0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0f3b7b941af1460748ce5e82299143c91c125d8c51f6685f64ecdb6ddada318
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5468b88357b61ffd8f8dabc449e2d64a142b6f4f573ce73f722a46a1219c539
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0a1c52c4892be9636a345313af1051f4154c7d10d901c8ea76c044913f42119
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34772504685de904f57a1bd1350459895383982494b2c993e18c85298f33eac8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f774f8cbdccdde297d837e6b7c9cee19b87f7cb5fa15eebe08bc87f176d8565a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37eabda570a94703d8d6d68370ea9916d9d332cc2b52f65b29f4722ce6bf1371
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2842771032f941da6fa9717d80715b31dfbad32744b94bea216dd5d0ea58cd0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9bc229798571eb6a3982a05cdc70162e655a75722f917843f4af195011a8f1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54481ce6608981b2669fe6f759b6eae9a4ba10b3473ec45661dee38f2c283a9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 746b961abf65a142b5dc55fadd7fb84aaadf285dae0080bd238f2148a52a9fb2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57d71c7cf7133ff8bebd366172021997a77a5f7a3d6203c288540ac4458d5f6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 287b0711aedca89c71707ee3f89b3e1d9561a93878faa610785f6b832eee61a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b900ac350a3bc48e000cd3c466b127f8d357ae07293ec4293dcd95c119befb0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2e1dd16bef02d48b405e469c529c92678f10937fcb7b5862e93e91a3df5185d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 554e3c7539389c4581d524ddebadf49ccbf7a5a225e4d28b46780c3279867658
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60d84a1a0c301542f5e052002f8ff673b80023ed5b0598c9b78a13e286c2337b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d669e4aa9358ceebc4190e9cfdb8830293e09c54745e35abb41fc4f093f6b310
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b76198980f756c68333aedbc5569a247ab079dce27ec9e963c7a1521f0a11c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 912feabe3ef9eeb3ae83f23ab0249659188383d107f2bba72a5964238c616166
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94ffab52b3f2513f52e71d48f40f99c2bb3552eb31e36af9ac697b46ab9d981f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68f0f79d2a3aee450af161d1335daeb70a727f9294b16b1d5320290fd8d215ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da97e93def3444c44404ac4ce6c266d7e20602c8c7df971e46a10ae43107e45d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 736f368be34f6baa728510a0e2190ea9c422a03e3b87185f53f5ca6355bdeb60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77a035386c9f8aa5c858399f191b697747635c58a19fb8f5d44caf5acfbbc870
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94a7d3d016037a59bd7630e1236d3fb49ea176539f07ef0c86d9589867e31654
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 febd9e076969c98ffcd315f05cf1f246aa5f74929750a408254fc079bf9cf886
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16b2b252374bb86b4d5be87d13b29d71026b9d0a6566956e05de64db81a07fe5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b05f619287f06b207d7ccaf4eda42a97593cf354110b1e76dce35bfbfea51173
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6fc46800953514a0d2f198cdb71bee65a7e6e898ba9f43d1cdd3e04c2177402a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 560bd79cfe1defc27ebe84b6f3025867e9ef23a0a0dc572f93c034b383634c89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad7a1d50df7a5b4b0f64fb2cef1eb697085efb7c7b5f3bd3d74b1b94cd0dea8e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42b3ebf5742844088bb772aec0cfba0bb7727253d02e6d660f4fad5573aec242
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40c69b1b3ba801e2843368f31f0599052ea652182c961bb015b26c87b6e409f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6ad93ba127f0091ce4e6b71221d708fc27cc34c02510f1a312ec471b9afb9f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93d67c053c53d06d033e5c3e7f95044b2d6eb1a48f64ae07b78838e0153b10f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1127530d359b18605267abe1a503f08863f833c6b82047dd6c0834135697b7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d35b74df1b6115dd5fc82b308a4642fbcfcdd94bc263f2c36bce28ae18fa99e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aaba0460aa1a1bd12ddfcd55d26e54ed38ba233596810f2cc87a6d1eb275e0b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5b41846835b7a8c89815e019c82eac7907a817616427199a2a47752b4b59e5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54c0f73e9d844cc3be08647441a4d883a3acd0d20f554977657915ccd7e1b46c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05d2e6e4444199ded384fb9f8f25d846d66daf823dfd521e8eab3a18f6272fd7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c6978c19e0da8669586a307931247af790453a9c5e5fd4d39df68ed9d47800c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d2e18c610e847d832ce6d718b6d065ee6307e61a184bae95080fa5385a18f18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df3e2dca2714dc6bcceff3fb2a01512c0679e5cac1434c67186e6bd0cfbb2021
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12de14a071f592270b5feb9bbe9137c7ae30dda2640cf29a35c25bb1d1528505
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25d54c2314663b258ff168ad3f4b80b99c0933acfd26d54c6ef0e03f3150b540
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 368356aa8abe86889b49838b441711084986bcb9b3d3e48c21b78d7206b5acb1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2629505c0902dde88533e891ed05dc168706b7c909d5ebb0d6d4beda642d7534
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10e3a301b96c17e187153e4f6e6dcf8d20b83c7fcc51274332063114c39ad168
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28b891c1869e8cdeed77db34d0ae86626f590611043c969eb59df0a125c53f9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 128ce5bdf074c64a817dda559955b0e20f15f0e999fdc9a98bbf0674c29dacd8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b274ac06506769e183d13c70baa3e1462a7395dca299854f8174e8daaab4ae1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf44b74d211605fbeeb6b80e11f46ac42fea09eb42cfb7ab29bb9723326ecee8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a7ec65077f09f1791813e69d3cdb12fcf376b7f6641ec91be0428e4f802fa4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58c0427142c4c3d2db3bd60af97810430a9f39ce3e1997163c9a85e6c63c7daa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b16e8d272da5be19065b943431e6be08e39c8d0e26d6d4219457e65a52ea163
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c0e9c56ff2b238a166a2b3fd42f13177fefaab7b033bd57882a556ed13f3888
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f023d5d4fd3a3d7a432fba37e657007e1dc612611bb190b0925be89294db8dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8a6e35d0697eb56b72bf92c0d7795f3f6c2f84034b5ef8efae368eac6492ee7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cda118e7ca3ec4853e0510aa0b90d280f406cf16ff5d34f49baa2637e13cddf0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59665b9f61928d4f65d4a6fba63d198e76c256ffb6cc4d752bd2243f8e169a49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4ed60c0cc3cfaf26b8740c5582c9d9edd16896ef837088de51de37882d10ff4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08b87229779d361d2c4ec43570232ce996f0c954c19f94522d866ba12cc58a3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 601ec69d80a01fc8c6a48ed57791ec854640c2cb8c059f71c7ad0187cc6ed77b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f38cf4f21e813d6dd65ebf54685e620a009f32a66fa7d9811f540ca88267e2b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c6e7dbf71d80c259dc0b86aeab09b01248eef81650745a1085a5db8f41dfe85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fe3e044dc8235ca4a127fedbf698940cf7c3ed52709206ddfffea3e415444bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1b32eab7f5eeaefc0e31c5fcc95dd47ce22fe0fd42cd953a28d7f7c4921f05b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5361cf8acfb6b030686b72d4040a93904be7225a346f8bc3ab26fe307016da4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63b01d47b72f90d15d6f71680fead037728805d5d1ad4622c7c84624aaabbc42
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73454e3a16d3c7680b0f161971849261a336d79f9b6b0352a377b67ff24d68b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f2417957c15625bc3a03ad0ddb78460af6a77b702a8f158c68f7bd204934408
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d30bd2422b8c1fb7a8af5cadbed6a1d19028fffc7f3172454e610ae48662fa14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48e2dc5164c682496af28dcc4f107978efdbc18923a7f07789a3a55ea1703f0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9656801fa6d3a02515094e261aff929717d6cf124abfa706b222f1644635b22d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b26617da709c5d2f50113cd3f41a77da73ed4e47c4c7356b210f81e60ed8ad27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06854a042383a7cdeb2557f1d7d4dac54e287e297f3f20a0e63940d4d55683c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e1441c29e216932de1d9a153e2f6c1e1c0e3ff81d4f897d1619d10fcf7ad0f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5bfab47835b6bc751e2fc759e545603049b6511f5d6551dc3ae0d4757577f9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eac95be85b334aeeb1bba2aaf33bc017016d0f56b055c92d1312ac09a422ce2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edfdfdc2f0c4fda97f34a93fb64357dce7ac90b44763b2a84abbe0da078e7d9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b4e9a8eda303bb25c27989a507e49c26f7e1018ec5aedb051045ad8dc7a38b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd69d15d7289fc33054717f8e1b38f66a882d4dc173daaa3b12a1dbd4da32b07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8a843e9b4d65b3eab76c1384ec923e255d09d26db8054622f0bdff6443793ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b14a70d7833d9cd2b1a46b0cd8b21a4655519325419cba82f8d3f119cc60dbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb74021a58cefa18b5f312aabfc1bb69e4d4a2a1d08fd98dd1e25b7ad5d89665
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da8824c3c7b62c6765a923f94913bb076c83b70030387dedaf3cce37972d3bfd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5dbd5930638c2f1b53d3561c8bc131964fdb388f82d6a2afae53fd89196c44de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e079e6b4cc621aa2e75f83c01fdd20adecdfa1ac58fc83eba0106f7671d12f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e297eff978efe3b324d3b587cabcd6a5499d35a1bc2e38083266796c0c5b9b8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08da2f24c1cef9ac7204026d704014468b5b3ca9cb62740bf2438e5165a3a585
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bff5336ab239308028959852fc5efa8c454752962244d3c77cc48ce72e37dfb1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88e831af7b49ad334d5e98d82772367566a955f8dfb820e1701be85af5eb8812
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82932b59da5ee6e5bc6f8c67b59e9a4a246e6ef08715818e797d72041966e7f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17576449b0b72c5ed8cf33cdfdb939ddbcbbb1212a2b7db26a3ba50e43284564
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7801f3c7619fa637df63f32df0983a8fb6e6544c05fab1c96a99d18bb031012f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 133c402c2bda018687d557d828f1dd650491ff794e8107c44d5f9d132277ea8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75bec2f239c3d74551b89ce9bb359d6e432552202dbd0d9bb8f3bbbe1b166916
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cddedf4a7ccc5773e5f78f9b9dde92baa15d77a52be1709b659b89c997807dfb
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Users\Admin\AppData\Local\Temp\server.exe
            • Size 277KB
            • SHA256 83f54f9004bcf85d7d829a775214ea5e0d2c755cb16641926ffa1d613efb605c
            • MD5 SHA1 SHA512 SSDEEP

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/3620-96-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/3620-23-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/3620-90-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3620-31-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3620-28-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3636-124-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/4572-2-0x00000000746C0000-0x0000000074C71000-memory.dmp

            memory/4572-1-0x00000000746C0000-0x0000000074C71000-memory.dmp

            memory/4572-0-0x00000000746C2000-0x00000000746C3000-memory.dmp

            memory/4572-122-0x00000000746C0000-0x0000000074C71000-memory.dmp

            memory/5056-32-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/5056-33-0x00000000005C0000-0x00000000005C1000-memory.dmp

            memory/5056-35-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/5056-93-0x0000000003CB0000-0x0000000003CB1000-memory.dmp

            memory/5056-97-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5056-1204-0x0000000024080000-0x00000000240E2000-memory.dmp