Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 02:00

General

  • Target
    07088fdbe2697d89404e9a33193984a8_JaffaCakes118.exe
  • Size 472KB
  • Sample240624-ce738ayajp
  • SHA256 aa2e15e745f842bc577e740fa00bc0a1743d48807b5280cfa9741f2fa5873290
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • maazounist.zapto.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    1928

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3416
      • C:\Users\Admin\AppData\Local\Temp\07088fdbe2697d89404e9a33193984a8_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\07088fdbe2697d89404e9a33193984a8_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:796
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          PID:3492
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:6304
          • C:\Users\Admin\AppData\Local\Temp\07088fdbe2697d89404e9a33193984a8_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\07088fdbe2697d89404e9a33193984a8_JaffaCakes118.exe"
            3⤵
            • Checks computer location settings
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:6252
            • C:\dir\install\install\server.exe
              "C:\dir\install\install\server.exe"
              4⤵
              • Executes dropped EXE
              PID:5088
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 568
                5⤵
                • Program crash
                PID:1292
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5088 -ip 5088
        1⤵
          PID:3272

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 588KB
              • SHA256 d1642cd98b28b942c61a01afad86c367e91c97b75936aaa41936076554166833
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3033894d585fd95543574c2c0c00bed12f5c2290bdea90e3feeb2278b08b923e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 197ae322b31779acf7547830a1988cb6991132ba6c340a1090916e5fbb4b04f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5faf435d26577136eeb38271a7008440dbe1bbfb6986f9e1e576eacd9c482938
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f392daf3d38c57c38d64e7d55c82068206f013deeff90f865a63deca769042c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6c3b51856c251c233d7bf8c05716a017fffe5e3747757443ec4c1e548f75f10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9b6e58daf4aedc7e82128daed31f38776ceff319918a235b4d3e665de84957a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 040ac0818a6a8c872e90e5f8800a733d86008cc050e303bb53eeb5953eb6a89a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9d5d33a4cb7990c8cb6c70eae2666c157c4d80059c55c3a0b7dfe2e6a9b947c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bba79460ac8154d4b41cdf86fa653b41db8bab23623641db0561570de21ad795
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0db0944a9a60d7987e02488b3b6c6091e9a7627130b401115ad4c9dfaf126521
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 69e56073a77b2e8a95f4bf45a418ab49ec1714c622f0b55084e787f388c603fb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85f1030417128ef0971a09df3400881d505de6f6de14c635ad5f99b2e461a6e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 458290d6f48ee84bdb203cc89c1b327942aea178f09d393628c3e50ccfeb7b7a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 662afdc37ab73069b93c1951b2cbbf798b2addeaaefdca80946e18fab3dac15d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7198d991fce6ac5dd4be8b556abac1e61c8bd1b0a2f387870603861dcde27117
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54e071b3bc242edc5aef58017880eece65760e116af1e32dd5443a46802c75a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c8eb938f4e9ed04e91141a8b960ef2503e9573e4e18458dc7321536c848071c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 283700a917238b7d4aa43f29cd07108723983650078a0e3dffa7f877f1e5c222
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cb5e25ccbb3cff9235bad3e4f75af007b53469aea718be652fb749879ad6f457
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d525a59ff7e2ba0bb3f53c8e9704d2e2ad95ab3d535d15b67ec7baf7b7acb917
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 37498a9deab61c58303258faa9abdf29e73dc715398595794361515e31fdf574
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dbc2c06b9dd1bba9bafcb1a2b52b21b7add20f697774d13d54a058cce8514a7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b5ccae73d43be4a4bc24fde589de340762ceb098a6f46eaa856b6840fb16dbe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa45b458c3a964e8faf14d02819c765fc45c5e56670f0dcff80694b54fc57afd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 276e90a0d50446f513175997812e70e9c62f793da98d6cd59bbcc0ed0df8fe1a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8cf8be01981186ebab6b98004f56b38d12a17116399405601a4d39d7488566e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d2b05bf20d29103271add77382673c8a41b3b757580bc1f481fae36f85c07b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ac51c90c4a133a8af280a3e86659387b786968ae3f15b0d877aaca2723236bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 04422f5dfc1d28d8f754da4a793bc67922182a2a4f8647e920c134234512a615
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a0bd3cf6616219181fd054c68b54a208cc6e89c0b950728e89a6a78d6239afd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aac34461105aa103d694d8bbecd13c8f0ee66efe3aad3c29ae72c4bd22b774c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a46f2fe42039d1ea77cb4c61b0964683bb065892ae88bd83623ecb9bc3b483f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f4235156402e681808479408d301215e404d5bcfe0be0487bf29cdaa9601060c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acca9498275558f158c4426b9979ea4bca1e83940b08de2e833b9cf934d9afa2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66574e7120f1bf50c48543fe34aa2448b1a49665451476af2ef9d76d9872f8d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ca25484ec46c4fbd7f48051020e3a191b863453e80959317794b45077afe3ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc1225ab368b261dccea2159fd6364dc08eb5ad7dc4254ef0ebb601f7587dd99
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 851a36fcc8b19e71beec1deafc58c2678ee752b6b5b80f429d0689a94be996b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e4de50fd7e951f189b0f0a1b3421ba65bd2d898e58770f5c2ea7c545333f4f8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c0524177d21ace476c64442bf9e1ec2ede3b09a05b509bf51d04678366feed2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 40da2b1fe1d0540ebeabd4c8e4dd0c5c395e4d7b9379c6cd6d4a4060cb325e8d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d5ac6c11739758267772b955e17352e3aea9cca734e0f814acf93483558a7138
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de42c90a488723fa822309ea1ea82ce928fde9bd272fb978e2e27a5f3852e7e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7984497a47cfb62115b9f0ca2594055c631429edbe80132bccbf7e1b77061201
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2e876fc4e7d39cf9adea43935b0b6eeb0f1a3fd06ee3da15734eb4da4d5f2f20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2688fa960e92dfa8b738cdf3c898988fe6334606670495c0fb331b05579f465b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e92ba566ff55e26598fce2bd9ffa10efac70c28657289da34195f7d2f47448c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e3b5d5c30c01966a7fa050bcf8c919c78782379be687f7933b67abe3da0e1bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7f56cfd580d1499462b8e95abd88ba2bcfb9e0374749ccf3685c90238e05c86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27a5d1e98961df164fc70f5203d673ac1416e430896c93209c04e5ace1a18a6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5ca3a811296ccc41adef098aae5b3601a9f6745dd5111dd7e900faf4d89de73
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1761253a5a904d12c4d09a1bb5254b0b66af50e6f2fa3e0788cd53f9932f1c7a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a4df069bfee32765b62b79d16be7c487ab7a8231da5f768a5fc754da62ec7eeb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d0e84ba3efa5c6db52cd2e934e099c807a1e7bffacd294634e6e2eb26bc0fcd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0c6c581e78f313ee7e44e6c392a8c707521b8de80530efd4b9df27cfc17ca6d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b51949ffe0e9c61c0730f2df5e2dc969c1705799680645215df3a77287dc14c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9dea4ba6fb7da69ad394d8f2635ed44f648ce101da4f741eeb4e7951fe2cd4ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9cf477fd972b8db58478aba88097d3701a1dd31fbacd0ac7ed4ae55f2e0157ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e13ce456d58237ec3be1e5dbfb8b71b296979d7c0609a4b60994153e340ca33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d932a1e5a7177b7dcf0b234dacefa9f55e53ac1ab5c83f9afd9761be1589e3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 543591d7f636a7585c011de93c44ffeee96262ca41363561757db07b46314671
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a6691bf2f470ca3e44763d50123bac0b9d38ef6ae9361ec8859d9498ca6239f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 88526e9c3d9f6e350fafee3c36776331eb75fc849ae8e3109598171ce9e41375
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 80c072b9e92daa8294bd99874de48dda652e4c48050c5701c1572e05b8f303f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3a2947bafbba6c321420bd5bb6afebde20917065016eecc13b417efb3696b106
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 21cffd63ca8996d1e341a03a660401f975cdda2fdf52f21fc6cc974c3ced377f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 119444693baa8504fe6d6047d0baea938f66e4e2e406b0b472962042baf9f13b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6390c710368bbe380dc38f919fdd8a2062cd11c1f3f409c0fd7cb40b8471e27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca227a07a6b70b92329e21f86a3d81e0676c6d36c5f67b747ab8e838f3d08997
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d55dce245eec3445ebe22d5751cccce6eab1cee370172b15efc8a7b7bac047f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1964f9112f6fb2277969b5c3f7b37f0aa4c9992801b39b9bcaf2d04799c8d838
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c0b6bd6d61f924c5280aebdc5774efa7357a723c993206f1b87ea6a223f3fb5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54e6138c7176919e04f3ac5bef6e24bab18558ad5653b53913c199acea5bc25f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42f682bba4a2d40e37bc284a21cab225d3b2bce57c1a5e881c061c77246a04c4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9798b1259e0e62db37182678dd31616e5aed0140e0eb74ef8c10a36a965c6f2f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9b48e8d4d727b5cada982eb0fe908170ddb430c9145cdcf8653f9aa13c07ed4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bcfc307a7a601f1838b26f91e69d2143944db8c863c2923376830b3bb7f774d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fcf8a418b54dfa1e6ebb12767af6994d75a1fcffee3975c01db6344ddd7942c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7435b9a8c517f836d3c7bc57213f656f91f815185cc7849583db2feeb823771
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9923dbad7267e8028dcf01ab006b36e8926d9fce8e609ac08f9441c4cf2b7791
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6cc053a307bd02b554a11dcad28d1abb8a8d8af0492556c98a9400fb9f8e1e6d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a377c90da438d77804cb2590926ce1da4770e5cecce81d91b0eeaa9a38e4cd12
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d543f235dc1acce468175bf381f747fc48ce9be363dba825ee5c4f5427db23d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf841b8b98978007787a6bfc38928ec4746f2b436ec937603e46f36c8a9c49d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f90f92f5466b734bb4a13c0c8e4bcc990963081232bd8020637a05db6dceb9c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fbca41a922dc6f945f514da971283ef8a5eae543e1e86f54b05dee2f3cffbde7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c37efd9235fd4ac743623ff04e7e2560a368fa3b5324725792326ab83e16a872
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df002b9a5b222fbfbad305c563cb713536f4179ef33bdfb9e0f57e8b8fafba0f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 044d514b9a3a2a3c0b48fc1deeece92e25437d3d0776c1e9eb6e3a7c6df70701
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4529fd307bd2a0789ab8eb7d5d84767553aac2a719ddcec944d12f5a412c77f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 567edc994c0e01000708483a24ebba36cc2e811b32f5316f0df7d0b716f5635d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1524653e53890f94ed0f765c0d80b02b8374e02d8452a6261d4fc837a434010c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7cea11256d5422d1a2c5ca6c86f0b1f3f42143a69dfcf51703abce7a7e67f3f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6576e97358385ffe3ce0d7e3e89f300ad32627dc33ff55dfedbc32c8e7ee20e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32b9654557665879089e0ea62caadd6c35b660d04b23c448bbc79d5bb589fbcf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db98f91edef5ddda78ae928afdf7de61c599e97e2ea3cb96708194d46097eff8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 559255fcc2000b1602c8779d4c7384200b8db74d804908605364815c01c074f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 10988f83da780932feecaf750cc85f9a8e2efe4cb47d529420a8960b9d2c8e8d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 607f45d2fe01d2d1f96d856ccdb5ae222a1fd6f50ab835e7513990eee25d00c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0295b4d25eff9834b869b0cd66a43224b37fddb7a2f096e10bae6332e6ca098e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0567e3b9ca43b3345bd08f04626688f7d6cb0458d6298b59e19b4d4f34794d1d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db8936dc3686250cdc7f497ee19ca493b4666252a2e9e4a4068b841e8558036a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d67f4aa1e2a0006baee10a6bb483a24f4b1b37d293c9428da1460f1c8087590
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e769c9a1010469cec40c9a311ce5003f619c441476910ca12d91c864a00b0949
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4395e4b5f411929da3cc2e83506a30219ab10d4ac052020603c41491338aab32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 95525072a2a5eed17026e3efeaba35920be29f58a9bc03503fc9ffde5644a47d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83c7c14f130d0364c4de531f97a025b16798eaec5d1ae3651b31f2e401cd8679
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 221ffd5f4803e69813f578059e4183dfad21be804ec6ebbb406ab679144d3635
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9bee663106438ed1b4fc6cb465179f34aba82472d643d1586872cf61f1c8fad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 740c4e92ed81dabf4df80f8a4271fc8035a5111b3beeb9c718c891f4d40523ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a827786a10f664b883dc849c32e3f631533bca1e503efa34f8ee7917e43bfe26
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 789b88f79cc1f4935253583c543c3a72a26ee404bca014aed371c70792990a12
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f03c8a667dc8b0dc611a1ad9aba715e407a3a22b1c6341cc332cecf412f9299
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36732f5f3b2a9d56b61ddca37be1b7faefcd362072eb76e0412b896274529d95
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a950ba8906f976651705b8b8b3c497bf436c193d26c915b715cb93768061a65
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 552329486bdff64a4368623292321d54ca95a3effbb856141f0720bca5030b26
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b039034a1df2b179d044ff405869071cad87ec2196b65d74769139ef28de456a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7838a88474821439b0e226cc4e2719ebacc91ab2d3dce9f7906cdf489ef51890
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1e8e5ec2f323d631eb34c841ff4a83c3331404cb30af26203267f5ca0e5c39a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8dd0d6419fc96e908981c0fc23e6df831b61cae06ba88e181836f6c6c1fb1714
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 190f4059f3883603e888bc29f4fc520477383f53133940bfe13ae1cfcdaaf191
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72c8c8d701cab88bd1b7ad4887acbbbc073383c5bfddbcc93674694a27f4c3cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ef825453c229b3fb219717af40120aa7f6cba874b3f3a756839eeb5b65a7594
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a9ecca59e7327c71786638114493d935443ca8e1ee3344a20b1a65bf31403a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6841aafd95908fc590e68f98c25b5b26869db6d773910487efecb27dfa2f9858
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58eca0913ac4766b88a6b90dd9c3b4567b562437470a484880b7c294ee2b8eff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4956e160a04528b49d468e1cbd9a63893bb30b40b7d72dd1f7c31112c3eb7c4d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0828d1c797fa6521a8e132c0668ccc487d7025353e23bbd4e001f9b2a9a478d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6fbf663f107a26a76f11b614ec422828240f3f54d799641bd0e7c5870090cf5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8eef392bb4996e4a4c532fb67d76daec185abca3f4708b9aaf09f50b9e879069
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13afe83c9a369809896287c563c71117a7e807c999b375f9dab35aedb3166928
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f45b300dc0da4be0bf3b3fd1a6c08bed287345c94c8e329e6d8026b9a76e7e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8ee4a1a94b2921a427b807662982fbbdfa3d0431c739189bfef853613c31ab1e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b610a0d2b4bfc3da64c75b7608d8235f20b6591271e1863671d79c36da44d072
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 45c6862af4b36e4c4fd51d4c88e22e7a136e20d3c398e86fd86bf927a2a88055
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 284347dadd7b73d93f38a6f3afdbb5c590a61831e679df92763835786f6e550f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 70fe3ffa8ea95caf9466a55e6507315594639eeb46c8c942678cde9df7811115
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4bb0c7a6981034c72cf66f10ba9bc435bd92a353108bf32e94832eb917048b4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9e783c25c20cb0b08782638ab898230280ba79f12e2918eaf380a37283924bd
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
              • MD5 SHA1 SHA512

              server.exe

              • Path \??\c:\dir\install\install\server.exe
              • Size 472KB
              • SHA256 aa2e15e745f842bc577e740fa00bc0a1743d48807b5280cfa9741f2fa5873290
              • MD5 SHA1 SHA512 SSDEEP

              memory/796-4-0x0000000010410000-0x000000001046C000-memory.dmp

              memory/796-1359-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/796-0-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/796-10-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/3492-1808-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/3492-679-0x0000000010470000-0x00000000104CC000-memory.dmp

              memory/3492-11-0x0000000000D50000-0x0000000000D51000-memory.dmp

              memory/3492-12-0x0000000001010000-0x0000000001011000-memory.dmp

              memory/5088-1383-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/6252-1360-0x0000000010530000-0x000000001058C000-memory.dmp

              memory/6252-2034-0x0000000000400000-0x00000000004AD000-memory.dmp

              memory/6252-2489-0x0000000010530000-0x000000001058C000-memory.dmp