Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2024, 04:12

General

  • Target
    14a308f15e0bb5983f9eff4f399fad1f_JaffaCakes118.exe
  • Size 950KB
  • Sample240627-es2jpsvarr
  • SHA256 b90a204b5761d2a9fc88b6a3e0c1b6c8f06c5de35b87219fd6454cf57e3a0b92
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • hgfl3322.no-ip.org:1615

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14a308f15e0bb5983f9eff4f399fad1f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\14a308f15e0bb5983f9eff4f399fad1f_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4356
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:396
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
          3⤵
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:5076
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            PID:3656
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4280,i,6522675234395427298,2952738987384583032,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
      1⤵
        PID:3620

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 6122080523a6c93c74164858b42b19354b4c00926099d981f42120c01a056e4d
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 588KB
            • SHA256 2d64d345418391c14288547a1003380a02fc795aa04e7b3af74b997b764cea22
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb2a0d2faba6de6913b7537001a32f026fe588cefebcf73ceece4043cb8cc00d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06fec3f521cfe52c6b4ff9ed108011bbc2ec827b9c0842e7a6006877ab403441
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b874dcc8487ea0d9d465821d74f6048632ec5cbc1c1e2d7a7f2129902d8e663
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a9196d2dce28450f8c1cd9e949b4438a6f4811f8fcf7887747a8f6d62758bf8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bf41bfcadaea8fb9197fd4473e0ee63081b57fbad3f014fffd13de83fc1e9fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89700abdebcb88b45c291f95e8d52a8a796449610a0fbbccf8fb9e06e858b77a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 044f82aa2871ec890d38bac4000a1b4d37167930ca17e23e1dd6254cc572939a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 053b8f78bbec5f8b7d3d3e7e7e465750fc58823c893448c13038b345103a4b73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc8cfe682f6ff693c598cdcba6cd84803252047e3fcf344457bad834c59e37f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d230e0c1d7ab2fd6175c58c116d3ea7b086193934fe2e3a6ff8e9741a7b78214
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d7a9c42c0c20a3bf932275be2f7c0f701b7af1ec2a34d23c852a473c32298e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffdc399307c4c83f40b725d4ae3f1c5f8a3e96eae3bbeefc0a8743e4b2ec7238
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25678ea2a9d3d77c062d7c25e4a012a42af77070df9e429709d9142ac21981ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1092d4930385cede5c692f10fc6dbc7b743b1f925acc053bef9183da93952ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4e7bc26fb86f83a144fc9352e332b3697d98e04ddbe506b462046a49af9e503
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fb094667b697804760afd0ceb960f6c9a5bb95b1d9bdf5fa85c8f22014faf63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 343169f16e05a5fba8263635923e029e5715a495e302c0d84b20cc1732ad0c42
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ec0d6ae97b66311cdb50baac98dc89abaef5fff81e547e8da5cf7892f191d32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c07b26fe161d7c2a163708216bd9ac3737758e42a71e573aedc23ff3eaecf0e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54bb5969e7111e3c3eb6496f3171549f70fda4800909450c3be904c2b4386b43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45cc44ef160f0a6316be1491536fd29ca9a09ce3843adc0a4aa17ebae94449a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb7ab0f265ada95950e1fec22944524be1e8732551fcbf39e24f15f40d5e2dea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a239550221a97be7b8735cfaa98c08a050789cf3dcebf88f369a24a37582c4e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a820f97a7231b9e1afda272c6af23e1ecbeb1415c65cdd10b7e5105cf7b1219c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e95ec1e9e7f5c087ad176f479fce5c8b6d846def845d72f63d78904bdfb7d307
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fcf91adf87956911ff4d3159bf2a380681914c5e7a6ccf8c6dd4d63f9f23643c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d0d8eb5177b39e5fad181bc78c81742aa1d81bf9e39b137a7f22b109b5a68ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e3d95b522ff415c21583e8f78eb3d9418f499e327e5f1b04b81b6156553e2f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ccee1d4127643b94fa0ab1c6fcf76bc8ccecdd4a087554230e03e34b982b016
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 190dc7a0a020ad2f0b7f7086776657cf922ad03a6c7f22022bfc9a4a8970f2bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2be821cd9c612de2aa70e6d976913b04328b6b91b30894a80da354e40a4115a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cc1566b2ea45a4e5d96f57c4450d72f3d5f755822b7cba91d2d49558d91f37a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6cc88559430ce1b9d676fac58920edf9e59f29d9091d616ced4284886e8b0188
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b1ebd9bd9f2bc90556333920f9d4ddb18fc6035d4c4e407c39880e0e84e630a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0fe2888e3ce69fe3e18e5f7e2cc5c85e542ed80acf050bee6e667efaf1bde56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a39e4e6e60164ae8884549029fca5174c88c4208c66992d7e5bc19d0d48a7413
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b00b41de6d2951c4d514f9bdc4a587ee36ba4bb8a965cbc47e33a67515f5f666
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b87e5c1b211d949100784b17db292f042bdb9f5ae9ad235fe1298cb40c475e7b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c9b46a31b71c59983cfd7612f7ab194ceb68c1505da1ac40851f4d6194cca1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9f51bf6a35e7ebcdb08635ba6e8fdfabb5252490b14769c23d43dea2f6be909
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a3c90bfacf1071f16c13547e8c6262964a06f4cf68c995175a4a7b313ba0b5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 147edb2dbf277a7c254dca0c4c53eec7f1892170fb25475a1736a6ba7fb700cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcd2f4164dbef6a1347f117214efe274786e548c16af6c1a5700fe28a6997977
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0eb49a3e9a4c42a599c8add04de16737477f195f3faa9613382cf030c19f824
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39423314abfca1c8fe55cc1777f21489c91c2b2ea6f151088b45c3a3f60d416d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b06eab9470f06aafdf893da5d462be3a62978f8d8de73afc2e9dbbc9a0857a76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30a1df4684ebe0f23496035028eaed7d4f3d16e711af72819b9653c90a2312e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abc6ef08bae9c8aeeac64dc58d77bd59a65243176424dfa0866bcbb4489a269e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07b723161da9cadd9d7d059f3a206e5ce1abbf4e63cd732bf26501ed4efdee15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c8e9bcb0ed0f581ac408c77e60901ca2296535205f28f9431f4e8c763350cea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abbb7655a2947f8bbe0a49e750babb802ac60e242aa3d785f2a2a2a66017db02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d7629d77d49fb8033e1e82d907f7ff716b140828b375ad6736ccfee427f2864
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e1346aedf3e22ea45f5c7dbddb68cbee98c9239c7874c0f8023bd524abea46a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 249bc7d7d0bb13b66e3cbfeaf8ee55a91cc13525dab5aa80a3a03179d23532be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cdd883e4c4a159fe1a8baf72c3a9d79a3e5411f19cdfed09f54fc999c6cc6960
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5ba209ae85cc7fa7afd4c19288a187bb4632da354e89c9fb05136c5bdeaca81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e065cba0b682a30985481411eabac29a4b23fa95af1c48b5f91f24b62156e790
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53ab759e123a658a740fe5bcb82b5a5c512e53159fd1d4e58226ad177ac3d43d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d969b6f707d618d17ab39d84ac3d26f7400fcf7f3197484c547533502b7c090
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0503420e71514b2eca9ef323b4bf8980a11e412acce76644a11622e0564abfb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d708d806ce7282f79486acff6b1aa5c3aa3e33a121d917586078086559079b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 261e79b0bafb8328a444a1f24e55c6ccb8692c877c63e9af2d66e2b90ce15672
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0304ac5a459b29bdf38976f9499a9647d3dfb9333237ed7ecf6c8f869a609e9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f28b2b455a03e22aa18fd3d809fbf0f9f5a75ec7d900f19f7581fa6e13710717
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47f159c488dc1c18a5fb7c395c6869386666ece4c07deab32ba00265d28c8d02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f33b77ef06c87c8a2feb51d34d5d644fc526a32a387b8e7640c5786777eddbbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0718caf9dfff2a809b2b692f7c8b9ef107e53d21c359d83f40c92fb7375519ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f0988003cc8c6f24b81d8eb16cdff05bd2288ad6ac4eeb9da7181ccdbbef1ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbdf3daab90b6d0ac002d917da91d5aba2729e374049b969d51f51b315decfd8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4e7fa50ef307f7725002c298f9a4b53b7044e10529d5a1ce42bb912166b816c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d31c20e42570771e483488c6077b68e35de2046c898c6fea4a740a10b9c7a3eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cd1d57ff76ddaebacc1f1a49ccf33b50dac9403c1311a8377051096d485c6e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa0fa049665eef67953bc1f71fdf2ccb69cce00ea191380774e3fbc7cf581f92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d09d9a229e281d397c125fd8416a6115bb1d67ac1a8e64acfd1eb19340f2c067
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10036716d00d45fce010b11390000a749107d34084031f0b9fea537b15259dfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3afdf9c6fdbcc48eef80fefb1d0f20b9b0220588513593d5fbe4b8fc359bab78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c423c521130b157e43a5acb7d297674508486c178fb610fae774e04b6ea0e20b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b849eebe75457663fb9b28c20da12e32f68eb2a68797c70a3f455d2315798d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81cff06a3d8bf77f8bd9221e1d4c5c0755d7505579fabcf0fe3498529e383560
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c3ef3995a65176156d3701ea2b066a9cbd158e1c9ff34d4ce466541374c0ce4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93f1a904a7c0d3ce713254f3945419a9d8790659b9399f634694ae4ef0492ba0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7efb0b13e0489beda0c7e163f3cbd7dfb747e55a390bd59a0e5d00ee6645532f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03494cc3f285d990dd4415b4f65138c35105bf37ad208e238d15eceabc791829
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bf664179ce72f13c7f229add7e9db9e368893a908d73b3b219ff79ecf2d29d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8806e0f60a74ea3aa2f17efff7b9ea955b9e616fc6e45d8c4ab41f595b372155
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4288f04c60ea519ba74e15969013765a97fce192510e016d5eaefc4b534f6de6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b3b99c1f24644e99691e83833cd29adf6e845d14528f6f13923fea27fddf2e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26383a1e625397c021f5236e77d6515466c60267349edd9000030b5332041c46
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91ab7bcf3eeccc1023e1041ea01485cd081bdec30aa06071061c7ede64a5d8bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6fadbc2021dc763efc3911abc1be36a0e9e1251e0878b95624e84f23fc7893a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecae5c68ee126f9101cb0a022dc5fa34d233fe25a4e363e492019fa5be80469e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6c773c35ea13140e0e65358a9f8baa0f1dd2713bbcc170aae465d229440ee1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a4bf2d667ee1332ffe1bb1ce54dae46c99ec7d92224f89274770deb7de2ac1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fdea88e2832bc15ec7bb82f4c332483bfc9ded1edd15f5f7c142ec7ec3b89b3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f862f4f7c9a0147dd81a6dd8fc0c87c58ca7960748d124ba91451626071b8bc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 829498f3cf5b8e325dca5102bb5ef067bace2a4c6a91a1b54a71f55ef95272d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fabe3394cd6549dbbca5f23c70a9c4f382b604822f987c46efbd27b993dfa410
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e218c4abf736c2dd19b755eb319a68f856a56f234738f915c5509a9fcae8aef8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66b4e71c32c2474ade71b9acdd7373c6e3a4052aa2b9fb8bec6058cc16001421
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 108ffcacefed179852ebb57765489bebce19dbd6a740b894f977e30fd40ab78b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2c2b4201daea6d97e5a1830e4e10250f88306ce17a3ae57188f1c2c826e0bed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09da0b8b32e07eba603ada9600fbd399c694758ba2178658658cddf46692206e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49100741679cd19068292e75fd37ca1f2d2f2c8338a562e1ddc8f0c6b3a9b9f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff186ce118f6404bc4654625ccae19b438073d8008e8644c875631fc921c220c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65fca69692793257cab450bda259ec8b122d5d79de3a96acf322460fccfa2fc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49c65059220fba06219301e094dd949bfa91772a2c9b991224fcec7da051bd57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c4257b2779963c6e87f28135392acd83971002f26f825e3ed99fb084ae634c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f015178fdbd55beffaf363cfb5873d4dc771cc8d2c21dfd55352997ee249542
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6acfd2212ef888e14fc21b9e03fbdedd0c529264d4495173ac1eb27d746517a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9294ba350a0a3546b5c03d9cce408ccea0af42049f78b816c4909cf307215289
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af01016223a060cc7d213ed4f2830905cfdf756087ea90ba827adf8576ae60b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c82dcec5050aa24257c1c79492d98c617b724c235c71512590ec665c6352629b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c06124ee8d2f787f2d264625ac067af1996ce5f7f7bcdf3ec9152d7612543d29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1569fd5e680caa81acc1b18dabaa16c18e2b36dc7fd5ed60e5da92b79981c61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9d0640657a65ff6e5045ced20052eb955de013309a6965b416fac2404dd571b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0208658e05aa60ffef0fb3caa1cb05f1e108a6b489452331124c6f7aa2e84bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a24de738b24f78b5cb7e5854d325d859eafdc5ef2f50dac887a8d67cef79edde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f34675025093b7b0551a6e5984a512d56ceb05232acec8d19080051dd42153a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91ec0cd2ad64bc5b617ea44d41a92c64d9cdf9138916869e18a94b218c809408
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0699c7d7a6c9e6684ea3d3b7611c2f756a0416e5a824eb5ed535cb89aa17e9a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8df0fa4d6d9b4629716d013adaff0ca1e14b0ce66d71f334ad719d244ee33e39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cdeb7b1fafcfbc6122bcd0a8abc3edadf61a184fd9b62f20cc4b00d18e81347f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e7c28099e18b3a31b5837666dcd272362f78414561adcc7247c9f434a19fdff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cffb1953faf4a3a79b80ed35cbeddb95db847aa6698803b3223a7fc1862868a0
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 1.1MB
            • SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
            • MD5 SHA1 SHA512 SSDEEP

            memory/1608-7-0x0000000000400000-0x00000000004A8000-memory.dmp

            memory/1608-8-0x0000000000400000-0x00000000004A8000-memory.dmp

            memory/1608-694-0x0000000000400000-0x00000000004A8000-memory.dmp

            memory/1608-16-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/1608-10-0x0000000000400000-0x00000000004A8000-memory.dmp

            memory/1608-15-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/1608-11-0x0000000000400000-0x00000000004A8000-memory.dmp

            memory/1608-22-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/4356-1-0x00000000750B0000-0x0000000075661000-memory.dmp

            memory/4356-0-0x00000000750B2000-0x00000000750B3000-memory.dmp

            memory/4356-12-0x00000000750B0000-0x0000000075661000-memory.dmp

            memory/4356-2-0x00000000750B0000-0x0000000075661000-memory.dmp

            memory/5076-23-0x00000000001F0000-0x00000000001F1000-memory.dmp

            memory/5076-26-0x0000000000400000-0x000000000051F000-memory.dmp

            memory/5076-24-0x0000000000690000-0x0000000000691000-memory.dmp