Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2024, 18:36

General

  • Target
    1713f910b1665190518dc7bbabe4fa73_JaffaCakes118.exe
  • Size 969KB
  • Sample240627-w82cbavamd
  • SHA256 984839f6b442be7c2d2b47c07d39ee1f445d0f064daba9d42702d7366e0fb5bd
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • lelekocem02.no-ip.biz:2000

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    12345

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3484
      • C:\Users\Admin\AppData\Local\Temp\1713f910b1665190518dc7bbabe4fa73_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\1713f910b1665190518dc7bbabe4fa73_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2220
        • C:\Users\Admin\AppData\Local\Temp\1713f910b1665190518dc7bbabe4fa73_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\1713f910b1665190518dc7bbabe4fa73_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1764
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:3568
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:976
            • C:\Users\Admin\AppData\Local\Temp\1713f910b1665190518dc7bbabe4fa73_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\1713f910b1665190518dc7bbabe4fa73_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2512
              • C:\Windows\SysWOW64\install\server.exe
                "C:\Windows\system32\install\server.exe"
                5⤵
                • Executes dropped EXE
                PID:400
                • C:\Windows\SysWOW64\install\server.exe
                  "C:\Windows\SysWOW64\install\server.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:2140
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 564
                    7⤵
                    • Program crash
                    PID:1536
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2140 -ip 2140
        1⤵
          PID:2460

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 d6fd084415192c8e343a7ad4f33e40bd7dd66b5ae2ba68112334bbb399df2efa
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 6274d1f71407a297c8289eea4fa89899ab1355f6cdf8a575572ccd08d24e429b
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c5c2857a1fcb5307a7e4ba29aaf8f6f5ff36f2d8ca1ee27b1afc885c9e5d182
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5135fee642cc06619a3cca4804e7353e0332ae8d0d28941872d90e2f7a6dd978
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3030b65ec42821a9806fe1da1a9a6e0dfbdf40a1e765d1dfc25f685c14ed0694
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 23567efec411b69c1aee07a7a0ccffd937f9bbe66719a8e2d6806817e17df8cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b0d424ecb07da82bcd7893a84b15a0c36c94d15bbf17e23b0ddbbea6532b68e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e791bbf5019c9f068748b8a47c6a3cb234ae5953d7d36dd8ae9f4b4a48ca979b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d03b6bdcb70f615c707fef263f7de1f99e0bdd29043f8a2a5291d9e2a2638b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 148852b46a045bb89871abb7acbc10ae3030fd6427e9b8f0144ddab548e07aa5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c77da0281d32ed53d277cc9f3d90b6d44ade2e0b47758638eb15cccebef9b572
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e838f64a4ac1a0775376dfe4806d0e6248d3f27855b0eec5d4e7c37c0c372b65
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 628fcac61606a88e00fa08ffe069fa675649ed97c8fb066e0ac846bc315856b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cff037f8509de9331e27b31fa8e3ed2754e8d1c93e888c206b05e4ce24b6820e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14efc26c15546c8958a9a5bcb72872d0d4c4834a3e7ee83f3d1c240cdeffff9e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 35939343c1a265c219742f1c52b5da16a046c1ee63aae1ccd1c30a9fdaf75afe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 947ca561c43a8649071e84830e3ea7e35a6728160087e6237a3f37b15a43a042
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 726c686d70ac2297ba329ee133a95289f5f5d45f13db25640a0e132525d2eadd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf287060d7550b34a8734c37d0c616792805034cab856ddf30c2e63b18f8077b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d017781c5d7b7ce1e934611977c9be916068408ccac32d5b655de0312c79e7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2e0d52734ae1f54861cb9b949a40f524d94ddf47de83b8397a12a3584162b498
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a728e2916b23150c09b857ae6dd15c67fef40f7a69f955a47f6f36865f4cb279
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4422a675f2f8f041b2a578cd72e65f7e52dbc0c33be2fd6ae45262b6801b8821
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 277c8a2d1972130be3a981956e9d30f69cfa0a55229f87b6272f18769ff88e66
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 82f6f3c9643058d5bcfb2c76705850e423a309afd97288548d51519efb47199d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ebd14a292364f1f45ab55273b17312bfc0a4fccfee628b4ff879aba5bcdc0bda
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3fdaf9fdd30d71bdf56d8700ee237302feb76a7a5e75b0f519847d772e068553
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9c26b177579d3b8392d7983ab5d8ac99259842fe53338a0dc16db750a62f281
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e617a2bb0a5ee0872fcd2ea9164be011494e5a026912e33fa0f98f31c35ac67
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7b3853fdc82ebc3bafc9a60277222312019bf7003decb5f16f0a75268436f6d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 64db5087f21e4431c5fc4c2fc49ac89020b390ced14b0ccba3258991b5302b7a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3658d4704e47bf50db6aada12f4790c9c37a1dd92ea61321eddc5b267bd837a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fec75373f0038b4d1e1a2d15bfada15e27d6885751014bb6ff57a8c6cfe2e382
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9bdaa58b1045ce4b797c598d78a3bb83e38903552ba23d81b8a92a8cff95c99
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 984e52144e570e23ca939c4bb771766aa7bb92bfb6aa1bb08dd4f7cb27c0d90c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4ee243d2091ccd5b1ae4a1efb80321845986657f359d0fe0469985604ade307b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63f41ba2ad977ff1c1446ecaf39ea492349b26339ca5b0f84399809d0cea1d8d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67cb79e2ee3d1c2174edb961bd0fdd869a42fc63079ca314e2b7eb711683c7c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cc963f9b2e0d2f002caa6a7438ddd9f0341518ddf518713a05438d8b401a0259
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0fea092d4d30afe7d95fa62f03bc033a14654a75a3f9b78d57a8c3a8fe185322
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bd9c66369e3684c8cacc98c6ad87b3bf76bc88dd0574d7e8cc4a8bd6e89727ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e468eac5a9a96648f870c5e78150223b06c7c8ac6727022678ad0ebd45a78ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1063c0da8c861b66cd38ce1dc85a635ee3501874f248a43db4344d6b64c321c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 542eba77832125d7452e83b9146f19aedf3276700269afb44a06b7cf638e9fe1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d917dccef7c3b49ae21ce24faf82793d3f08199be21063be2671bc213324f1f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af4fb8bda8baa1da568c08ef8782a5bb46fe5bba95abe3d782c55e1e412b1f9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d39d70cca5bc1b3839aa95eea09d5a4d1041107e4f0a5dfe031d13f97b9c2ddb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 070aaa5312339c0c1baa2dd6a7dcdb73919bb29cc920ebb47687572b4b0e59cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3dfff114dcc5081cd425eedcb1e84317f9348bdfdead98df0fa7eea10ee14aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d05ad14289f00a1e33fb720b6c187da7f795b08d9c93d71e354b6b1b6a3aa321
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0b28865143a7afe6ce659260446eb7410560ad7ad71e12c385ca1b3925578b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 298708be31ed1228cc8899e777e1c0f5cc0bf59226853ee591e30f713ea80fc1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3d423b2dfc2b6a227abe60634ee1d57e7a81e0a0b38f0321ec8e76b4a4337ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2a76b4793d2cd47b3e4cbcd0dbcc9d2196c9eb93c538d63a14ebcd7e2da5b7b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 888caa37e7e5f72a253df948ba150a4d4171c5f8ebfd26f4558b9365e1c26364
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 487cea35d8e94e078fcd8500afb382dedfd2e2b97fa94f2858fc50bc05601aff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd880dab082c56b6f54b2eecc7e0d76da04e885a670125f8a4923114b9bfd8c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 163c07e22290199b6cd2eaf657d071bed182424ddb49b768efb8434e3b2aab78
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e532ba7251c949d33242b58e96dfe33e54d591e75799ad1fd26aacf972b57f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c1d98d505911d64982e3fa57c935168d84438a7bed1316d943514d5304a97a3d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 abb725a4cf4c28e54e71b7a59eea3cbe9b866c774bf400c1e2f432197340c510
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 967ea339d90d41cd366bd1ec46e12cc972911c73dc2bf8749f361127b9c8b3f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17a1cea09cca514b0206ea15bd3a7189e88b7a3a8b6ab4c938d52d3f7e4f2741
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a7abeb475285b0d4b21b79017dafd55f0b94a3c5e8ec406183ca0414a7b8fcb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f9f9fff9b174dc8bd1c9d886060b7b0ab666cc5c460bd815ea30982ce68fe76
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 475a4815a26dad3ae00d485a8014dda1be5a248a2456d96f1d67c097563594f7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b491891083d72cb3e731f8c7afc1317830569b34afb3b99fdda265cf29eae910
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d43570f7be211018cdffaa6cc0cd3938297475d0196873de778c662ebb2b2de6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b429b9d7c686c11b5d8a301da753792a5d748a732da363fef65ce33d2c4e9544
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf3f5d41a232ad7c422f1e05dc345f9b895a847698ae4b2a8e4e9499c6eac999
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 037febb21df2c1c2692d1d8cf0d8790bc5794b90f6989bf7380873dd711c7f81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 382f5cec0bff12dd7cd362dd7142c0dc9bde72907647fb46e10116e33fe761f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a73bbe4fea0798e8c2d601a914d1f50b60a0bcf4df8cc777458aa8c7b24db03
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b6cf228db17f10b050a366f90e459971abc28d969ca13d72d14f182da8e6584
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4761afcbcd7bd7fc678890c2eadded5bd74496c1e15b6cc68cd9d0dcec39062
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 64f32b5a95609aecfb5523dd029db979bc5b8212999f7cc127d912814cc22758
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7b399b419d7e0fe1dc35c90b2435b0a6d4133a527a8000300f8d867a9e88bceb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f74120e3c286d92a6227cb10d297014e254d1de189cefccf19ecf7511b32a33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb414e8319e117f94582fc14fdb8ae075df1a64ffce74d248931cb2e77bee3fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42e4226a6abd939dfe7f149199c1e2b843d52e06e3226cfe6b09b0e5763891c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4459e7dade8da70a142d4d5d0ba991a2eaf0372998f3b110ec450f9e6422e291
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d235b07fffbd280fe991bbc631ecc3ff3cff11e8400dec5e5bb6a8e63fc05d31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f1e7669ded6123a0ca1061bc66983d5c38cbd928b9a705871efb3608efe7312
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1e1413991760b09f860fcfbe03bb809a91b955b3db00ef99588beeb5781da5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a30014563878c1b8da1e4fca62a7e20d41c4269394ad09a06d4a4587825f2c14
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7fcceb1c89a0a922deff4f975251253f1e6d0e17e051faadfe794128bc194ccd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87397e10c7df23effaa676a4f73ddb2c28423b41a4c1fd08bac7570e7bd30160
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0b7c6030f27ef9ad646f5bce18136399e3bb3630da6075696b127219fd4d9ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e7259a0e3263c7915e21f03781cba1af4501b9798121ac8692448279baa0ff4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 336d0f589a167ff708fd4dc94c02d4225b56969aee6c415b9b5bc0052cc77ba6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 300f3254452d6b6cad9f06c1460e8e2d31b63109008891332afae7b09086f58e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c55642586159ed203b83b1ecc097445114bb387dda8f45df3b47c1316662fda
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 181fa431f20143bcf4965bc41b18834a278e6b1ec60c279c5d8e7ab0974dba99
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 691b8e6ff7fe29afe439a70892e2ce8fc5d5eef1027b7c00d8e8659a3695c8aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d7c3c91730580b9d643eef255103899ecd8861c19e367bdde42d99a21e2f76dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3af6b48fade70cb47832f0cebefa7857dc20b7ac805f71b641dc8b5314c5dd38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 05e79f83e4bb72a475b3f98b84e139cc26c0d7f46ebee90b03cbfc1f45d50a15
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20bd1dee32b8cee81eb64800e75558fd10e0ff837c01324da6944ecc96dcef6a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bab2f4d2c10b50f3fe361e715f7773cc2c5ce234da53128d802336fa51043b4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7cb1a2b7d84e16f0eaff671a47dda1e14d20e2e6cc7f703c33c032e8453e6f16
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb7925b8fd3a21c751e12b99596d98e5a9f7e7ab96a9cd32f8b767cdca835f40
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba89dd609a99c8b19f70d79af1fae06e13c6b1b9e653c32855f8d304afb40361
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d908b136e7e1696472aaf2230bcfcb0ba433abc8ee0bc0f1598761c6f02d8467
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1710c37cf6b4022aa4e68ee8e89fa5f1c849b7e3168d157c7c56c4ef3becbb2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b19d9e5212d35e0ba4618ee79d24b32180f6642add507848431794b37e69b637
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34368047dc0f762f550951669d6171727ddcc3e43bfdf3e14bd8e37c726d12b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb8ec8431406319d2bd273a9d67beadebc1463bd0fb80e8d1f3b8a5867695e91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27f480c996fe492c66bca5c76cb26e59a9b7c6ec0201ebd1a49da1362bfaa063
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f039103da2f154a1750b9ac7a367e92ff53712424331ee5bf36b090e81053ca3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5dbd5cbf141969279ea9e54d89c8fe9cb10dc80cc00c7bed7c4a0051ab246d38
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d5d4302f3e2ba639e00f6428d230fb2bdf01404d846e54d822805c49239a913
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a77c7e02ce89169fff977e4d81603174ea477ea0b6e5d160137882dc6fb3a26c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 902213d277454ff118beaf4996bcaa63d4bcc3c5e062bb9faeaa53edbe5dc93a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b188ba2aaf2bf90c97576ecb7fee9303902e811235af8d3fa0ec655f654cacbe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 29f992412213f73d7411b47c3c2f00e6164d1219748bf455620e846380bfef47
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b39137c13ccb7004d7f1af9bbea462db2fc87e3cc0ee53ce47eb213ec70a283
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 faef6c6236dc575d1144d0a5c7658a7f0ab9626046cb5eb8a8451ff5eb92c22c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c667124310564a1fc011b872ebb30b0035f40a63dab775304c31888cf41addf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 64ce6bfbecd1635cb3544879ccb229a1c475231df2cefbcabe1803aa44acb151
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8701c93de6f64f195790a2a289f2b3e6203c7a9ed7f1ece428f11c637629ebe4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0c7a720d0387ee87847c6ed82b5f8f714519d3e552a4c78715f8d06772a7da3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b00ddb37d5b34e9240682add117b50607340ed539d5646be3b7e4966334c407b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3ea23b0ec27aaa8922a21ffec35af80a98508e8ce1f3171b5889c7815a5c515
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2246ef38cb6d0c3819fdacdd2f8769bf7ae0c8db60d43084e8009e2680ff8b3a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f28177dfa4b05b2883ab1d1ae019a08923cfaa1509d2abb33f7b0c75f7cc2c71
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0804744bc2a03a0c48bccab37a55892572440da1f4b3b854fac618db7b4e70e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd3cefa9dd2114ef52920932b9edb4e2a38ffd5b6bdce52fba56b4eabd6191ef
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59c863ac82d6c8cc610f78661b53a701286a8324309c529ad4d41136ded85570
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de06afcddf7ab4e16ccc10b808b0722823d6fd9c6620bd8808b81ba98e534513
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7dc0c838a4184fa9bbc6f2f495e257ba23092bb3fde735a8d94746f1c0d2f9ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 416ce214f036e798ee07bc80a0c564692d8a797f5896c3684a57c143df848f1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 88861bf58cdeeca98ba917c0bb86dba0be8c30e550d36c4bfea7ce0429583f28
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b217ec568e20dad0d6db1a670fcd1e3907155541ed4bba3c75b73a76a2a9ddf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16955e095daaf23f43b74da4946894599f7c860ec626c05cae26f62b28c16c2b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f914da84a822b65e851d059e14b43946126b300d806724ed34658fb42b098631
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d088ad5e7b275772456765ed669edbb6f3fa0030973fa9c305849ef84dedf751
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 81275eafd47dc4342bcd9db12475cefc53b1a4b9e9bc67ea54e77b7644820786
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46c339c6fdb02865124ffcedd7cab6e476b9119e1c00a077214c3879599e6452
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c832b43dce0806c55ae7b84311487b2abbaf779e01ceaec983ee56f6e493160
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 622ff0da88d92f35705fcc89879d7f6a38648921ad96230cc84f76c0f0b0bdfd
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\install\server.exe
              • Size 969KB
              • SHA256 984839f6b442be7c2d2b47c07d39ee1f445d0f064daba9d42702d7366e0fb5bd
              • MD5 SHA1 SHA512 SSDEEP

              memory/1764-3-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1764-12-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1764-5-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1764-4-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1764-8-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1764-1-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1764-146-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2140-174-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2220-0-0x0000000000400000-0x00000000004C2000-memory.dmp

              memory/3568-14-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

              memory/3568-13-0x0000000000C00000-0x0000000000C01000-memory.dmp

              memory/3568-74-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/3568-1300-0x0000000024080000-0x00000000240E2000-memory.dmp