Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/07/2024, 18:31

General

  • Target
    1c0f2305e4144e1c70adb45bb0046246_JaffaCakes118.exe
  • Size 456KB
  • Sample240701-w57pxssfrc
  • SHA256 4599ba39d60a40dfeedeb0aa29e782bde509651136ac664860d3043d8cb914d5
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • picmisin.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c0f2305e4144e1c70adb45bb0046246_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1c0f2305e4144e1c70adb45bb0046246_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Users\Admin\AppData\Local\Temp\1c0f2305e4144e1c70adb45bb0046246_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\1c0f2305e4144e1c70adb45bb0046246_JaffaCakes118.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:4912
        • C:\Users\Admin\AppData\Local\Temp\1c0f2305e4144e1c70adb45bb0046246_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\1c0f2305e4144e1c70adb45bb0046246_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:3300
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            PID:2812
            • C:\dir\install\install\server.exe
              "C:\dir\install\install\server.exe"
              5⤵
              • Executes dropped EXE
              PID:4720
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 548
                6⤵
                • Program crash
                PID:3620
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4720 -ip 4720
      1⤵
        PID:4772

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 f01d4cc941fb1d5aaadd3511ff7585c68c0344a462abac8a7e0a159437f7fca2
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 8af301f5cd77455bd470351827e65d7cbbd07777d9c69122b344cd941e04df1d
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13b4d7b1b3873200d342a5517f7571690a580aa3cc4c219a070474de5286f6b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3c1c933ade5774ac51d5b5a352cbf5c78ef53a7860977568a3e8c2e71d55e35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c9cc138b3a0aee476a2bbf0985bb35d8ee29e9a159424c6d13e28c6931e66a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a5d9f0faef99495b511125a4c5f65b167af7a5502e8d2400606b3e67aab877a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fba134391ec825b995516752b5f88a08ba9a154a00e0ad05f8cabad9419a091
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 efd49b735e591fc6de70db93152d4df9e1f569d9a033cdeff12313c4b5d15e2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 095be85fba549b6cf1512792609e6d493b30b5fd5f87038a048bac65e4dec12e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be11aa4303e55848fed24d8d5c8ebc28cd4bbf8a34bc3e4fde5fa90b8097b3a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebba8f221c38c6577c982977c26b044f5a88e1052b81cb78a67b8e9d3d43dc95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41fe7cae608726da86ea07b552cce85293f6cd7f3e47d0247cb9b67fd421fbc2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40f2351d0df6a4003a7ad7040f1c958cbb9ea09e43be989c75032a50965ec4eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77f46a7ffcf4ca32efcc6b5a2afebfadd6ff0010496c24e072d474e964dc1041
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73a264b376f54fb343923add65d6aac1c21eaea44b2b8a041a004038761247df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cffd36c556f3ad68149e421a93111ed59ff2a48982b0f5c5b6b34f4da50ac376
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b235f51027de20296d123570637dfc54f2dd0f17b4e745f382392dff9785f488
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17a67b3f2fbc27c6783485e71645db0fcdfacd34f9723a7a75a2104b1f12db01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8da8a758915abba10846bfa8c432c8000ba2a878fc9f57ee5dd524f5934612f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3faec937705badffa6cc1937f9702e468b37520100b518b0f30a2a2b95476ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55b2277e6ae7ffd5a1d5a4fcede783d97ff8327ead176612da4144d9dc8a33f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a0063222fa40ed0f900f465a94d06f22a3a3f00d5872cad24e066a39ff54560
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83a4b2e460cf122497b0a8f8e35e9348c07a2cbabe45b692970c8d8977ca57d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 563fea1f17fa1d8552f53725ce563d5c2c9b905581380e0eeb4e279b819386d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05b7d78a33b8981cf413d30e2767dc0173c64551a2dbf391eba234acb481f19d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6c49176443325b91eee060b70fe67910eb45f13101ee546d67ada2df0894a41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21ac9096693f58c59835c594146d211e24b3646cce30fba0184e75c4f87f2d23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9b7e1194e4f0644bdc8a45f8f987ffed5782553cc45424104b093f88d0ec986
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fb78b56135905c9a4dfb0f4c8e75bbcd94e346ca46a75fab4b05d586beb424e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e662850baeb2be7a5f7a4bef541e6b1e79f155d9446223e5c60494f5bbb041e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29247df222aa5b10251d73c2dc3d42540c1525ac0a581063c76045986b977175
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31e0e8864e269ceb4597bf00a837d95b45458dcb2ffada5345f2642d7a548eca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 304999f240ca0bbf9e87b4279899eeab5245d1eeae78b24082dbc157c5cf440a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc19f93dce2120cd6934e0bd24b187b9ac6db0c887ed29080fc02258334c5ba6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b49af8da1b25171354256e3fa29ec9913df5c279f9b583660202b58b683668f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37d9c4cbbd8a9f890a49cf637bf48b0866f0d125b815e7502c8e2dc1f35168e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d188429566246b90a819a955dc4e3c946f1b264f40bd509c9b21f113eb71823
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17f7a5917dd5c9dc29e6b2f23c048ea171ade81f0f2600a47186cea06dc3f5d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9b45b46eeec89079d70b463f51df3315a21f07340958f2dc8440f7a546bb597
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 599e5e1264e8e7d2a9375f208f2353afe13164363a35e48ae92a088ddce9ed23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8baeedc9ac0320c22d2a0d4eb1b3294c6d66b812f456c07ec283beabe53ffdb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd84b916c65a172f4134a3b0a6b393ebacb4796cc7f72d92b7e562bbc8a9448f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25652cd9161a759e161ceeea0293a31c107b012a51c6d1d4d29a4d58a7055c77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c5ddeab9320e1041bf3ddb2a4234d248499ab69d561ab0f24d30f4341ec97a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5ce2942a13b60add98156eda9427cff20c4a9af92bbe0dd39d9b92faae5752f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc44c2610b436e231eb6fdd5c6717526de62d7caa16a023a1e525a558b5626fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79292eb72259b07de6c06ea5f4954d729b547ec1360275859ae15701e122f9ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ec9497accd41f2ca613ece6166c9aae9e0b4b49244997c1bfcc02fc3c74c3c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a68d352f7947fb699ef46774f5180a0cd212a91b53f6b6200a63e916432f006d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 996c3cdb5e1373ee83d12b79cebc7b9dc301601d672697fc07383d20c52bc91a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad39bb3e5e25e262d91d3e35db7a5832b6634999e9cf10391c51b464aabc9a88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 110734c976701017e945dc0fd0be45a427ae858a001a2f99e810b7eb9717990b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa2b4985062c9ad74066d82383a200b3d5db43d77d955f63789af27dc0e3d403
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14861817cd2af5723dfc01f6b70de43d73e9bb3e73b9d47c7d6a1ece8dcfca54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c09bba5e79146dd1ad9e3ccc570357fff6fbb39b2e9f7b5a1a934b7602613d7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ebd7e261b7d4eb443ae5b1c7de9816782ce719825b05a92e05d3b35416ff18b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b62f76b72e7aeeeb822f148962cc0de9c197e8b5e7934b4e6207399ecf9051cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55215cb9f2af99ddc0d42ce54b8d8ce82d0b0f41ef0231e1b252d88a39ccfaac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b050c11e8efeca1a9902eb4690a0bf6c848994cd3281d81d844bdd4cf63c3e13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ed1cfb1788fc2bda9ae28610f0b74cc11c76b1bf7294e32c7fc09f517999c31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce450be56b91eea3e77526ede462670680adbb37ac70d984965965b4e222cd10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26c43e8fc68001732eb05946fd58d63b2f4d89381376981dc063843702fd9655
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2138b75bb6041052b7142808b8fa69c6d68cc5030b379b6ef84424f8dac7f21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f2bbd23294878c641b29700b38801b51cc666b50e3e79d448f3902119396afb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8b1418b21932a75096ab5f3cf112a34cf46d7006ade16758d418d9467b70ace
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d14392383a80bc778af8391ed3d5765acf37ea85daf48592ce615522c13cea8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb645eb7b91d1e459ff562eed86b7820ce806d372d3cbafd57e45fc79f8b1a7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42215ff10aa8a3bca2ac0750670b88b7b03f56b1758ed0d986ac4bba1b0ca54c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04229d8cedefdc179787c0835634a1eecac0d30e2490e5a0319d00c00abef684
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 154b0be550ec9cb385f044a87b8fa77670eddfb74e477552a4f68c991f04752d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f058c433c865ef239ccaf1d67c8b1298991706b67d6683409df5a393f5c5762e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 267cdf529150357738c63aeda3cca23b77d34a01c16bea15141c066d4ce034d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8c51801e87490b0159862e346d38e8255a8ace14d628715f9100474124a2a04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cab0e11d9cd568bef78d422796c35156ae0c9f7e3b8ee572c22185ec6b201ef8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0551dfed84de0514f8bbe034f10ad7d6f91805742674c0067a919de67e25b357
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a357ad984c20ff631d61a082e7bcffc377965d54361561e2916df5f6dfcaf734
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 142112cfa1bcc55dc472c361226c2c588ff0cb3ac3c79cb14d73cd1753128f74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f8b8c51912936503e82d197a0bc0a6d163abe771eb1b1dd1e2a541f32fbe689
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9975c14828c70f82f9566e4254216c9e36956d773129dddbc9a7001b4e5f513
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60f3e0b63f1a4c3ec9961a45245ebced3e22362aa6fc1bb275ae121efc221254
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85a7bfda294ce6c3f36addbe089dda3d49425d3f40841237abea145c683fb7f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80182a75e19db727903c5aaf6aa0b6f3dc96630af77cb63484f493515c70f0b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3c0881d793e2e64702e8766276413d207fc6547c0f5437415edf8374bf8012e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98a27045112e3c98c6986d266e993af8f2fd4f31398ab577e9a9ad76bda321a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b13f29dff86e7dd34601bcaf4776615fb96d4b33801ed709d1401f3558a88af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b895b297d42d52c36620cb7293d2ac85388620a0b5f4387eca401ae41f8e075
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1cb528ea31cdcecc2f23eb6aafae00a111b42ca8b6644783c704552c054f160
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95168e79da0ddfd25332a662753884ed43d2dcd7cf3de6df0646970cd407916d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31182cbfbd5f6787b8fea35fd40fc80a6583bfc27dce544a067263e3ac41b368
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3133161c52cf380cdf32af00eae6d0e41750cf5237a066d4128dd4628cdc7e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bf41a2bccdc069cbbfb79b2ee720c5e79cb35aae9c79955f8f350d72a318c8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20382394654edcc8c685d7ebe725659006239b73248badbe1af9158ca2761f0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac2ab87aa84184868a77e1fcbc2d059152dd3fe0cbf28659e0b001eace419c39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b5a426183a2e9d56551074e0a7d2878ebad9ab92b77450ea47eef62c25ffd2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e44c67d5dbfce489b06c611056e06ee978e0aad279d3cd98024453ab32289cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9aee47d8c145a54172249dc32d3ba65179834065438907046787c2e23b60761
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4ea634fd67d9e08f152a34fed72fd1ae3f6a5f4ac6a9efb76412572323bc9cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48d34f11b010adc720108089c11f2efac56e24017e0b02fbbd95e7464cf218ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb9db90ab147dc1a13bf18df95bbca4b033f78150152e006cdd2a6119aeb4b0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b07cd8c42fb92ae2d7fd70f1b7a54c459c21c31748896b3d117c67ee0454011a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f30b0fda0ce934dcb57f6a501984f5133537969a7e0fb036275f612f547b934a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61c7156d570d7c1f86ea4d348a606855f1381a4ed1f29359db5e5cf775414dbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9dde13df92465c1cd15682555ef51edb4d56e587a04f58df2d2e43d6b877fb05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d94d6682e92a38ada6dfdc8951ac8df19e0034fe1df4eda1908ec8747334026
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06ad0317e67a3c4ac2391db144bb4051debd00c3177918fde5f12121bacf9563
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f72b8734c1240a7794787b445bae9dd7a8c52e12e82621bee93c3fe84159c13e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42783a6a753146f25ab4f23e8774e6865b18c4287d3b95b7ecb5733d46660d05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45f460335a33fa38c7f152b83d46ec757c6f411e99e8deb6ac6d404b70179533
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4c1c3313df564d3a4a168771bb6765cef21525e68e930dc3e1d04887521b363
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1be2fa3996a77dcc0570e829afb4aa7c7c1d8e34d57f25da215fc309a51e050
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f5089a0d6992130a58aee7499b0df9dee95a29102dc9b2f49d55ad9bfcbfe67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca007bf5ff2ee39765224998c9f95e6361f1a3d57b6d2de82357e1ad017f339d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7903829304495aa161de67ed78f7db748cbdb97eabfb145f5ff09d42a713bfc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf2ded94e44f685694a34d58f2eb07f71766452517780ad8627af19647e4e581
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 514fa4ac6d907c2081e55d42e883a14eaf59f29641eaf579edee8713495538d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d47f5b21b14e0bd07d46f8183372e5882e0010b148a896ac62dac6feb0dec9f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f436eefb8baac2c3e6ecf5584b7ac4adbfbbf0772ea340e0af5485e09a26236
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50d9f4287a6c9f06300317d72c8deb2b9032ac0a7ba4a585108d3b679a8729bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d28de614f0972f5943ff5b5117b75c64354adbee0af424247eec05b4fac164de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d566175dbbe30ec190e40b4097d8171a654d1574a35dc4961beb18c20fc2c4af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 011e18d1085f7ae8f189d7bec5fe309242d19953a3eb4214d7d0d8d8badbfb16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d1a81c9de2a3903884d1581dce4682d8d5ba8d496940c7598953a2872edd113
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9601846d59becc72ae828efdb4adc239edddf28b112d61e76f0fc62196c259b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c049a165b2cb9a6fa9b011dbf752bc76ee07aaf4c4b400211d4d2762c6fbc5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9dc490f27522f5b5e76310d49c9f9b7f4dfa5b1a2a44a932e12a58bb9e31dd0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a00fae4ca1bdad7990bf455d0d08e0fc42dcfe24bc4ae11825c567c6af68fc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f7c6f3f32e422b6e90e9224abb9cc4134271782ade57534796a4a7e10b93875
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ea668c2fd6abe62e8bc3abe63df9d9e1261cc74df3b1b33ae4b3a478c93ae35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be7083f5ebfb326445486e873d65b41a5e25a4bcedc2df85d34ea3e033bd9316
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d0be6eee87bcfbaa64141524b723f0648273efe1cec6c5f6ff1b55cf27da8c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1cac161a4ea26b9ffe95a68a89d5133f705634171e09eb044858ce7ec761c91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1ba8ebd1b364b5023da63891a1edde18849acaa4f81a9d5364f1b9c9224b4dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bc8e1ab1fa11310a4cd956acf6efb287fa7092a82525d68c83c7461baeee499
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f41acc682e92080c4e989fc0ec8f04ac4addbe4ec57ca422ed4f4492362b9fbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 033cea2f83013f0aab9b295a626c258eac52de10b83072ba19f817fadb284187
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63a28e016f2623df821e504e473a41d86205c862e41fbcaaab84f0a0dd9d44ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 172798a938c06f37b13caaa69495cdcdd051e58c1759b25f3cdfa8fb0ed52f05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94e3f73a4f40a3efd576132a65d228c9ddba4a307697e4335f9b5d07094316ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6069593ae637bf4d4ee1ffc382d577462404da75133d5e2250cc3ff2246a4595
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5465c21f27f3ea9a14e3ffa4059016a8c76cefddea5d93548b52f59f5d3752b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb68a58edb16433a8876e19a0f67cc9bf95a06c86bbdaa7a256d511d80310fe3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5937f4a20d2b465999182f2dcb84fc48dd7c6f418eb603922a8232ce7ad81e83
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 456KB
            • SHA256 4599ba39d60a40dfeedeb0aa29e782bde509651136ac664860d3043d8cb914d5
            • MD5 SHA1 SHA512 SSDEEP

            memory/3052-2-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3052-4-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3052-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3052-6-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3052-13-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3052-9-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3052-78-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3300-15-0x0000000000590000-0x0000000000591000-memory.dmp

            memory/3300-14-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/3300-36-0x0000000000400000-0x0000000000430000-memory.dmp

            memory/4720-108-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4720-110-0x0000000000400000-0x0000000000457000-memory.dmp