Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2024, 22:27

General

  • Target
    1dad4d60a2bedd9d8766b1100da1415f_JaffaCakes118.exe
  • Size 712KB
  • Sample240702-2dcy5ashma
  • SHA256 d7283faeefc77cfd83d2e04d802ac364328c7955aea704bb9ca21c9eb4eeccfc
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • ameer.no-ip.org:634

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1dad4d60a2bedd9d8766b1100da1415f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1dad4d60a2bedd9d8766b1100da1415f_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:2084
      • C:\Users\Admin\AppData\Local\Temp\1dad4d60a2bedd9d8766b1100da1415f_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\1dad4d60a2bedd9d8766b1100da1415f_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:4960
        • C:\Windows\SysWOW64\install\server.exe
          "C:\Windows\system32\install\server.exe"
          3⤵
          • Executes dropped EXE
          PID:1824
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 568
            4⤵
            • Program crash
            PID:2104
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1824 -ip 1824
      1⤵
        PID:2956

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 a077dbf67c73506c0067a066534f65c3bc5f6e9d6c44200c1dac73471f363284
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 230KB
            • SHA256 6221da0855a8d32688a3e3b87c52385e86bc387842eb78de9ca0ce7b10f1e366
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 545167b598309ab68f3dff002a7cd97c7f5b26111b2638be31f0a63fbf869383
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3e0606e134d0ad59d1d72a249cb1acda200150d6fb9e1b933d81066f39fd60b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f46fd388677f0cd403ad23369d38bb3c86b9eb367cd1893129e595ab11ab18e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c68ec25ecf842d680f158137128b2c81b0cbfe06d952af8f38c08ac845786a60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3938f2a13a29d58e62d4c2a038b52163763be05d4edb483f7579b96d0b25a53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f688b863e51b6a9850acdf06f9493d88788f460740896de9762ea8a43cbf2e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17b3d75e7d083b0211aafcf3eae5c90496efde889b4d3bf54ff1a7c153863a69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e40404fffc50d2abd0668e6f92bd00f0a7808f9af58256b87c31ef6ba346490
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa8c48cab679be0bc0bfb25478bd40e5bc273233eb3cdcc7fae5471c1ea0cbc6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 874830ae47db2a17e7523f14ef20c1a03aa7cc9477672220a2b1990875267e38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ded7e0b5a26c196ea0eaa0e7b95396525aee55b117cad677ca0ae1cee97d100
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1644e06c9295219b8b78094d35e77dccd3f3955708c49144360f6277e2131fb0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01825b9d79ccbe8728d80c8fe8eb7b47e6af9aa855d279336a0a0753a840ab2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd0c975d32c184181509448b7acb9a56b84bc78c2d8214e6ae027e1adff6f555
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5cb9664a49070f93d46236d16e3d11e4307d76dd4d2ce6ee76db31b47334d95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b27ed7a4aad9662b3cbe50e28e2f299772421bed5cac557a1144c8c16574dfd6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1235c019cabb1108d4a9d3a872204e2f674286a727b555900cc17e150e438d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8d13299f22454b1dda61588a26ddcc284dcf83657f41539c2add782f47399f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d6be22a80e872817d3f597879e1f158d41f5758953a9053fe8f03ca9a5f3e9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b73bbb2b11352282d44689a54ccf3d760441a1fe8513ce1cd1db3c7b3eb24438
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d322cfd33fe3f399ee00990ea0c0834405081d2e89a4a6bdcb7f25d18d00698
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79dc1cc0c335c6372a154865e357f75b98164d676e6bff1270c6d7a90203e1df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed38bb006d8938ad24029912d85c2c2e66b41de08f934323c6e5becedd522e60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c1cd59db37cfde220d1e89d8011afe09fe967b1423771ff1a764f3defeee4ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8a7510bfa598b5619d17f376e786982bcf269d6124f4f5a9e4a5b39f7d61f86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 149bd4621252c9999e59fce5083d06499b4af2cc136674497314848310c313be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ff84514688be49b79d7af678cd49c566111eacf5eafe2b26d86ed0b2b3a963e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a524f66f845833bbc8c37ec3ac4bb0cd872c97cca4e81bf2efe6fd09617ee0cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f421151a6fab64f11fe5fde836bb9a6d6138a9c126891cba080d259179916f2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a18e99b9bbc8e445185eaa098be3d925114017232e4538a4f8921e4337e793d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca1ca646ef20f4eb46901eb0be11ea6dfd469d08e2fea3d460529d2658b15fa7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48107534d3714a82076841465963ae3ec6ec3e021277e4ed3846a3fba655a9e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d8e5e58a6610119b9bbea0f09f99d229ea49f503d3eea93433fca2e42b681b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d83aae3b2d0a885eb52d169e728045029ce2bc0e26016ed9d2d8821860ddbde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 340fe11faeff540fd14ea51a714dd79245ff1d2174c7d814389926d9f7ee957e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f03d3d73417d10eb1f52f8b2bc83ed00497f9c2c7e335bd95ce6b430e5c5dbed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c7ded53790ec9ba9b2cbd871143d0a19a2c8b8117a76351c7a231b2e90e790c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d37303d6b42fe4187b2497f27518fe7830737f87c0beeb74e202b3b46915800a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 891b721dfd5b4a8757b7d71e7092df8d26e0260a521c46b84b392fba2c3324e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4cf8d7a465cd3f37df6abc6e2f7120a97701eaf871521fd21ccd2b293bdfd017
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d798cd588e3e2004089271368f470258859931849f6741c9acabefd9856c610e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abef7828eab76bc0208b8de90a7447cdbbd1ae0722c03d9750d456e38ee37c4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6443c375d5352819f7f68be9b4e88ee5c1dbf8b917f81751d2e60b3d6a07e0a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e7b4482bd0414c276f595938cab8be44a4555e37429250d42e37f73c71f389d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df197b1edbbd15a4bd21d4f2ce2004d5129cf79394dcff1acb87d308f915d3ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7c669a32676ebcf6fefc10f61edd3367148631651fdee0efa53defd6ceb5ef5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fc6dce1f179351098d0a1c3473a20f575cdff6e5758440beafbf04046bb5364
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 efc057b067445b091bf31339e62a0c438316e24a1c88f87033d1f7b387f14c18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e43f251c78a502431ced3af8b22d8084bd6c09fccf7e39400601de3f2c21fa04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c044097cc68d4077c9e7e02c03a4db77a515f40092e0ff63ae76943e107d89df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e05912ca37353845e73725dd75cb9f658723f77e7a56d610012e9c37b08f81b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cdd687150794b501d26c376b4dc14ec98e82c4dde05557c9c0da8f29cab4d9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f08dc7b80d08d24a30909d044496ad47c93bf9e4bc26b724c9257835b9f6e90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aef5e31d503cb1bf386b915f20817dbbfa1ee3d1716c6579add0723768293476
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61792c308c4a6e0adc39bc1a2e31dda4ea071db93043f81926305dd33bf7f27f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6b1fac899f081440e696321bd5c458f705d086bececad625f472e78cab2c503
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86599a0c6203984629dd680cf5b3bb1452e82bf59e5ae4998c9a3f71ddcdbcd2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 801d939d9257ee5386d893dfe5fbe3af3bb8db3c4915f8da87984983f5ed6850
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afd7d2f5299e39d31798b21c956535ab30ced2c1d94f9199e29312e3c47b8a1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ea7bb8ee2e33a2e7e7a23a64465e2da591179115ac031896bec9cdb9251772f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af14d5eb104cb2ae98e744a6851f778c38692c0be06cb144b5ce242a22f661eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a91b55bca44e3156a0cb6d334f61191b0301547792ce52f7a0a5df61bf6fbfb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ebfb26ed95a2f2fb1c30032f2655d81348169c8ac4d2ad1cf4e80fde1ad664a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bce44dd653805f562f503c1e063f308785da9002b54c6564fa2ec885b1ed5662
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b684ddbbfa16dfedf385b7e4548572120d9d376debdbf886c0dee276662f2c9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f74e6692e7591c8a372ac2d3395097f143fd6dbb8bfa9fba9b0547b23b40484
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48ac7409802da90df8ebcebc3eea219639cf2684ec7fe11a1cde8c60753c11da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e07132330457207a3c4fe7361e7600bbb5f10044e20cbdf6caa7f6311d39afc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7235cae0d5a50d7de1d538c8a126e1d89091289c3c84209eda192b2081b891c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02b54096eac716ee7263570e0a90693140f7eae2bd15f0690260f44bc21beaf9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1872c041469d1fdc5c153e5e0464530d68cb846b99d6ce3940c10b6dd466ec94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27069eea9fc8b8b74967498123d81234b1b04bf6a6e51598d6e2c86de627083b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08d9bf846674adcf9a345822d792c2b8db447cca84093f6e92c8a4608069a9a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 580578d259bb83545ee7f745aaf763c56eabe059e3d00ad9512e5e0d0beb4d28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d62b8d20b91b19636243fc3c2b6172c7c9db8fc86b96fc7f4d4d4bd51b96b1aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fd994672d4cb348202183d3fc4382298a47cff944cca49eb0c7a9e088662cf8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f29d00a388d51e41c229e5ba6e28e5ccef033be8faaf99626e4a5257dea33ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 097a4108a78031affff3e159660c39299af19bf6e26422bc596c1942f937c102
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f44b820b65faec2038c7995f2f2fbfc12ba03a1cdd76f21d5cec15e6b67daaf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7b7e46934b9cad5ce84fb1a0665c4b2eea4655132747bc5eddce0da73975d04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4649e2628e257ba11ee9d451b5df0a962da932750e7c1a26ba2bb3cb1d91cbaa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bb37eadd6c87ba09e67bba4257f89af3dda4d604f0e56b26ace8af0b41c4ab2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77e318c4442a84dd514246a58c0d860b39b26c76026fa8ef10ebd14a1fc94036
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d74f4e0a568db18a427ea4680f461e6f5969745352583e264c124d6cb33af4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c69f9eef36244c3028aeabb22aff73653169c703356f6382f9339d1b1f1e091
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adf0102c2f2711f029d9f3f8f20f0c6d8cad2042a7ddcc5b182b9a01b7601cf7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ee5642a62dc65411d998b277bd2d3a166bbe9cfb85651d4ac2ce00701c31b4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b5b201e5db4f48555b63bef15a00f8796f774d00d15894ee4978f9b41652a97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad474df08c05775b468849b93aea1c24b91491e8a0947871af6dd4ecd7c1db7b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8d5aaffa20a328bb316f27ba8377f68c556c119d071efdedd778f97afb981c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7979c3eec306758cd17e008157bcbc78e84a8c1da8bfbf20be4c58d091e5b75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e0bd3d1ad9755a975665a2ced2348c7360e0bab167e42a17388506d609faf93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 584f9b8481c9bdd80a0cba9c890826e8f23697a87619d312bed88c8ea6026b50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10121004b81bd2354f7a9738a93855dcd775bed2894cd0d461ef84fac58f4c6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39d8fdc36fb1a59e1fe3de1ff275b557a38eddc8765302d4db9175ed80cd020c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 000e5af2ec6dfb6166014c502ff31bfae3a9b6f0d6d11a055edf565416237819
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36bb61a2adbd240b71e5d4d086bd320ea8ca029a96c6ff2a676209fe92d01ffc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47d1fe5312a41e271fb093d10ed2feff3b6e2285917aae6b9646125f85205bb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b067439dd8552c110d08751fd8975e9da275bac34a9d4f817e17c70fb17a98a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bd56ee8f8196e2cee498637758bc8c73de2bd1bfc2824e0e574d7271c679158
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2cbdc411eb85f18817cef6de3e10664e64627ba56c4bc1b6f3d599e8b310050
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12e3158c5a4abe67dd498e6ccd269f5fa781189051eb80e92bebaea09364fea8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fcfee90bfb16b55575ac5bfeca28d4f4865a32cc776cda3e7f574e03c475091
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f2438283b3488611a3ddf955c27c3378933e386fbffa8b87e0ec838b84cd23e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33157e2c6a9f0afb18c937b689a92f3795ee575b9cb5f4b8cc2663a7c00917bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edf687feeb9149f030faf5b87db1b11622bb201288adbdd4e24a2253ef8a8d50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9fd76a45f0f14c1a0e99effb36d95fcbb387b394cd6d00e1544bc48d5a9534de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9bce2c716cc0bf3b650b3485de3180ffaff6ec3e64832cf34973fdbb09e349e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f027cd4536a20e2daf95c70e25476b73eb41b32f7420436f176240da5286698
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f2677805cd55dc582f0b8e22066a46b5daea25803eb241448cad946e2b8227b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab39fe4a09f24c89d143f3ea1f58344b54d9cc6603b9aee23311d43d5d319744
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b292f728e7fa29511c6bce659a190d347e58d199e1ef34d9b880d40d9b2232a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46e6385e7f34529f8ac2fd22a0596b4e4209bcc6953edc624744bcde8a85a6cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f1778222cac24f8317b9223db79e15484f380cd8142be7fa5ba10e6fc921553
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc2f603d76a81c08ca1e3361c56ae53f742b098f7e16bb31a79d6778318ad34c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93c6433b58c277fb217ba8031c5dd88c66800ed1e56155520127e5fad47bfaba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2150825f46a00372a7d6ffc65c0bad704d8ac2877f776a567582cb12afe2dcf7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bb6e0f89ee205a39a6bbae5d358234c8c3f9d00937a0f4101b0651d705da75e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fba3c5e1ae1c3b3def07ca14ca114129f5ae09c77c6cd4330f4ec32acba69db8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9246ba5311b7f48c8488de0440ac960474c2038d4ba92e9dd6d16330692c6e24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b4131892ca4bb2c99e8648d7a6859ec486eeb3e0c7edfffff360053b694f9fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42ec343e17b06b7c94d71d5fade8142ead7409360884cd9922c58e1ae414ccf6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0d71eecba409e9abb412d4b698a1a88e6d0494db41a3f40f1a3024510b2a966
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dcb418800231a49bfc6663a2a770d3732bd8ab2b0b4e80f8bcfae7689a806ffb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13d2aa057619182289037946d7b023f2186c084bbd7f02c6e2e25ed8a245e6ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d938ebd0bd9e6818202c552bbf196e1052d43111ee3d41f98ab4892cd4d5a54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c328d5bfee32568de1ba313e8b306ffda18528180e64b98eb0a91ee149d05d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7bb30254788f4926fd689aee14d577f54022b195b9b7eef40643ed51a961b20c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6913f293a6d06e6d5cb7dc1ce30f4ce4d5b711c2abd216cbbb0f5e743f51c461
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58fdb22f2d408ace153b544390e4e8e47d0b1f1f2a2430358ad575575f30221e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89ab6c08a9d2fdfbbb9abf5ffde52a40de1f97808e32f502409312b5706cf6f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ef522d01640b5eed8b8bbf18968cdd2653ef84f75499e5e1b5e3e652c7e775f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c12509149d7d9d4a6456fcbbe21d32da387c41528a8bd1f627f57c17dd30769
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f3ff707f219d5313e120487f83217599509da34f385db4fedbdb15317283cd2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b38079564262ee12c567a106876e898027076b46db07a7daf0ecc4dfefc87cf5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d22cbc3df4b377f2d002d2901d96461381ba6a11c64b0704d8c04b2edc22f5bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6ab6d3b0a77b9c1cf69786af6b752d646aad048b22929581a51bb105a1e3762
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e6f4bb668b9bc763eff15ee920d38dbafe8f9211ef8546444a565e7eeb61516
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0407ff05196578e93770376c04a8a2e6706cc2d2d6acde85908657de4397257
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29e72026473e7e4fb313fe4eb6ef19f7eea8120400ceee838368f451bdc469e7
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 712KB
            • SHA256 d7283faeefc77cfd83d2e04d802ac364328c7955aea704bb9ca21c9eb4eeccfc
            • MD5 SHA1 SHA512 SSDEEP

            memory/1824-95-0x0000000000400000-0x00000000004B3000-memory.dmp

            memory/4444-70-0x0000000000400000-0x00000000004B3000-memory.dmp

            memory/4444-7-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4444-4-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4444-0-0x0000000000400000-0x00000000004B3000-memory.dmp

            memory/4444-65-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4960-71-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4960-9-0x0000000000620000-0x0000000000621000-memory.dmp

            memory/4960-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/4960-12-0x0000000000400000-0x00000000004B3000-memory.dmp

            memory/4960-68-0x0000000003E50000-0x0000000003E51000-memory.dmp

            memory/4960-1188-0x0000000024080000-0x00000000240E2000-memory.dmp