Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2024, 15:58

General

  • Target
    1febd0273c705f503db40c88ec4c03b2_JaffaCakes118.exe
  • Size 590KB
  • Sample240702-tejjasthqr
  • SHA256 c15ae63fc0eae57128e6f1fb3d47ce71c1025ed8feffcdf54695c433b212ee16
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • ahmad07.no-ip.biz:83

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1febd0273c705f503db40c88ec4c03b2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1febd0273c705f503db40c88ec4c03b2_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Users\Admin\AppData\Local\Temp\1febd0273c705f503db40c88ec4c03b2_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\1febd0273c705f503db40c88ec4c03b2_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:2304
        • C:\Users\Admin\AppData\Local\Temp\1febd0273c705f503db40c88ec4c03b2_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\1febd0273c705f503db40c88ec4c03b2_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1456
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            PID:1788
            • C:\dir\install\install\server.exe
              C:\dir\install\install\server.exe
              5⤵
              • Executes dropped EXE
              PID:3668
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3668 -s 540
                6⤵
                • Program crash
                PID:5052
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3668 -ip 3668
      1⤵
        PID:844

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 bca3b43239f80f61d03ac8fbcc138152435828d6e3ffc762a46c8fd105f394dc
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 dcefe524d1842f0db57823dba890a46775fdcdc900e904e2bd0741e149ebd382
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18b61d1e971a66a1089aff9d1eab11e1cab4dcf72ec8c7050c850f76c0ccf680
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bda1692b4ef37f1b60b6135f50a76ec7c14d2259c66d46e7e487f7100053189
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eaa69dbd49c18c35dddaa44d81bbc8507cb877b477af1ce97ca2ecae6b9fccef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f03d6d4404c5cf1ca95424fb953d2bd85918a90265dc8cc09a37fdbe0e70c5b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76918c52396903f1834addba41c8e77ff0323c0af5171665014a309ef27bb6d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec71ad0436feae066ecbc8b2b291c8303dc62a14e1256c8429c69a9ffc0440ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b766921527de61af057f802a0d7cef443abe8c3bee5db2a93aa9f768f57b018f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 531776806bf07a60271cce2f58f155b62436e0140f8139e446ad34ffcba1d317
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34d0f95a880ebcbe2d8fd1dd41b515e01cbd740364f6d618198777f1b193f081
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60135e491a8a2682c2b39574d0eff131df756815f784952d31aca901fac22745
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8c0110ab93b89e30604f3fca41ce59f61dc78c839092490241d100de9750ee9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 967cef540f65c2a454223058edbab1aaeffddb338c6578fe57d39593e1f79d7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3cea1a7e4f86843dda38c0d8aa4c573afd839e90512ca9488434328d112a437
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7139af2459d89026d68b0de056ef6c641b21d4137fb731fa373f46fa57b7dc6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 607ef67ad33399f61b39f8bbf5897b4f74f58c3faef2c6c1e3e393f25c59beb5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ff398727664a940634755a37ba20df2eb626a2b4aa9b60fc627e3133d992e69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b93307f94e3c7b94d3a4a378a3aad1f345711592975936856c1378645d999700
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e4d14ad969b984303ef3019b5a18f31d638f7862d51e3ccf3d875522b8e6e20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5e712513864d3c6945cc57292db377e95b4dcaca0b706658d83836a9b354635
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0699d92a72fab7937f11f162574d8da47ece7ba3442d82419797d513c0879ce2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 933a1e7a367937ab68f5c13484ed8758f33794039b53cb3f2db800314cdc773d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17df0ff8034c28a6bf7a4f0c38e8d0b7bd43898e553d8bb6ec6de5facedf5e15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32822242bf798f624c273b62063efa8d599086ed1750551ab2ae0b3d4280072f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7aeef8c56142532db5e9e1b1b7eb3ec0c07e2fc3761b3831566571897b18b97d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf628ac4e90b294604abab459479f24dcd24e3ceef22f8e5a9b414aff08912ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0db74dc7440e6106f7c951ee341867ac2c171db6406dc924b45df9db3591812
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d5e923a624a241466eb3d1b21cb00588001ba3dc487ea94ac21df1940d57bf3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32aac4c25517763077108b02d40524817886507fdf38caeeaafac4d182f32ebf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83e676aa162986e4884d590bfece009f8952f5644d56aaac297ae7dc1f150bc1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3954b79e4f1538c0ee02e8b7c61f2d98c4fceea3bcee342c6e360f7bd8adb371
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b11945192a66106eeab530ee0f20c7ce8066495c4e6632096311800fe0600b6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98d27822d322ce38c1c0b871911482b7286e82bbbe5420823839bbd9c112a4fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f60a9627dee367cf579214f76352d6a76765d9dd176be4f1dd28e5fd9ba6771
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 783e6cfdeb8f6fbd26bae995e327951b9958f4e594277171d468f1556f3b8e86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03dada1d674f5591f1f06de1e5e30ab8da4782e01d4c211e856d9eb86022038a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8410e45b34db6a5b66c22ac53bd1110bfd17b53cf0908033a39e80b6222b7c2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 695f3a8f45a9b3ffa3782047a383c17838280c177b474e8dbeb82393a91c43a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19e12f8140090d2548abe4b66248b30e5cf04e72772ad0a2fffe16d8c50a2ef0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 461e66744fb39b6f5e9a48e703a7677125394c7b7fdf8a0e0d9e975ee20f1ca2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe323ea151e4311955d176e5feb019d87e1d38fd846ecd0efd304e0a17657aa4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 efcdcf742162166c174f311c5a4569faca5406e0102e521f968f92e98ac1f1ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34e2a1e8846e4101082c6991467508d57c1d3c783622ebebf684d8dd51abfc8e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bc9022010e9884144577589fc7779d8a6b95ab31b6dbf45190070bf116907d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9a71c18b1827f92c8b502fb3691d649c4fbb2658a2cb1d62bf911749ee0b6ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3afcc25b29c7482513f8bbfa520f97b3685dc872c070cfce951c0dc9f58d8800
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd5b6da5d9a6522afd827369b749aaf4409e0ae966113c8ff97a58ecb013cac9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 506d913a00deefcfbce505f3cdcfa1cb66cf123126e0e9eafa6d5fdc9eadbfd4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6c562ecd3018918af82d0bf0841f5cf10c038ab02e81d8a3963284b49390003
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66278517c570aa1fec90a5cf9df6dc8df77c75991a119f7acac47fbe68d9493c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 477b28003e974f468eabf53dc97cc8c92774cc9d30ae0e5cc954b459ce3f5169
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b517e87793060580b7e3344701804376f43fbb2779d64cce012c5d1d620d013
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a032aca0a009b9654f2d699f5ffe07a8b4164e32be060579128fc273bde83e57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 535ac663a7653071f9817785bb4e093a5b44d995da798da037b46838401927fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f91bc3589b9223ac99434bfbd845421db117d780b553ef859011e7139abb488
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5fc4988652e7746394f16c95e21fa454cd6ec7ba504180c0e54e1321abf5777
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00954c098fa847852ba93d377530a9469560365d59d44d9dae52b2c1b1410f7b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db8119ec2bfbebf1471dad0741150b4c7fc67f7674c7a06f47ab0511e82ecbe5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de6f45244cc31cd3b25442bcc2c61329b85dd47ff8f988295471a0845a460934
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6fdf400ef7eda267275315ca3c2997ebd06ebd62dc5c59c89ffb4dc9612d265c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88bb3f23cb496cd8dfaa60b99ea5b6b782b15e4d3d3eb65e1d6b33b39b551c38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91c41518250e2d593fa636a0003bbed4f95ff091da861c78b132cfe2decac092
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2deeb7c5ab6e2f4acbdac382a240bdb927a9826281925d4fb467f2732ed03705
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52bcdd4dbc1ee38e5bca0dc6fa8c6a278dd7437476ae719d11169341f4867104
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a60b75e98db217701323aa848f91852fc047863af5e47ead0c223e24a445a8e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f087393d417486ce4af46ba8c9f60e4138fa77020a8cf17f3ab6881ed8807c45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb2ee156fc71e59b31428483c2c487b20a5a1cf830d51d97882e24c242ff8b95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0bdf762e926804652265c7caddc5339f0a0f0540379890a6f580382abd39e89c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b69d56cb4c4354453738979be57634d9b59a0eec4561449d82dfd51624e62845
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17c5e9d6430dd5eebaef80e367b3c9513171545e498b277bb1d30e2f34d435a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ced5a7ba1c21923544ec480f5c1f1a5d44a60b00fbbd91b8a07379d0a727593
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c687427e7f2ebbb950cb6bc193cd98514e33f7757b0e21812907b8153190298
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92bae5f53a0555911d4ab4a4157a8edfcd832447b2fb7b2d071a7ac075698554
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91a2e8f7bd4d7648d3d38ad4dd32bf159333e9bedc697ab8fd5981ddbd29f63b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ce76c3c6dc657b5a3eb91ca8ebaa8ca9e94a1a1b70afe549109329915443694
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b2e194b863a423053bf1b915c3dc974a4509b106f8b772d8e75d5558b93faf8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0655e0e799bddec3e79a0a08c690c652ee1a87f203f42ba3351cc9f754910699
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44252698fadf635d8172c58c4e54016b33390bf05ac2645712d5b48e04a1eadc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0b4f60f7d77a1e1232884b22fb75b15b057000d2ab7528f45d114ade1427e15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 999b282d086a62fb8027b7d9ce302c505f9a4f010d67bb4322a7bf8c11116521
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4a8eee0d5396439cb2ab23dd8d4b410f9a13eccdd24faeddb07db86f67f7b07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3d5bf2e1d19c9a5fad013b1ac60be41bc42a86b63b2ab8b407eb44d69d676d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b07e3ef3b97ecca1bede20231da910bd51cba7ca65f222d58d6546f9d67aff5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ee8a5efe28270e0b085cc15426d775cc53c3e8ffc28d351124a034ab3163843
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 617200787febd2dced6228fa3cb29f5e6882d37f928991ad61ba90ab9a020876
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56c9726094075112e1a1faf70b5b0ade8cd8fd4b3bc20cf931fcc8223e0c0185
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d7341baf16f525f2d93c2513fd2699babf3552b505e6182f977e01191cf0ad7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f6f3838411a9652a0b2a3dec7b71b0223d9b822646466009065745e87963271
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0201408d0958511f5e2baee22dc9363f860614c266a6205abe8360e9e6ebcfd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 990bb589861630c35680e30d8cf8a22d59c9023e343335c47f1b6d37755790e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 232c85ec14794db8f30d503664fe95d6919716306d856406e5eca84ebc552a6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acaffed7feea2b0ad77a6c2d6ced64f4f1cfebead19f05004bcb486ed6c974dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe8c7a781e8f70fd78db606016532f515c2ad0882b13cc47f2548145871636be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82bbc1d2247e9c145c19b11a5c22489777a929bcecf1c70dd49e87dec221606c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b23ebfdcbeac453e8cddaafc4549f6d8a55f29562874719de215bde1697915d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af1fa39527f4e12509b2874bc7c10c35ea0411219e658849edaed713d3824595
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 763689c346a5b822556f263f12bb9b739fe3628d5efda668c7fe519dec60e742
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fda70cec6845410d98f94bd9aaa4d976587f5faa0b4487f2e82e56862b0f75e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37aa3bb2d1626a72653186ff3242f0f015e01f10ee5aa92d0f3eb11c3dd5e3a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f336a6363e896bf2a231f5976bced903122950899c1fd238415c364703732cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0f193914fabcdc82385be1d6917cb9c1cc1a01a78d392f081fd4d3abb9aa9a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e75202bde770a9995919b62835aade688af723bbe12b0c43d16fc58784b1ed36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 911eeeb8c66c2ee63d53c3783bc241f1e03554db1e77c57b86604c54aaa5cb63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b3ac98f82584e6dee32a31ceeafd386ba83c1fb20048a6dd652d39fb89381df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a4b8333e8ca68339c0acc01741e22a12867f26e976a372054efab80dcabcc85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ced0a158b723b78904cfff1bd1edd540dc42ed9f437bf53608230ff601740598
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c982b74ed54102aeb11da7c34d2e5a7a7fd398b9e37d65908d532778fcfa305
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e3d87f11f425bb7263424bfcff4fc5c5e67df381deae2fbe49ba6f689e3ad59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ead9557d8aca4e348f1481f8301fcafd0f70b5b94c3b10f21e634c7450d8b4a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 872fbfb04fd6aa7469f33fe3eedad809b0b97879e146589471225da1761f97ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a68977c3e6b32a850e35501bb1db3f1e718c3f79e8e744cec7eabf7f08f41dce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94c93717a6334be25511d27e674d7431d31710227f6087d79bb8618613ef0ae4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5db0b3a393c0b420178498de352372306683cd19e18c5829c558ac2ef0b1caf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5706023434e541072269307a18b22cb214cce28acf729879b4e38b56a062e508
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56fab8455b97de2e1002be9f27795dc45948cc9364683e2e661482ee5f988184
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3416e045f8ea15d3e183aee2a057025ef4443ad983163182170c26cb2bfd40bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c15781ed345eb90370348116ca1ffc9d45488112a7a845db4fafc634198d5347
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5bdecb116a272a99d72ecd1c24dcfa8d7b17776b12a92c9e97cb5a14e642126
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a01e4230f54be632a42c372efc3ab56443e0ddc6ff1eb0b264ddf90177e5143
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4473f5d8b9a7beec563f518799690a6afffc5bd210481afb0969cbb6b198a6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c584058e79b79a9498e966b95e997fd2a602427864a70a89284b0c60cd263abc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe80e68200f7a6e736d495aa2d89c54a717bcf0a121f2f84fcc01a217ecccf6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c446c18e3a094665ba9ff145d896f7c819f4f0196732cc0e4e27b8a7be2eeff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4c0524f177c6c8b84943e30fe016aa63142d642d92090f5dbd78f49acb81c9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db312573d109ccb91aa8f89dd51ac2b1db9e1e9104808402047016762cc5034c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 702859abb101b692e49666dbcc7af1a4ae08b3ff5a2a53f49f49a923f8dd8b17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6fa7e54536ab7bf2fbb0402c09886edf5610a62c1b6ad28b94b7dbd4e09088ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5d36915c0afaacb2715d2406e1ca05e990e180e060ddf46756c552b1c53a235
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17a252c67129f22fb8ea8b0164c8bca10a387da5f948906d845aeb423b98d7e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0970a38070b7193c55e9948269c9c4f71c8d815efe5407730820c1b3cf8e3443
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d9bb17b5fc94b43271e418a938abf32ddb7358efe296f691b73704256b17560
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b5e85f338a30de0237ce41991b1574803ceeeba0fb51ed267f85415390f5746
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32542ec02917d3fee1dd7b86254dceda35b417a381f785a819088c631fa673a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 394743c15eedcb82f399297b1635e806f555a07cf50710ed54808a182203c5ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d313b278788ce69873596cabe8f1f4bdc345c78b857a515be7f6ea2f6a326530
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a003c5c1d53233851cc4a87494fb05f13b2ccc38929ed293932388823796e0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a6c459a7d283b7c834f8bda4ae82df7dfc57db63e8174e2a2bb38bb2bb46410
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f9c12b8eb4585c3645c684e6ceea9d72923f39d2aa60850560d0e4334b6fcd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e53adf83a712c9ffb2ab9c0fe5fb02d3d6b11dc0b3ea0755d52082fdc83f062
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2f485deb9e2965b84929dd7e82c3fb8e98435fca316bbb2462d64032c908995
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 590KB
            • SHA256 c15ae63fc0eae57128e6f1fb3d47ce71c1025ed8feffcdf54695c433b212ee16
            • MD5 SHA1 SHA512 SSDEEP

            memory/1456-37-0x00000000006E0000-0x00000000006E1000-memory.dmp

            memory/1456-36-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/1456-49-0x0000000000400000-0x0000000000575000-memory.dmp

            memory/1788-131-0x0000000000400000-0x0000000000575000-memory.dmp

            memory/1788-124-0x0000000000400000-0x0000000000575000-memory.dmp

            memory/2760-27-0x0000000000400000-0x0000000000575000-memory.dmp

            memory/2760-20-0x0000000003C10000-0x0000000003C11000-memory.dmp

            memory/2760-11-0x0000000003BB0000-0x0000000003CE0000-memory.dmp

            memory/2760-12-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

            memory/2760-13-0x0000000003BB0000-0x0000000003BB1000-memory.dmp

            memory/2760-4-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

            memory/2760-14-0x0000000003CE0000-0x0000000003CE1000-memory.dmp

            memory/2760-0-0x0000000000400000-0x0000000000575000-memory.dmp

            memory/2760-7-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

            memory/2760-17-0x0000000003CE0000-0x0000000003CE1000-memory.dmp

            memory/2760-16-0x0000000003CE0000-0x0000000003CE1000-memory.dmp

            memory/2760-1-0x0000000002330000-0x0000000002390000-memory.dmp

            memory/2760-2-0x0000000002540000-0x0000000002541000-memory.dmp

            memory/2760-26-0x0000000002330000-0x0000000002390000-memory.dmp

            memory/2760-9-0x0000000003BB0000-0x0000000003CE0000-memory.dmp

            memory/2760-8-0x0000000003BB0000-0x0000000003CE0000-memory.dmp

            memory/2760-21-0x0000000003C00000-0x0000000003C01000-memory.dmp

            memory/2760-3-0x0000000002530000-0x0000000002531000-memory.dmp

            memory/2760-15-0x0000000003CE0000-0x0000000003CE1000-memory.dmp

            memory/2760-10-0x0000000003BB0000-0x0000000003CE0000-memory.dmp

            memory/2760-6-0x0000000002520000-0x0000000002521000-memory.dmp

            memory/2760-5-0x0000000002560000-0x0000000002561000-memory.dmp

            memory/3864-22-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3864-23-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3864-24-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3864-28-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3864-31-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3864-35-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3864-100-0x0000000000400000-0x000000000044E000-memory.dmp