Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 02:08

General

  • Target
    20b92b301fbc91b2740d3a322b18faee_JaffaCakes118.exe
  • Size 302KB
  • Sample240703-ckwmdawejp
  • SHA256 30e7e655b15743ad69fd2e4792631d88d23724167d58c563098e6515889bacaf
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • sneg.no-ip.info:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3420
      • C:\Users\Admin\AppData\Local\Temp\20b92b301fbc91b2740d3a322b18faee_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\20b92b301fbc91b2740d3a322b18faee_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1484
        • C:\Users\Admin\AppData\Local\Temp\20b92b301fbc91b2740d3a322b18faee_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\20b92b301fbc91b2740d3a322b18faee_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4436
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:1932
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:4256
            • C:\Users\Admin\AppData\Local\Temp\20b92b301fbc91b2740d3a322b18faee_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\20b92b301fbc91b2740d3a322b18faee_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:3052
              • C:\Windows\SysWOW64\install\server.exe
                "C:\Windows\system32\install\server.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:4508
                • C:\Windows\SysWOW64\install\server.exe
                  "C:\Windows\SysWOW64\install\server.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:3580
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 564
                    7⤵
                    • Program crash
                    PID:3656
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 404
                  6⤵
                  • Program crash
                  PID:4412
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 396
            3⤵
            • Program crash
            PID:1492
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1484 -ip 1484
        1⤵
          PID:4388
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4508 -ip 4508
          1⤵
            PID:416
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3580 -ip 3580
            1⤵
              PID:4956

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  UuU.uUu

                  • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
                  • Size 8B
                  • SHA256 3ba99a67f86bc6dc55b58602b726fe075b5aafaece1897ea143ef2c330fb5634
                  • MD5 SHA1 SHA512

                  XX--XX--XX.txt

                  • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
                  • Size 229KB
                  • SHA256 669a2983fbfa9bc00d868a15e4a2f7faaa5b24c145fe7c5e2e88a97315fa5580
                  • MD5 SHA1 SHA512 SSDEEP

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 215ade481e0f03c50d5d9aedf794f82640f1a65840b4d48ce6f2c8bc9ec7315f
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 a5ea2e5d1755b90d2fecccd2cd2d6db40d5b1b3464bd992239df162d33c57fcd
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 53d3bc56842ee3f666f5a15acf38b026447f88e25ce48ebf8b165d9ac2f8692b
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 c1d5da3e4fc3a3cdf0d36e34204f589e5dff22df5843b148e9c9a4847b20bb67
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 cf96dc24c8fc538fa541a26693649e39771a9bf3f6fc1efff0de0d049ff42dff
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 aab70f9a2c0c6d786de3478435a7a05bb06e6d91a08225c5e60696b83adc85c0
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 afbcd10640008c2b04ce54a88f853d81ba8c11b5d6ad778133d7cafdc794e499
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 9fab3e938a4bed69237bcc2f479045c82e09982ff8cc7611c378bcf0eb61eb89
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 e46d3f0dd00cad516039a36e546bd8b725cf6dce5c84d0917d566a4877fd17fe
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 e51a85f7165e4e7bb230ac111bb0db98d8fb54b5b30cff95dfeb936781d59faf
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 1c5bd53f1ba7eb4e99ec5f40ec145fc083d768ae91964365c0b97aae4a033cce
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 97e4f5c4b9e61294d22ca216191baa8f5495d7bb6f8d2dc4910983505d8d0961
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 19f1225205c550b2ca5e6912dab2e898f2e70578522155f7863871e954c4386e
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 5b0e22c782e4e90291ed5ee503dac3a3f5c3424247faf9841000634edc0e25b6
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 c37d603e812cbe6ea8aa20eb4cfd6e72f60909e2e33c6e2ece4e6954162d28dd
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 7af187cbc97e25a67402121da282563556024240358ff0e8a23fe21a9be64293
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 f550e2b32aa40a06afd71420dced262e4571e295d07e399aef715e54a71aa5b0
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 313dd66202434ce348e913c1a9c81b236b252f77e59550eea42beb2f8dfdffbf
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 1f0676eaa8add357ed7ce3d15431b1afde41a8c1ae8ec2c3f546c9580e6b12de
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 3cb4fb0ba4a91b413578d1ce4a50db52570670f652c520b0ddcd9f4a698c9446
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 edd006819cf2bc0b2f4a963000c0ed3ebeb632c8e974b136553a041484972767
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 58935410cf8866734b3fe9ce3e43725f7dee2eb8dfba38661a25eb4c7e9034f5
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 d2e4170aab7e2d1d667307e0ecdf9d888da49d387dbafa5dca2394b273dfa49a
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 d1768355f85baaa1cc13be4c758415ebfe96866cfa3a5a5f63955b8eda368c78
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 2d84c632b8e759eb89d506105c71f897739fe3441b5fd286bdfee819bc9ccea9
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 0f692bf28eefd0ec302b49e75e158e6f879173261850be028d36d174066948a8
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 4ad865f62a19b198801f299175a9b66c9f8567bcd76178328e2f820713f54f17
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 38d0c4b1f89f663ac3ff34f932876ce205acc84cbb8f5a253a728236191a920e
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 3df98bd67c1d99699c0a031fb63726a479af50c724131554e186d4c1bbd673c3
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 9c7f4d78461d318f9dcd1322d200ba5e4b969c0c7df55b318b7df0bd57ee64a3
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 50ab3f461e4f82eec83735fb3c9e72be9ba5be573e587ff11646e1fb944699d3
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 2190d41baad38a08e52495059a67654961f80f78f9c737b7768582e6fad77fb7
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 34422be8b87995261478673aa5d950904f2eb22151c9f6a42988cf633becee32
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 dd6f9cacb677fb2edaf1a5c3d88fa464410ae16f92d51669428fc93020102024
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 ac7c895f1fec5a1e047deb6e6db35ba91d0f3665a2b88a685ea364b448b5c89a
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 7cb72e16dfb61622b4532f95d451fa490864f71d7338571a7bba99d056ed8a66
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 a55210cc25fa1b29400702d932277de66aa5c27c1016867d2b09f567587ca770
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 55c5864a5a1c932746e16151507dfbe020324cbb73e426c45b3da0f3287e5dab
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 75d0e39a4062ea4b37eef516de675b1849ca7f765412173f65ccbd0805b4e4d4
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 84bfee9c2cb665f0a04505dc7f523ce6ef7999d59258c1892dce4f9d9e028f8d
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 39b09de1064e14d730545ad9db5ccdabed739807c230a0ceb7c761330424020a
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 1711a0c135d265e8fa43f0c2661c518ada991a50940418cf4603219b2c56ae46
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 4d95d80cd1d518062be578c9ad10302b7e44dfb63082dea676965c07a118ee99
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 1b19c25a413fd853c4fac44b15f2d650b2a52d4c1f3220fa79ebee1a7f053241
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 5199837a72ce8aac9e982527b0a8aa1c0c3be105cbd423339227fb1a41c350b3
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 0d70c6c0257ffd58ae690a211fa220d3afb1dfda3b8508af712e95bef617b694
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 e1553106acb89eb6a03228b52b2d538911a31e8cc4b22fc84b733e9e12736fbb
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 5cabf3fdc1f06e3f0f6b4cddcc8f3597b552c58f00a0156a0cda3747f60653e5
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 1c1ac57fcf1b15fd8fb54431f26255a9c37121c09780142722779d0f7fd96259
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 9638ca4267911cb3bd11cc6eda24b14d538fbb42aac51f7f36c9d04d589e92cb
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 ce72a9547af44ab1abb06e6203da12287a2a6b4451c253276ed0ecb8df7c5055
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 1eab4deb0889afe273193dc924b351c64c7a578ac007d39994f6dda70c09c94d
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 3da574ec10deb2a5c2f318ca7771c29fa195e2a7e6c5df9b3480e4394eac5fe7
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 ecedbd239300b4c7d7c032871350fdfbeeba55c588c7ad124e1168cf16ce0a6d
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 d356ead1d8d0765dab6661607c51f52702d08872f53ac6ac836d21c4856a4fa9
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 aab44b72b35aed912bb19b5851c909ea33ac667d7d2da7275717a176cc219868
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 8ae6d8f69d1a794e951e47fc92019610ae3c1fc7877c9b2826c00370944ed854
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 36fefecc917e1b1426b2188b8ad39016d8362de320c6ffcddd7572f1e649ab08
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 27d09fbc47a046f991e954a64e57111aba2937d62623756fcbd4b94595989af6
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 6e222bd74ce73783aeebf9a5360282e5fa09848bc0aec48daaeae06c3cf139b5
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 884de8a2e1e93960ef147a2ed3956bbf5d9e1328f74ecb25d634c04e9dd9325d
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 40faf2674e4dd1a4b1e74128efa5fe164c0cb550179c5539dfecfc29ee70dd3a
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 57e245f1a87cece7cf4c42c63e40e358e83c07abfc62f490f58770309a97a4ab
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 a7a8e7c49080b28c15cf6892d3c046e9f47ca3e55c7e791838431ffec9eb1b9f
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 debe0653508f26de3a139c15715768064d7f3222751ccf976ddefbb2b20b9668
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 1950c2aaf8b0e62dce90b24a99631cb585a2f348f62a719fae553e06a981bbc0
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 e431c199d4fa9ed62f19965914f0bfc83ef477a42f7540aeb491d3cb8f0708ac
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 2cf0ec60228f1b2772d8ccd404614401cbf1cbbfb5a500094cc4c5ee9c4d2408
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 1d5e62f296da5267d1f3d6fde8ac83cba9cc09d428d370721a08d13fad658b72
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 a6095cca06f3f79012fb06accfbe20cfd82a8a3611db9e63cc1880937c9d1583
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 cd1b2506ff9336dd8783d70f2d3facab5250745a7e067b245a464ebba059384c
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 7a0821f42ecec0b3fb7767ebfc13cae0419f759d095e299e617d59bd4644ef5e
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 7e4a606ecc6a3b095a42f283098f7e2fb772dc49303558f256d210e060fa36f5
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 51ee8276ffbd35e02d38a0641184fceca0ad830d86c09b060e1f9fee45c80627
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 5fcaeb771a00d428e364c3c7c1ca4fdb3f3bae5729af33f072ae6246cfbf82ef
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 6725f6b7b4e9c946d4aa8e418da6e0a89c93885de30d1c8a96b855fa4eca842e
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 6ced6b23f60938e007a1381b5043db252f767b1fb074c596061ef587f82991e4
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 ada8e1e6f4188d12c8dd8f432117008c8703ef4b0563d1ef7a20c5eba7787cd6
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 5c38547427da7bc1c62a298d73c0a89cd3d31c2076cc1dfef49aaf98d85772c2
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 567f50d4c52dd71e364fa8709fffb2ff06f5b62f0c1359542a46233b8d5d7c05
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 aaca026589dc25840bb7850b8219529721f8ed4d8fa3775957d27891e7dc2db5
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 ef0f64e3ee36f7434464f60d1098a1cd77ed03fc67517358f58c8f7173ed62df
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 67b8aed5676e021fb93f9c559de4097cd511e54a19c195cd39d4971fb106d4dc
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 901b1b3d908c542062d487288dac878ebecf6b2e5e2224ed29c802a14ae4d127
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 dc21b137fdd6d3a968861621d24d117085a96c637d4abb27b7e07f93bdefa5d4
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 7e1462d50364d7ddc1f5b6d624e1ad533cc33aec2789a83abd7898bac766e719
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 aef19064848f23c42d97d58197875af6609d19bca22388e4d09ee3ffbcbb76bf
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 d5ffe0459688fd37a3ef8af0bfb96c52ccfb18a17fc28a749f7d6880d7080970
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 e069695ecba1ba576eb453e70aec3d40e9c788d38f8feece543e31390140efe5
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 4531d57c16576bf605688fcbb34783f12f7a2c67ab45dfe6a4022ba83ae5af5b
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 ef9d3536d600c9904f8c8f7731ced1586b0bcb4d8d48dba62e6ccfced8b6e659
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 0498bab7d40583f42b88237c4e0a9e6efc6aa449a90710b61698c9f314070809
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 1403c07975ae1f4009cfcbd0f96d090ee4e4ccd69417c18231e2272edb798901
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 2b585930b3bd9ba6deda94c37783ce05ad6fb16c1b73245bf3e2c5f86e370752
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 aa2f7ed8c3e6c6b1e37a1083919e8f68ad1538f836d008e4e3e18e892da04a31
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 95abccb3c6c92aab29e9f4302682e2304e0283f86d46fa97782e36a222788b83
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 0da6714fc16c322a6dfbf3f928a92ef9c8c994264eb20eb206d9eb7a9f0dfbb6
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 6d1c254995a22d31c3efcee1612d7358e0d77c0ab93347124f879be1d2be278b
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 07f96ef8387eb7075f9264fcc7bf066fed544e5112473c1d2ce4ebddb8de23f3
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 72ef4ac03bcc55cb1198ed94b06d1a660d98961bbf5f7e9aa3eaa99f9df59bc6
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 324108ab799a5d5c9bc863e39e1b935014a69635b78183634a5bddb671442e0a
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 ae52c010ec14f7ad8e29abf9e249e9b7b47522040798ef09b42b0152ece205a3
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 2b7b1afc627372275ec211ff0e918799d25e201091bdb248cac0f1e12756b345
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 a91baf4fbd404aac56c9e1c9fa2a72130f80b73c210d9dcc5c669fdedaa78580
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 01d0beb4b72fc5bc939a5e47a62c07a0c27709934dea39f51e7d68b40ac2269a
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 6ce8be085a51c5f3d05ba69244e4b650a3b5dbc85882f6e8828587930845e426
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 21a02ac493b61d6bf0e298fb6c8d0b0a0cc8236544819a501a437598b62f05ae
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 35de088eed9f480f419f430d3f83bdd8be4ff283b095ad66ffb138f727d12f82
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 7830746598d0230464679e0b6ebd0e992f2bfdf5df911f730260d9e7c4d9ec38
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 61d74754b0775b10ba78ed4da9a4671f021b30f4d20538330ef27e4f3ac97b73
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 914f8f66efe28813f55c2dfa2d59ffff6cc50b314a6b701fdcf516083d9193a3
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 283130d7ac6e9e1c1f3005d6fc18b7e914edd6a512144d918580b8844f047594
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 454f87c67ce1d8b551cc04aa3c4c34f604dc9067010487df0c449e159a65e379
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 b3d3084e7e11b39d1c77d21149a223f1cd6f9195569635a0148538fde54f6823
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 947eb45abad3a630b12140fd2bc5ede955b429d5729aadfc1431af3a0dc405dd
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 dee64b28affe4fe792aa1cd50eeba347bbd4e8adf3a0612eeb5ffd4f8082a848
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 ce7a4935303c31de58fe0aaca78c0c87cba90574172641a73fa2dbbfeb3b98ff
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 39ed775b310f7fa797e6df7e9a6510ba0dcc9c844ffd21203612de34a515fd6d
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 9c77e268c402fc91417ef4223bfa9017e54e677384a637d704fa5af2fea4373e
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 46dfb8923e36e20c781e0caa54b859f5e85c807ffe062e4e8ef75f00199de995
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 cf0b69006174006b3463d750bcd40e55ad341b327cadb37ee3d5d32a8255d0b5
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 e98093f2c1f9e8d92a70c440b3f23f97b5c198414bf011ba9c7ee4396e5206c8
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 6c5c93415d033eba49a089c255df7eae3676d3bf579ff9ef5e41d9d57c961864
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 cc46980bf2c2c8e6eb31c05cfc2d97365d9f893403453edd7dd1a3572f713060
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 908fb81db2a95a782ea309440f386bc009b826c0d0e77c5209cfafdd02c043d2
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 fcc9ae0ccc620fca569c875c239f632b17bc0f6e3f64d9f759acb7dee416b15d
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 e599c7a574e4d6fd246079e2dd9f1848cedd87350adf50921ed4ed5a37fef678
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 d1a138bcc918ab1ec9d64bf3740536590423075c90a4743f7b6ad6e939a617c7
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 38216882eb799546b21fc3d012c5d92fe004aa37f956054148313aeb6fed8321
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 3d2ec69572f120aeec1c012987a3f6ca69da24f900a6ea84c9a52b8c271eb5ad
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 2ce1bc1da2a826fbcf27a917c0bf64e6e7784bbd54a1a4a5d3c5cd70d80b5c4e
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 60da262afd4549e74a6b027c41168b6ba12e678e34749e168d0487f6ab398524
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 c88338a50e90482a86d22bb8c4fd7b148883154b8bc43ff44a5d75fa567762af
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 a5ef2b8bcc84268132e8f7bb79d22a537cabb57a2bdc1f4456f24189f2f48bf2
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 c5875c099fa09779ecca312c7b702dadff24867b7473006f59b2539f0fb64faf
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 0814c9ab1f36b3b5358c6aa3e107612e792b7ec90749eb089dd3a4547cf83316
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 9b6a0c836c401bc2c55c752c8e3fed78f62659e7c589a8f4367b7c2a5f5b73d0
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 2359df1b82bdc5251f884e66ed467e13518712b0f8c68d92b805eb5b844577d1
                  • MD5 SHA1 SHA512

                  XxX.xXx

                  • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
                  • Size 8B
                  • SHA256 d4c75febfae0a11bb32276f16ef380c2c43487249ed32344a050ac0bb7a86a9b
                  • MD5 SHA1 SHA512

                  logs.dat

                  • Path C:\Users\Admin\AppData\Roaming\logs.dat
                  • Size 15B
                  • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
                  • MD5 SHA1 SHA512

                  server.exe

                  • Path C:\Windows\SysWOW64\install\server.exe
                  • Size 302KB
                  • SHA256 30e7e655b15743ad69fd2e4792631d88d23724167d58c563098e6515889bacaf
                  • MD5 SHA1 SHA512 SSDEEP

                  memory/1932-13-0x0000000000F40000-0x0000000000F41000-memory.dmp

                  memory/1932-73-0x0000000024080000-0x00000000240E2000-memory.dmp

                  memory/1932-590-0x0000000024080000-0x00000000240E2000-memory.dmp

                  memory/1932-12-0x0000000000E80000-0x0000000000E81000-memory.dmp

                  memory/3052-1270-0x0000000024160000-0x00000000241C2000-memory.dmp

                  memory/3052-145-0x0000000024160000-0x00000000241C2000-memory.dmp

                  memory/3580-171-0x0000000000400000-0x0000000000457000-memory.dmp

                  memory/3580-174-0x0000000000400000-0x0000000000457000-memory.dmp

                  memory/4436-144-0x0000000000400000-0x0000000000457000-memory.dmp

                  memory/4436-11-0x0000000024080000-0x00000000240E2000-memory.dmp

                  memory/4436-4-0x0000000000400000-0x0000000000457000-memory.dmp

                  memory/4436-7-0x0000000024010000-0x0000000024072000-memory.dmp

                  memory/4436-0-0x0000000000400000-0x0000000000457000-memory.dmp

                  memory/4436-3-0x0000000000400000-0x0000000000457000-memory.dmp

                  memory/4436-2-0x0000000000400000-0x0000000000457000-memory.dmp