Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 16:43

General

  • Target
    23155b0e0fbd485eee783e34fc44c503_JaffaCakes118.exe
  • Size 428KB
  • Sample240703-t8fphaydpj
  • SHA256 f91c4f64be2c7fbbc2a7c803d48a7af64547a85292f22956f6517ff9192104a2
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:240

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\23155b0e0fbd485eee783e34fc44c503_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\23155b0e0fbd485eee783e34fc44c503_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Users\Admin\AppData\Local\Temp\23155b0e0fbd485eee783e34fc44c503_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\23155b0e0fbd485eee783e34fc44c503_JaffaCakes118.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:2812
        • C:\Users\Admin\AppData\Local\Temp\23155b0e0fbd485eee783e34fc44c503_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\23155b0e0fbd485eee783e34fc44c503_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • Suspicious use of AdjustPrivilegeToken
          PID:1340
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            PID:4108
            • C:\dir\install\install\server.exe
              C:\dir\install\install\server.exe
              5⤵
              • Executes dropped EXE
              PID:1672
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 536
                6⤵
                • Program crash
                PID:4984
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1672 -ip 1672
      1⤵
        PID:4784

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 dd02976c7f5fb8ef16912009b50b61f2dee14ea1a4c867594de3d1d292d6cc65
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 c08f5e36bbf3fd06a0acc6e7e6b17093621028fb36199131632b4dd9b86fe8a7
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4a4d218f96f52ae321782bbb44a5663fd74c0d9cd86ccb4c7c1a94c98f139f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fcc1743bd5f125d7e1a285c39c5fbeae2306401a013ba635adb5119fd8843cda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebae5d3aea4b101cd7006415fc8f461032f413971af219a9d2ff07581ec891db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bd16b7c1c484cbb33df2dc02d8035feb2b6037db1b1ac4c3ba896ea3aad04f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 762d6a151200d51494cbfff606a641a04f1aaec18a5ebb66c1b48fa2d5905b5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c797512a928f9693c65c800b742ee8713a0291a6c9f0298f91c4cf22fc32f0ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3792c301f79dc0a8c228122027b9d4db3ecedca1b3283477764ab2633b4a4fee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34b434c0a4c5f46f7226020b8078173949090307e16caa7eb03f8310afa1b89f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d45a0c566cebeaa1f2c1ab6ad2e41924134caacecea36da00baee34e64dfdde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da2033682a40a0c551da9eb6ed756ea53785fa6aa3ae08f1436633640bfaa8fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f67388e49c9b5d9b8cf6d05e529c595b42eb4b955973bc3042b4d60fb704e377
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36d16714bae1cf394345715b8814e30b41b94707a0394bde9b5ad66304f1e81d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0378b1499ee89d67eaf7897d76c0e1e749b149cf506ca16702551373fcb16dde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 432902bab1b76c5895c31ba393540e6df4ecdd50fe3e1a5711a43d23114699ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fca0a6d770553d4eca253af4d3dbf545fb89d46386eec812daed5bc052577c35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f90a869bd5af9e0d8617aa9798fbfa0a76e9af9f839e70c9decd946f54f50c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd661630740107a1cc45fa1ca60410a024d416c76bf79dc2096ea74e1958dc61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44e176090eac438b08d41c6dba524dfb76e11e0dacb2da342711e93023df2a56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fde682ea99d8801b08040ccf4fb3ddc51b3b8085ef9b16db4707cce101ab8cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5074b4e786e58f3e8787439c493f6832106df553faa4f739ea7628d43f8383f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f0bb2f119743b2997ccc92cd2cbbbf5f67361cb1b49a60a174fd2ec652112ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 152543603eb73d42b65d58ca69936d5252356b27a788ab6b2f0ec5a27e86358c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 983779fc364b226775bd698599c3b2c598f5dbaa886b4cf3d875410724ea6c3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78f412563c711969daa9e8f406cff03dc5a23e37b173ea7e06f08b7cb008f3ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4156c4db0fabf022f61431704d2de21bb11072239ca605a758a5ea19925ff5d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c34874235d568b1997c6832a82a9339da5a831e56aa4150ea63976160ef0e2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6454bd4378cf8ccd3b9969a908d82224dda4f885aa05605df6b001a613fadf4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fb0e2c306f70750fdf6573cef654322cd5bc6a5494cba12c8bf2434c131acf6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be76fe5c243ca42213535989788aa6d79442a563e33c11aed892e1f3930416f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 313cbbd4ecd1c0ee29bef18055a6384d0f1dc4bd9f3b7678594f531b153d55bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d754c69c242315a4c9cdff88cd8680c341353b1a7bfb594167772f643b54584f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b66211c1088623f27f77ba6a1e0624d3b700c73f8433191e6413cbabbc4e292c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86761fe91c46332d98fcc9494e3a509fbe91d91efdea127c33cc43671561c159
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6368b9f92a6bf70d3639df0282e77cde9069428c7f27b2a677dc4fdca3f6a112
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2b665bc1470b391f56b1d8828504bf4ddf1b361866df0b4d0f68a81f0b25b79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f46a3cf3bf249f22668c95872f0fb11a55a4ae047980556cca51bf55d334adbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2152202de807f09c3f39be0be010126990846820541e4caf9c4c71dcaf6ea9a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85164f5cbea487db03507ba18ae4fc97b3d7b00d1762b2624e39d15474f56da7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc7a1bc196e8897fec5b98ffb226e1a4125a3837a3adf610bb97087ca139e22e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18a1a954af67f06af2e858400f5d6d9e59770f33499dccd4a0a651131eee6a87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b790d019af7412183f9357a5fada7156347b04f9ac5854ba441e69a45096c093
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4af458b69d1a88e96818409cc0e9ff2ccc9c98dea70562c73c7660672975eafa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5f51c0903fe2f650e9ad03564b08c6fb276a2d3aab86f95e1a5fdd92ec38e40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa751c934116acf0b01fc611d5405097596568720b0a6e6f2646a47acc0fc973
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31b9622dbbe485a1b02b1a8bb7393cde3ac9dcccd08609117a292c30699ea7b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c1c3aeec6f76971b32966b8af9c9a817b68719b952b4ffd276d5d86983dd2db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a0921e5731689b3a9bb77b34b809418b91191c7a8377596a86378ae2e78e9e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07e2af56df796173ef3879d322549c6249d03a91b667c0300abf88f3cfa22860
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db1f9c0dc05e268b23f4ebe2a5979391aa53fae0721ae2bc20ab4b8be94f3254
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06bab3c63b22d4e04913e9193e1cd3f151024ffb044d3ed4aad9135557c9defb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8acbf0aa361358cf5a95e01eb0d0f9868f8aaca3f7b167dcd4246ca1b9d9689
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75ae22a0e9c26535d9e1d0dadf278af3bb76c7eb9253e152aa021ec2c5ae10d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02db581887ebda65b94f54aec14a63fe37553c271cf39dc739ec78c572716172
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1494bc851724f747e2fe0cbdcc1ed565d16a1455ba56c34fb0588bdc60022d01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6faf63ec155f2e196c2c399e453522104082b175a8d58884cd782f4da641f82
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41777e9e680c61b1a8e4ac3d59f651f73d8a15eab50f6df4ad75e353e5399edf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 feeb6e2716f6d0a6d5d87e7d798e8f4e805aaf0b3357c994f566ba86834d42d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbbea9fba54759b3a76d4baa1c5adfbf59961e5c56b53bf25418f7392c34c9a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a66da390e0e0158051ba82bc29cf49ece9388c34aa13b64714ee37d3c564d29e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64baaf43d116e6639a105dddb52ba0c84ead5a74a9c0c2622faaf698b98b11cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fa9b48d33ecd8420322283dde90774445642233632b449b4671cc70b8d97d14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c288961e6231c1d7eecef657d6fb7722b882e037efa32a1a8ae7081d7071d91a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd13b8cb3214f8b5a72d543a51115201d31b7ff184b117770728ec0f67fb92f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90eb8be0ffc98daf39543ae5c77574cd66bc648944e4d362997ad93fbf4e3757
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 420b3168f25c3bdb1d55ce12ccbe811168563f1ae39e5f26ac954160ff1df16b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad26dd157640d018bd79def39f965fb53b9006ce72c3dff7c656e362a4dd4e60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d1552cd783fab8c1410f5bc13d2189e1d8225e6e44fe9e493fcad1b0dd1fc11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b05270cf8e78860362be34eac1a83ed17ac73d9d97f441d3ba44276ca6fa0f8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42b48c4d7b54f2c7f3ca6d9ddc96f7e897bfc270a2ff8a858e96105fd9a6096b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0956a00b2668143c29cdcd88253ed0bfb0db2263c9b1aebfacfa4ca75efc0127
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3425f1b78ddc703823e167f128b3bec7bdfa5a0195ad3ccf735838924840753a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05469d7fbe6ae243d9c463fb65bf55cb1c6703db08602d02ae326fb90310bfd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83cbd5a23f869d5e6db9faaaaf2e107d9d4991d3f731b882046c3838cbfd9bc9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dcecc37b547e7890761411ee511aadf8f881d084ee67f8c039baf1243ff263b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c91ef1964739099f1ac0d7c831a9b09687145eb607eb1568591538f9f06386db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 209fdb1ee76979c902ab122c3dbfdf9ff28dfa65ec4e42506c57726b90b0301c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc6278a25a084ad51245ab2e9353ae0a3722b23561b48704a9fe8c39286a7bec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f80817f76557e5334dea5f5126cf077a2a65396fd93f37dab4abf1677c09c77c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95e16e67448a1fbccd1c5e9d28bf95c828ff2e63986f41c54c9e00620443e4e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f01378cb257549417d69ed4ab551d346351e0d7c8c9d583a17ba1011064034a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 639e2496f009b492724a72107a994e6cd6b4dabd9a0a0d271e07f48dfd299ecd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40eacb54362219adc8edbb180a2acdc8b336705ee85e32c8045882ed7b549cc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1fd88ebc05d6f14572377660fbc3ba74a0903b6810425cd96d55c0f639c44979
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8dca5045c7069cc20e63e1e9e8e405d8755ec1bb0044ba413a67ac6ed33982d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00a60168b03e0bf6375b5a6e9b36eb3875699ade6ee3fb3391095c9d17d26e3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c23ea2a0ed24a7207bce0ba297a6ac108d2a024892c166f998605525be12b6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fbef433661a4b59cf087c44a7438c71a2d1e4d85320ecc39b84ea1ae22e3f4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 441b266f3ca3962f6705c816dd36bb3ebf844e0d82785ef1746571153c6b837d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ff176dced4eade07dde87d8a1686806670331dde50f0d5f1b86537cf1b1db15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a492e463652e11cbd6ef548b0efca66331eac35c222a6deda076c952576e7202
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1b30c65f469967b0ae71ec04cae9bb0b72c857e6040d3ed5870d28a1bef0400
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f14baf9eb265f1102c7bc86cbcbc85e5cb50078f0ec6e54d52109b22bc773690
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b64927fbeab293747abe1f830133257064fe4552eefd839a086c53cfa881a1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a279e5d175a671fcc972574b88eb5443df24a0a794f4c9b560e2d5d80687e8c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 375e2f5661b4d8bf5bb4659547e8bdcfa704f760f212750dd3180206b85c6227
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fcf7b72650273cb6cc041488eaf2f43e52ffbf95710972790b96316d780a141f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab81f2c782ee073549ab0a591c2056572c6172c220e6f2c20cd016be68f38642
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 626e36c667ab6bcd05a8a05fcc9aec729be02b166cefd900baff812bb730dd75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d5e5bafe6542945922f016e4d2a2943c5d98d08f3bee634f80361585a2f0080
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aacb634239ac5d4aa0ce71ab89d9bdaf488166ce49abd09d2a2910297388f61c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b944aad50973b765b1b3818a56eeff590db2092fa54fd94b2f24ec32c0830030
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0781f6e7a77f90716b26eae8555d6cebb2f107fc51f58674e159470a5090acd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8504903eeb9b2d2a6d46e2134a20c22f1e87a04be0fa4031cd246f75ee735d89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c57df931fbef90c230aa60c18a8c654c68f7a84415ba2a2a92f5915dc1cd33d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d18292ed0b321fb44fae7b22193fa5150b630c9ae1d62a815c864cef89ab336f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72e62cbfa339b2066784aed9c325ce10e1b4955518f2231788955d6d539e897b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97ff1e9806061c84a13cd3998e7bbfd595c27d916b3525fecd392c1b8e720040
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94dc7c9175b8f5a6311f25008c4985e9122e97249e16db13dae51a33cf8bd90a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10f31db01678774e3255f5c959829ff1c188d9a450524322b8390ee02de00e34
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3e2d40cbb5c0873afe22e943bb1993ee42485c486590788f5780405fec8fb90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87f5dbea2de12798961e54db06c8bf6cac5fced4da69bae1c93c8f7920074fb2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b00af8ac13a2a06f7737b312bace2fcbc2523ecee24d24b53b6af4ed064c74c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6af6f309e1cb82cd67584ca01af7fb45a980edd57dff2a4d56a4487f33e18db9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec355c2f794f82ff854dc493595e47291e4bce55791b11dda9dee441b8bce2cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 426f8087fb56bf248221ec21b620f9206b8a16aa0f38b284e8488ec6eb4cdce8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53bd98cb3bfbc098e38acc9fa69147003c957520a7d24cfd75578506958b8de1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 033eff0fb9d24228a55a60c34d5d91d56b83a5c6bde981be500319ef8c60773f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 517df793ff8d2612cc4a8d1b962da5a1171dfdee0bf514f07ad4289065a669b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 762ed81edae0db8c8fc370f0cfaeb70105747d370b81451d4837a9fc3845b286
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 967d025c66148e72f8e75f6edda132deb211995aa912431b9a1493aef54162d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acbf62f487543522f4182ecc6cfb02edcc8d1ac024bfc541a9c8a8aa75bccf8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1bf812e8268cb9aad681194bcda1ce66de717a61d4aa101807e30ccdd156314
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a15417c6cb0d45fa45e38afb4652cd50eeadef682f59b63635a7737b002f562
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c787c163dfb2910653da083e40026727d870826b973da3ed145c435c681c1db8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e31087ca2f53757588fb6a5ce7813dd5e2fe2e92d17dfa048ce5e45708202fc3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87659c1af4b80f253010db4443c6fb7019604ecddd97cbcd4aef4f3c53433ee3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2935eb4464fb77ca0a164bbc4acd1e90e22ad258b445640322e40fceab8ba07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a8189868cb482c1bbebe21a9bad9a71ea2bace905cd2395769de25f84454c13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cde8fec9cf45c40773da10158cfdbe83acacdd58667a3e7fde1a16621c6462c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffaa384a208a5484eb0b5173053686631071d1caf3cec065d3317ae2989a119f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 709a51bb7a4bc087f20c020b1efa9f99b27e53e94214f87ebbc432ffadda1830
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c359c9f151bcef0cc97ae663afe000a4bf79a072afbc6f5b844775871226e5ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b95b81ea9ef108a0e320bc76946017cc6fc150574f740fca21d689e74dad5d43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afd6b8f8661a8be6712faa6ddee3d46ad228e341d50d6cfc8b714f83b1e8d56d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f4d492495a8d57ea48693e635abab8a49334c5670982d0cc8a55e09148c8c82
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc25bafba6a9665197a75580a4e81557bdb9b67958e2459ec97202e3ce68d58d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6b9fea1de84657b568234bd07e6f027ad5ac0ece03158497ee356447c7bf392
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e39759d17639e730d28765e37344942f57e43bc3e28daa4aac9d1975d6bf2c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 630d298b2baca13a62f5167da6763ac7a576bd61a967a226d5cfb077d4701a8e
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 428KB
            • SHA256 f91c4f64be2c7fbbc2a7c803d48a7af64547a85292f22956f6517ff9192104a2
            • MD5 SHA1 SHA512 SSDEEP

            memory/1100-0-0x0000000000400000-0x000000000054A000-memory.dmp

            memory/1100-8-0x0000000000400000-0x000000000054A000-memory.dmp

            memory/1340-17-0x00000000006B0000-0x00000000006B1000-memory.dmp

            memory/1340-32-0x0000000000400000-0x000000000054A000-memory.dmp

            memory/1340-16-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/1672-109-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1672-104-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2656-15-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2656-80-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2656-5-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2656-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2656-12-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2656-4-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2656-6-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/4108-97-0x0000000000400000-0x000000000054A000-memory.dmp

            memory/4108-106-0x0000000000400000-0x000000000054A000-memory.dmp