Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/07/2024, 18:06

General

  • Target
    291d9cc61344558a74fd42173ccbd31f_JaffaCakes118.exe
  • Size 789KB
  • Sample240706-wp2tqsyall
  • SHA256 2f06834b202da9846f3485c13b524001bd3cd99de11277a2387ceb464d3d6f39
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • sameg.no-ip.biz:2

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\291d9cc61344558a74fd42173ccbd31f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\291d9cc61344558a74fd42173ccbd31f_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4600
    • C:\Users\Admin\AppData\Local\Temp\291d9cc61344558a74fd42173ccbd31f_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\291d9cc61344558a74fd42173ccbd31f_JaffaCakes118.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Suspicious use of WriteProcessMemory
      PID:3432
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1284
        • C:\Users\Admin\AppData\Local\Temp\291d9cc61344558a74fd42173ccbd31f_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\291d9cc61344558a74fd42173ccbd31f_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2436
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            PID:4168
            • C:\dir\install\install\server.exe
              "C:\dir\install\install\server.exe"
              5⤵
              • Executes dropped EXE
              PID:1708
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 552
                6⤵
                • Program crash
                PID:2784
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1708 -ip 1708
      1⤵
        PID:4884

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 230KB
            • SHA256 81461f30891ecfb66a0d77b888bfa88e5a37489125cc52b60848e3650a3517f8
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b353937ff2e5dc44530a1d3a8b4b56f122907c268d18c5425614416cb516ba75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea068815f444058785a5f6d0f0e23cb1938f32591512e7bdcd1ac0c6d41f301d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 090a8f5eb20833881cea654610c2c2cae54a707a548ab124c3b47f6dc4d50319
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e4920ed19bdc1ca1c598cee78194e77e234a3faeea96e7d558b3ea8e888710d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5246259e7cb70c9bb870743739de509582a8b119299967b316f43af3e2dddcdc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf15f82b331fc313750a64245964c0376575fe946f988b49896ca66e0832d4a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcc3e755b1272fdedfcb9fe29a2ac4e967cb2095e14d98f138fb8d5fa1f0dadd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15dbcadee4c230ee3e050f37e37fde3192c7bbb3476e94f70feeb5b6702b9062
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ad17d8e501bb9a35a8368542581632e2775cb54524552a05022df02bb47b611
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 196f6d911c887f966e25778c57a06015aaa69c95e2c97c1d2991dba3b7f6504c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c00f3957eeb0230d6c4604952c66de943097dec67fcd0690f1324c2ffc309bca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44ec59a24450bbda2093ebb3b4a5e5267ddb87b903207654ec75e69dfbd970f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 debb14e55ac156fbb5b5e097c14d2ac71986d566edf8ec74dc414f0f0f3f64e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb2a592d6bf3bb1a176de70faff704789bdbe57a86869cce479583b84cb6e621
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a481741cc609d31091a35afdb9a86333652fa629a369ecbadffcc268d550750
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecb102b2a5f88b85b2df5c3489588198e87bea379c7beb8350109e1eab1be026
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecbd0a2ac76bf27245df0398d9ad5daa2f80036d7b5f38739143473d2c9a1f7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33985401c3395a058db52214c238c1fe4d0534b8ab8ef52dc13c395604e41cbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81c996c7bc5e282b45c873cf4e0c8085d3e021a1c49a0a5fae4363fe034bd703
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1280edb3cea3c44b3efd555f5f861cbb9a914f061498026f3eb1a94e177cec1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0fb8e9c258a290d223ca517c2f2f5a9dffdcd6860ea26a0ed271cae998659a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fec00f0815018792b29d8cac8d0d10c836c04e78ab1b3a888be440a88bf2b28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc2c5d8a4d2db2c485a98a4052a67e59cdc1b08dbfcdf922d281435cb46d890a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa5168269e59acce375958c0ceb83cdbcf9e0b551a4a6e9a1e1532062e809734
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c86ae8a1f6742be6eb5c50f82f3b7bf4cae73f5cd66ca32e72d55fa98cecf77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d3d49ae3a2515696ac1a1d103bf996cefdf267f25211d755c5fdbfbc6f7021c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 275c1a91b358a60883d03497c15299ff0c2ab32fe38857706a57addc4fd17f3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5b2fd4d0b7282280389519234a745bd26164eda795e7aa12ca91fd636b202e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e93afc565c4c3e04987981c528f30ad9f9a0a755c04caa0b1654e8e59e7b7f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2353dc1205b580f130bf858ae3c2fdf911f77154ba0d738955b6e2937ad47b7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 428f4277060f31e3b5f32c2739bd120d65c81801da52525d8b5676377245d8d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 491b0904afcbfe1bdd42ef72c6673121dc70d505f380f90532ab47d6cbe315eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 208b36c9619cbbd2fd932a04cde8cb76acbae7785557be06261f3a09ef85875a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84b05154c1f9a8151781aeb712582f757d028be371ad3ec1ab9076aa06376c87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfa953b637422f1e4f64ffb0495aa96bd87e28545b3a093355e50bc2b08206fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 164a28f2043f00349765893b5e5ddf862d883fc363282bba57ccacf7c1e45059
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de4c8a5c7ad2847115e45cf20ee88ecbcd49bc32eff03e810bc90802c4f55e8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1ca86afba6981e6b1759a59050bb57797143212be3df0973c6c6ad8ad401dec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40c5a51abb7ac75fe30a414f2c584f5f893b908c7950e4d1ce84e118f71d6060
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe13925e2ae032c7aa81e5670f357acf443e2add31fa7cce73df0629ec58e43e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 102c4b35570a7a12908552430bafe66d98079cc4780d0eb77db12b010895bbfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94b36e89038758f67bdb7f46aef8839dee578cd5aaee87a209e24550e72bedaa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a78056bedfd061a98c7e05cf999e0dd5d6410c7e1f0e235308595eaa66d14629
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3860f5457587b2b2a3e4598476c908286e74de34f81cc534b337912969f4ee11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26005acf583481fd979f96782e76c29815e2868d6db65617cc61971bbbcdb387
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1c4f31cdbe6d82e1cdbdd83827fad52920c478b4e66251500dddc829b7daaec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd3e8606ecf49d1d9cfb6af75111290511c80747ae318f8b325b41de61670ddd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5915172dfa8ced4e4617537e70bd636450c7154b26193fa041e99ce58a0adb1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c55a31b4e2b71073640f59074eb61311f35bd91d0dae43de51ee2e8661b1760
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe9adef1c745e2eea59f3b9da5162cc7fa4b45bbf9b8243837bec7c544d46ac1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a12b1e2a428fd99bf054a07b53938377bf9730495ce177ff72e2ae6ad809c5fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d151aebf952515bc5f1d765b875853e858e76d57d4726834716e8962395d2a7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e09fcb30547d9fc0049b3ece0ee0ed6811503d715b5b00d35c71ccf6dfe193b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30264fdb60060acc6e8b03e3243296fc7333a9a53e88eb93472974548af32b51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56b9de86080d5a36c715b7c2ac9e948769c0a6970745df94d61869b2b7e18de5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bafc1dc10550aa37102269cb027d29e0d21d7f57529c15f7c4cb357c0683f6fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3299e2cf709f7677cd4c9427cfa5a448c07ebe731ed7e33f9b07df8a57fce12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddf190a62bf14a90573c128931ac6a95144a0b0ddc19b7bf93f99f5ba43905e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a76715ad7770ec25408191bed87dba0de1fcc078273ff69ed49bf06b341fad0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 467fc607b8b55a37b05fd57e236dea9d72bd2d54df0dfce8df3fa16a5903b1ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebfa292769b3751aa70807cf6a2b62299fcd53edb4ee44cd621bc51aa4cfe3ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d70353c5c8f4f57689fcb154b251e06ca503aab10494f0769225b87815454aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2f565165a5b94baa5c82e9f336ab3d3208de0b66fd8326b93c9fc93f0262787
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ba6c06d3336767ef0021117aa9b3853c16cc7a64b046aafd1cf300f521f7fe8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d1c61eb881d0e09a618c5c683e4943c96aa6d634938389fd8052aa4071ea994
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9bde1d8f0b7bb0e57a6eb63b0e5966e8ec275aaa6936860d3df807d7c3ba7e64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0caadb288285257ab5f9efecb4980cf6e5f67dc9921e70910b3ed5d6fbd01390
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74cc17d8a807601e40f5ca95d29c8bb44c5edbe45fd0ef69c4407358b6a6395d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b49afb146182c3a3e0a3d70d917dbf7ebfcf6cce14f52b62904d0d311d673ae4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 399549aeba034da45219af0399c440ba309bde18aa246f206dc21f2831a4406a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c751befde5252f08ac7c3bc82fafdbadf33532d4cbafe28b363b5174dabb013d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64045b4d80cc946ce685f8c1826a74082fc37e6174b15c3a9151f716ece7539c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5391707c466c4dee8c84d8cdafa1643a57d0996e39d0dbeea8ca8dc11c4f7c5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c7b1803ceaf657f1726fd3041f6331750831f8a95a6e88410f7b6130019fb5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cfb6302fcc926295697a15566a4f542deab0dcb5ff0729b3fe53f958f8d5a0db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71e8cba9aa71da4888d74d7c8b52ddb5f0094c4a155e43e46afb746214b94b34
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c0adff645f37849b399efee3b8d76be6fddf4ddf7c7eba1ba5d329bc87fb932
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ac87acec5a9f7f8293cfd9a637f5646a6be6e8eb03cb6f2ec11b1a650a1802a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6541af6fe729b87a462b6e3f4b8dbf104cb8a118c155d44b9c7664d08ef36d24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c064f390e01d08b868358b41dac9f3005d0c3bda16965eb8276f9465820b0d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be1b88c40315e3c1315874dde9d12ab812ea32057e83af607ae910d711842a9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96f8c2c28bf8d09cbd72bc857df8f41a036e95687da316d4d8dd194f959cf558
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2df177422b229f8f53ec4ecb86b44ece8f464b98248001a3db54b4a082f7b7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0baf409fbd428f11f03667f7381f4f880e48e00fbc3f74097977c358d4f409a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b35cc0fe7e0a3314e84676d6ecc2f2538722a09f16883a38704a272eed9671d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a0645720efcde193863446055ca83968fd6c4b495b92c6a020cde4b90e6433e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6c4bc2ba884db2e342bb10992d968bb080bf5f648c00c2def4a4811392374b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61f9384d1b0205517701a419b0974b371faf512d7b691b19c55313f9386e02da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9fb473cc88446269cb864578b558bf78df279a9e98e8569c8fe4f42c9a8c11d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eef86439c5d67350d64ce9bc8168f6ae93eee0d6eacf2c1c6a62c37729095364
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d44f36f173c40831437f6a78541315f50f4991b4daa7ce85efcac7f80ce7d3cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e74c708bb48b8b569a13b1e14399b761592cd51af9485995a52c253932853e3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b55a304ff8136f29fd1434d46ef8f743809a01623baa21842719a948ce855f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20b699932f41ac9f08ca237dd6ebacacffb07a567096ba75d219b167660a092a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 686b9eb540d694dfa2b632f3ec5314bad4bef4ca08155dfc76f98aa4d1df0db0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 790f75580028612d63456e4da39d04ecb39db5559c0e886f30cb98550bd0cce2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68c6bee70ad1ca4898c620e1e0183d0c2a4861508056db1926047cb175cce47b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0aa605ac56800aa9751c03f1824b71e06c85d6440446a54a08ad80aeb66eed5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f2789160901796887d3716c814f423d5e4c2a15dbefeff16d8b887f5175dd74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ced55b1b8a98899c68ccc8cd419639e664a2974958c021f5438201bd153014a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72c762eec9114bd489b301ae4b0caf5268af938104c2ad064216f2293090c596
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a3584e076edb200b3f63f380e02c9cf6f5e3185a727afb74045bf2960b0a0bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1c3e7ad453faf701505032c8a8b4616aaa08c9e9b489f236464c2414cd5b5cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e9ef55a521e4b5ec2061fdfafeb642c6231700704d6fbd95e8da5da7f2347e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e814208e3310ced8978387c238e84b3324c6d539a13fc4e11a3878b74d4c7fa3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 052c9ee0c75dacec55d9b6a956f1a7175b22645054d2dd33a60198117b2b640f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47f1f666c0b84425378b7aa6a7d67296592afdaa20f142c6cf9fd3b2a2e396f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84dffb39da9126a0e8423c94f3aac7e0109de20b021e4447fbb5d59c7ac6ba88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09027b03929da71764a51636f703fc9d5cabf57a55a6f1500918760c953c1361
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb2129fc2a430fc91a07e17993145de9487237e5af40eb370b7c1326b572b3a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f7717b072846505a3a5acba7e3e37a09bd7bbf933835b95206731cb247a8fc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbfbf3624718dadbe84c81e1a79e9c6c7186bda1eb19b35859e6b2c174715dfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0711611066de1e11a09b44fc3a2a5d2821ace977e2bed231cb612357bac3628c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eea9f7d684a4c708baedcc47a5ea358a8d04f47b4907adff789c48f9923c6ba3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c621ae58fe95863466c5d6af32d599cefae2b1af076450f71ead52500bebccd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c46f4bcd91beed3bb6d59dea990a358279475078dd31d39609984aa9b8f5ff9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef5dd1524cdf4c28ec31fdcb043fd7cb6d6de1ec6c9cb8c90039b01cd68100c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d87ae2367ee25e1d78498941f7f0832c0f4ec5a85b0c896288f38bdc5af9ba11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2eb87c11245529bc0671324ccae5a7d0cdb6a7b7e316a3a54401086d1354cf2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94ed3a21ababddd0a29705aebe744cd07c7dfc33d371aff05096a5885b280999
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad48b0bb37ec7f477c4dea570ad217e7ea2f2dab2b30f508e14da98addf67f1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 781ad557922091281472683b3ffc6fa6a05056adbbd5220eab87d832e4bb1943
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e9ef0b798665adb4d8ac0fbde3358de00b9f205f84c0b4d7ba39825468182f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c83d3a522d139121efc0cf540b6368a0090b8c192bb0c684a6161cffe31eb42a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b47e6664dcd1116de94d032a46b861663c2a7f565f24f445667046bdf69b742a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a42f453d9c129440c24f6621f13b940e72d40efd2817d4a5994ff623b4a1a99a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec6bc0c4ba27d89f8da74d418b5e57c0fadcebe6f8bbaecc073f17fd37483b89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0d7083f86b0fc3bfa945348e109968796c1b62b98062a75ca106daf1c62f7d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe8cf6e9cd9ada6c071409be1a7a6455e79854186ea93c1c5dfaa68cc9cca002
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60551db2eb2f30c213284888ba67d6caee165aa4892dd54a60dd3d06a032fdc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70e6e33518435800b6a3eeed44520a7e35ca8e08deca37da9a12d38262fb7de8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 928d16b40621cbf96f73ceb7c0b69211150d666901bd240a8433cfaa355324da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2802e63b557696ce1da8f676a643f4a23ca9682e42467c15753e556a4a6e473e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 812bf94921d36f9208393624406d0acb9d16409e86752dec79a5954d22a4c5da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3be7cf08f6de7c37e472f6283b6bbb764951f1d3fc617739508141bb955eb847
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98d661af139c994c4e81724c5356397e3d6a0ddda8d4449729487b71315e0f7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18b8c2674fe19ca529eda8d1130524773d2013a400f362bcdabaf7e05ecf0248
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a0c59a05d81ca2f285356a5effe65a909d5b77aa78e423982e23b017e321a7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b9d08d99c6c6bda9a461341a4b92ed3436808673d7a02ef4aa70056ee6d9685
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d261a044899034e25fa226d2811c21ab7b9ad1be63b74824fc94420d90a0608d
            • MD5 SHA1 SHA512

            699c4b9cdebca7aaea5193cae8a50098_468f6343-c0e6-4931-9703-30c6539573cb

            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2539840389-1261165778-1087677076-1000\699c4b9cdebca7aaea5193cae8a50098_468f6343-c0e6-4931-9703-30c6539573cb
            • Size 50B
            • SHA256 4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 789KB
            • SHA256 2f06834b202da9846f3485c13b524001bd3cd99de11277a2387ceb464d3d6f39
            • MD5 SHA1 SHA512 SSDEEP

            memory/2436-97-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/2436-1194-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/2436-1192-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/2436-31-0x0000000000610000-0x0000000000611000-memory.dmp

            memory/2436-30-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/2436-1193-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/2436-1195-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/2436-96-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/2436-1424-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/2436-95-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/2436-94-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/2436-93-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/2436-91-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/2436-1191-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/3432-26-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3432-18-0x0000000014000000-0x0000000014055000-memory.dmp

            memory/3432-22-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/3432-15-0x0000000014000000-0x0000000014055000-memory.dmp

            memory/3432-92-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/3432-29-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3432-21-0x0000000014000000-0x0000000014055000-memory.dmp

            memory/4600-4-0x0000000002290000-0x00000000022A0000-memory.dmp

            memory/4600-2-0x0000000000400000-0x00000000004B0000-memory.dmp

            memory/4600-3-0x00000000023B0000-0x00000000023C0000-memory.dmp

            memory/4600-11-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/4600-5-0x0000000077BB2000-0x0000000077BB3000-memory.dmp

            memory/4600-6-0x0000000002420000-0x0000000002430000-memory.dmp

            memory/4600-7-0x00000000770E0000-0x00000000770E1000-memory.dmp

            memory/4600-8-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/4600-1-0x0000000000950000-0x000000000099E000-memory.dmp

            memory/4600-0-0x0000000000920000-0x0000000000921000-memory.dmp

            memory/4600-10-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/4600-20-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/4600-17-0x0000000000400000-0x00000000004B0000-memory.dmp

            memory/4600-13-0x00000000770C0000-0x00000000771B0000-memory.dmp

            memory/4600-19-0x0000000000950000-0x000000000099E000-memory.dmp