Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 11:33

General

  • Target
    348c32d361903bf1c7e9d2cdd4b0b98e_JaffaCakes118.exe
  • Size 276KB
  • Sample240710-nn4ypsxdlc
  • SHA256 7d3589a0e96762aec126d6ecb27bd7ff87e83fdbaaa5d3e6ed776939f0d8c854
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • birkan99.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\348c32d361903bf1c7e9d2cdd4b0b98e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\348c32d361903bf1c7e9d2cdd4b0b98e_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:2288
      • C:\Users\Admin\AppData\Local\Temp\348c32d361903bf1c7e9d2cdd4b0b98e_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\348c32d361903bf1c7e9d2cdd4b0b98e_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:2748
        • C:\Windows\SysWOW64\install\server.exe
          "C:\Windows\system32\install\server.exe"
          3⤵
          • Executes dropped EXE
          PID:1624
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 564
            4⤵
            • Program crash
            PID:2508
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1624 -ip 1624
      1⤵
        PID:5084

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 d904b8af9d395d131efda564167ba0526674a249a92e78e0cfdbf95d75d4bbff
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 2b22a8557e6ae73e9a2dce683e01b356d6d00855b4e416be8f0bf8082737a32d
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74137652d0a48e3c35fe0b4ea280af03b1cbb13b7cc925ea3dce222bfa5c68f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 578026156262bc860e8b274e8ac67cd46a2e112aa0b054e23e4495fbde70c9a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b16764ff5ef9106901210bb8eb787db9f262646da208283a702c029f53369455
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d708f4b5d48a2d6df55ddb8775b271b6a5bd7ebd6be187dac86529962990b2dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65b47fb4699d4b636cdddb1cef902d6b69f5d9be106a9d7350e5b5524ec9d57b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5953b8894ddde74792b142fcd82f10008fe836861e3980f292c24a494edb5f80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a6351a380b5b0b35ad8e75362ab3f860ef8fb308a24ba36de3276de50ce7c00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 264d324b0fa2fb930f630ff8d040a70b48b06766973b221b885c1669a4c1f77b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1eb179b52105c3e3edacec7e2246d1d4d01f35219e7cc6a158c6e1b5176fff5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7400fb508a54158120df108c80f09d725192e830da60ad5ff8e774cbec2f1b92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f0a3049416682d925f8022f65e85b221b0ff47adea0fd063a4dd16e14da70db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e21f1fa9c0b1012c043d2a2e7a04d827009521c0794d70304fed7cb81bf8dd03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7675d685ae0103f3bc22d135ce57f2aa948eeb860197a0450b52e81c8087512
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42ebedff1914939afe768fa6455d4fcf5c753af63b74280ee21dab1f2b2d7fb1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68a64f95d19d57ab62f25efc25c02bd223047c6808f4fc1d66c1caec58e002e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7437d0e35198c79612ebdb7ff199fd471c3462cd5884fc2a8bf32c40b751a59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29daebf1bcb9581fd624e0e41f286fa22dd0dba7d857640adbc99d1519f80204
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44662ad25435c202fb5ab0ce18c6f023d71fa628014a8aa5701f82213242f6be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb19282ea68bdec89b41e46eda7b57bdb3bac8c9682280d526772a3198e4f140
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b324b1f95f8bb03355ada9be96a682d67ce755b62bc891d236eb43b8cb0636a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c0d4ab43b25d0735ce56f6b121f24ff3ace5f789f2ffcba239683ac21e27be2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 689a9ebc92d257d80830110fe6acec33fd1b1c5b8d992fc1c55e01e115e43745
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3b0cb9a64cc2933ed6da176e0e9c8dc78aef426be5a8bb559fca1ca12370fb0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abf0f81a0830c87fd5854776503b8e61b99b3cba6ff9dba093583e5469ad6e76
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5be85607e32739c94697c6bf6ee2d31f10c8f5825bfa07e41e9abdc51fb8032
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6304ba3ea2c22706951e5bec93168366f9ff7e80377c5de3aac9b5c8ef55ede
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60804f977fd50978a55e4642c1bfb770a26e79ee4c4b8d44f16614f98477a53e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91ab54c634392c26895e7ee1260ab2b77e98f1c4669cbe3f3200b4779c7a22da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1aedc87a3c1f222ace007dea458d0d3675d007a2aa8e398c25f10d05dd57efbc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 787cb0dbd8280ce203c021226c2b0081bed0cecdfa0729e16bcd3fa4fbff5e25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c247d9a58c8d7d4421e7cd55cbb69c5af1fc8c09645a564a92693d3e12abf421
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4651db7d9a70245ba4f0eeb6a438bd2c4ace4ad77af30f38fe0e6302ca2febf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6ad53db7f29742234ca73bca0d07a3279f7930c4da1df47eb127814b0d119c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db06cece012478e37d86911ad4ec36006424a1de324cce7a4975b1ca6e731326
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1c6cd786cc39ddae1ee88a4e8d1745d5253303a8b0449b3924c3a05bdeaedfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4b495851703c67a5f92bc624701ec3260baece80cbea161dbed70d1ebf4cad0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e5a488f147569c72260c2f200a3c0be1ed791582cef37d003416742a47b08de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c24605b09e4e57588e91656b60551f59877b7ec23536e25b210b249bd5b0983f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34604ce5ce4fb005b453e28b5414391e07fab682e83a32c5ab2de7da460d29d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a53bf8d6dcc21fa47512718c4f87c2d6c8b25bdf52a8ef3b188369c718e59d48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8634430967c498138e0aeee869e29e0f897cd62e2e497a56ff7df4248aee6a2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a10b18827fa419160bd20edb5208719d72f551656b72a55de7fd0a66714018d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19b13aa0c7c2107761704a2b4ddd3d48b511b296bd8b9935bb30cdad595dab44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f9b991f98d42d06d99db61abda65def7eceb79dfb106a053ce0be71de6e46ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 475ec5ac4ff03f85ab2e22f60d704106dc074c0531f8ffb34dd54b518cb0bc3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad6d8c2e21c064073ac89b1b06920564a33074a25cda5dc4c63b18b73c8f631f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51b5f3a38f8cf9b859fdc6455fac968d970415fed11165e6a27b6d520a45cf2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fdd5332d93cdea57abeef1998ced1765a6a601b7ad30a85ed79de7df4d2517d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 467294d9aae84a06bc686d176bd71f2cd4a97a1b01aff3f766ca6bf82d2c35d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 179a8d389f9c5792a3acf20f0368aeb02b3cdcdd2af3c9b678b022296661c0f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 361db96483c54d6407ea2f7b59aa6c96b840ed3d08e981fa64941ae78249cf28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f86ed6c5ed57fb59d556051bfbec0da644376ffcf14c4e3cd0817e7f5009a333
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 840b7891d6af22996089ed6659f3e6a5282985a1e3db71a43ff9c9fdd59bd48f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71c2b77ebac3fbb1031718f1d0f1f953d8fcf386b84c108ca2acfe81efbac6f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b60a48f1b5598b5db898dbeb1955bd6c894f51e9c63a3815da49df8748bb534
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11ff1e1597584767dbfc3a5a5220238b21ca390f14c2cd20f5ebdf9541afef9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1425a7f59d71887d0e05cf75aefacbbd2d88d382ecf5955f6932d32565fb906
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13b7f703c9215475441440c19c75c78a5133c6ebbae3dacfb36a9a5a0b76731a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4230449838d928fe080a3cf8d314cb700a90801d463da7a9e0d497de4865d93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb6524b2b1fc5056985b8187570b564b2c85b799a7c866bdddb3b195a1a0de25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d96a57dc84226fecfbcf16441f89a29ee65798fe78de7c59fdf47228740e2c47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a08072564ab3449c636b0255126ddde99b066b3580c2414aad8ac26719e3b08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c83ef7106bd8c638bc01b8a1c6399dea4ab2aef6b69a8131f9122a76fd16ac3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cfd173ae828fdd9ad0f210f7f02c296f52b94ef9d01f8cc13b987c1942b4162
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc9288fa623dcf2dcbc88b9ed71ca6c00b7f85bdc5d4ad9540b3bea942ffce78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c155f9428ccad33bdae7812e70352a7bc31b15ac7534da97ad696d4fd83397a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fa2cdf53b8791f7de1e2529397ec8796e6bcc50b387a7238f3413d6fec0c15a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9dcdc2240fc3043fd47d25c959aad53dad237351c5185de5b74f1d832af8185
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c79f0f88726bd5a7df5139c33d40e758e73a6ebe0c029967217fef99e167548
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6813c675f378c2706eb9161bedb1b2a7afd30132a95e8897d382bb0baadf4489
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af59f1f8b668e2b4f3f4bb2a36e8734596df591c57d6b783da0817d0141b86c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16ec561276abf27ecdb327ce5f09993df5e17dd635b8c029dd9426b8ff2b4178
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6991496e4e3d388ea17101dfd0776af084ffd26eeacef485fb79f59ea1ecd0b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0af2542ccb888f406c36d805ae06ae252288f7427528fdb23293649a3c1b7d03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01eee015dde8980264db15bc2c5cb521ffa6201ada94ffa88285941da975c443
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b83061cd4e3c57dbd15dac839951b73318c77794bcb9c95c7624eadbd4ec45bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6183a7164ac7305fd02cf9f6e40d2b7f5a1597807773062afd94325e7aa0bb39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8dee1631b70622ac423f22123a5928c92de7463b043a030c87a34cf8f6843ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27501c39b231bb41a0643b5a9d871ace24f93fc14aacbc785c71d9da06f0217e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 923ab78267033954398672ebbece21c0a9ee9ee5dbf5c790a9f51ef7a89ca3f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d833eacd4e44697b18cf11191ca982f5942b732368837150cac663a58ceffb1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bac6051a874df3d7003638d93ade78570afa249ed180f267baa506ba30ce2768
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e594663be2c689698d506c0045b90fabecc70ae85aed979a322daccf6bb6151f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c3a7445be0ee30195529097e36f9767e088e95a1d0cd676553160069836475c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e905f9d8fe9956f6d3e2fe7cff7605866193e8a5369c7869cddf4539745b051a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5a8cd0a653401a3424da8e8f384947c2852d23c77c688dfda2db5910743bbe8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed593a473bf7101a1fb0cb81fea1d09d1e02fab2f693a781f5bfffe094b5af61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf12c3a8a1d45b769b6901c365ebb936817f5dd34e8d1670428e40eafbbc6db0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65d44d1722c0c69188e82992f75d3f1f6bde4e402577dbc7e8296541a8bbcdc6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b3e7554a972e8ef3429b0ffe70aa51cd42c7f71e9d26857e1da76e1fb6a5744
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50a7dd4978153746e61ccf9180eff464ab69d522a9568c0ca06aeda7c512205e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e422256a603bce954bc2b95da23fc1230dcf5e995ffb16c7d86d9365cea5f30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee7d38955a96d709ad5eee15295ffcc9eb6b12b788d555324fae448014e0eaae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0eb98f94937d62f0659f1f6deb32a2d02e4cc6700c853e411a4eea8023d57e4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bdd27d2c803af00c3dfcfabe01a0382d2845d7acf985a3837ee8d2d7e1b2b545
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25e5abc6ca7bd9c0a0e1b2f99013eb20d8b229c4649a8f68212499664f9b52df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ac9df18609bcc615f17a0ade8ce9f393fe744c229df3427305ba08441dbdbb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7b17928e6e57429f33a7892af8f6f1b86f4bd2dc829994f6791ec7af5f17542
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ba23d1d7b96eaaf61bc853dff5f42a3fda1cc1fb631dfcd7a148bbffccf1db3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ed1d55497a34bb1705fcf480308d63528683a2d93c4fd765e3ba65c4d828546
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f127fea5837d5569702b1898b6b30a71e14fc8db78d18f5931417d6e6be73ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13c427fb0a2056b484686c1df0738a0d4b15507d8f90efc28ff4edc1813a19cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0cc9ade538dcfc958948b2e441cfb35f48e82250977b693ce65cf771aea9d16f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d20dd7656a38dcaefe6da18d0bede12f778627ab5469e44ee6af54daa0e2ccc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6575cc3dd70d87bc7ab788e7b63cec7fb59b6862f6ab9eaf9e75be2cdfc382bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95eb28b96301efe4f54ffa19c68121ac36b78e3642a615fa9efcee412a4f83c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54a7d12234b2fb95e5edc6dd9ddce5bc65af25e6640395f8dd42423066ab7a15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea9e3f4fd5ac1992e5f2678405c74197192c9d8506bda8f1133eaeab49fd3a4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2da65ce5a459a59a6b8d6f3b29b6d8b30733f4c44b72dbfe3d4314de3a34253b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5340f2c8f3f058cfd27c8b67941576b425d94d834135fbf08b993b2871282c39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d8650bb9fbff66eda5a83f67e22e1c920d0c04a3e601256ed504f0565157653
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c44c7aaa0f1a2abd2da0fff9e11ce09b3ae828bd43bbafd7b91b0c2a38504edc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 737b414a63b32fd71d9c17746139610cc2f10d6e72e964fc008d80401654abed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 903f7e951704d52d71c3f23b8f7ca302da8a787779b8520c47eb0c826f1ce586
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bac76a5ef61875bfd68624c6085eadbe0bbebcc1118d9b7c4d33eede5935747
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09c9f79dd65036635d8877388df30bcf0d3609f13c047cf3cccd5435041ed73f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf6cf53176fc594d480e036b30d6374f3a9b8e8536e72d6f95f02ef50c5afa3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a49465e7169ee5fe9da5b3a3befaa494d6175453558fc32e6926903a829d2943
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d577e9de23d21de123de6338cb813a813e371c751daa43b932fcfc65e6ee384
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aeccdb3fbe20f1eb24f4a67b3b00db3dc36df12c46abc8386ab10d486991aeb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74909cae31741328496e93a579f8a53e4b2a56a4a4f05ecaf281127bb8ba929a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb2c5b1f314c9d61e237e4fbed38c177e8bf93c1a3b82a7abf16bbc04228217d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9a740f7fbda06fc5fe3d3308b296ccfe910c31298ff1e5f093a00cd059767d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25fb8d62ad79e898776088a9ab628609ce60e8d098fdcbe4749c39d57445d9f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 104d50679040c1e769f4c5344502bb0dc4cfa40fec81a84e829604e5a90488e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ba82eef19d8dbf02369736c498f99f95643d487231097a0f5eaff3925c6865c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6755d0e3dfaabd5a138f0833587233a14c3aa637e7863bb67b9d2d12ff49e513
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffb2df5b32a5e4d1a046d72ba6075df79594824057604b78d20fe76dbba5a196
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5642b27888460971a233b17f868041d12a5b432ea21784a8293f97aaf9696d6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04b75ba298c5f23a506063fd57ce5da8b4f0afab58443f21ccb179f6f3420ce1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71c58ff8625837bd113313c84e68d760263eee40bc333a4a6f2c0ee95fad1776
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1fb677834e7326eaa83b2fe60d73cfb53a90b4e8a2d6fce22dbb4764dbd144ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6eb0a4cf3471ee3f509aa3d36a308320a930ae8336b8729020706e36572ee1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52abb3dc8f76f07da91ed453deade0a3cbbd27d5c2845f7ed6b09800d05b3f24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d454b55f4febe48bac49e655602fbd2008d7ebac738e60a4fb95a64b323cdc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40d0779ad11e4c7b86732ab33dc0957256a019e53539b99e7cee97de506fd850
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dddc673b4570071ec432bf60a5b15c9000490f7dcce1877851e6d3b0b38ff55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7720a17b42ba0fa75a8761893f9b66c736fac0599692cda369a34ff846bb95db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12cdebdcb4b9dc35106bef351aa109e8732b78705c74857712adfd23f90925ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8dfb50ee73b8a136fa90153efa86be67e3d11676e9439a4d79c7dfc3bae4217d
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 276KB
            • SHA256 7d3589a0e96762aec126d6ecb27bd7ff87e83fdbaaa5d3e6ed776939f0d8c854
            • MD5 SHA1 SHA512 SSDEEP

            memory/1624-98-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2748-70-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2748-9-0x00000000005C0000-0x00000000005C1000-memory.dmp

            memory/2748-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/2748-10-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2748-68-0x0000000003DF0000-0x0000000003DF1000-memory.dmp

            memory/2748-1205-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4324-65-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4324-7-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4324-0-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4324-4-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4324-72-0x0000000000400000-0x0000000000457000-memory.dmp