Analysis

  • max time kernel
    150s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 15:05

General

  • Target
    353ad8e6fb9568f84df646c0672ba60a_JaffaCakes118.exe
  • Size 280KB
  • Sample240710-sgcm4avbjm
  • SHA256 cc4cbef497a795ac520b129a2b30f9671543bf9dd70a31911674eb60a87b354d
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 235.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    false

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3596
      • C:\Users\Admin\AppData\Local\Temp\353ad8e6fb9568f84df646c0672ba60a_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\353ad8e6fb9568f84df646c0672ba60a_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2564
        • C:\Users\Admin\AppData\Local\Temp\353ad8e6fb9568f84df646c0672ba60a_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\353ad8e6fb9568f84df646c0672ba60a_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2292
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:404
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:3252
            • C:\Users\Admin\AppData\Local\Temp\353ad8e6fb9568f84df646c0672ba60a_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\353ad8e6fb9568f84df646c0672ba60a_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              PID:4304
              • C:\Windows\SysWOW64\install\server.exe
                "C:\Windows\system32\install\server.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:4648
                • C:\Windows\SysWOW64\install\server.exe
                  C:\Windows\SysWOW64\install\server.exe
                  6⤵
                  • Executes dropped EXE
                  PID:4816
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 568
                    7⤵
                    • Program crash
                    PID:2068
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4816 -ip 4816
        1⤵
          PID:4788

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 5c621024b6988d082081d9f04275a75dc13521014beccc9dcb9341fd830bb73e
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 26dc0e85df6b39a64aa120c3fec843664a863e015caa796305107f3c8f8f6a7f
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ac624ef1d6cfbaa2a2744889e656e9254af7fe4d4eebf778f9d011ec45905c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1d45346d827c83e4b17df80263b01f0f85e661b6d9d430282642b0df2e0eb184
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 448117743ea005376a090607b71fb0301654624e29850b776c2af302c612deca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd5dbaee17b4500830cefb1c5f4cb1a77376adb1d1b463322a65b888f3103546
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55f3aa871057f066a62e6ba76cbef5284023bd7969587b111c446573358dc9a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a303dfd649bb111a8254692ada31d645114bc56012e1145bb47477b67282d77
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c09c6000d2effbfaead17b3ed0c2f6624298d4aeb0d602da2bb736918fc31daa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 681b7fce42d211780136dcd3962ebd9a610c5855570c10320f86208e7623c413
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d4815df40e323f4ec10f825b6b1bbce58a657fc85b2e94716cb6939bf16b5bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c03f484dc82b31d7ed92941e401bb7a7b3674e04a1ce002a8f9b5883c5915636
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 637a09a9ac6fc0fab1ac798c342c48a5bd8bd515bff740f31ae85f6dc0e60b2c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 efd5dd4e7feeeb9baae4797cd3b09fe96f55ebb54d8f13e05fca02e7905de6a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b8862e2d9e4ebbb932a807d91dfd8d45b04561e3ebdacf62cfce053096eee117
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc49b09f16a58abec8f47e84a5bf8c09a3f43a6fe31f7968f24fb2f2e818dfe2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6be4a349b72eda7d5f31992c266f779ea7a175449ed277a56c9992b69085a5a5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97783f7936c6177e3233383df3aff5557dfdba5625ba5760b292a9c7cbe0937d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 241b389bfad04ffc58e1288fc8d940d4de2e49e833dcc653e6719d30d64327c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c3cb6dcf886d0c66550347da822e4a7e6ca60a62eb32528e24413e3d557cf0e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4fc59075e2ba46c1a4f10b59f12bc13324e0b751d085ce6d60d3b7d3727dd354
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f87b24b6fa985ccf83e64d1b1af65193f85bb47757873689f7f9fdf4fdbd271b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e7f3965c6ca447f37deadde2cdc3cd1f004122a4096c726478266ac15a22dcd1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3e385b3b0a8e65c7abae58f711ba69339ab52549f456eab74b45b5196f65b56
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d955389a7212901de2dbbe19abeb5c2fb1a4e92b840e5fc9b7fce6d263bd392a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e15cf921bcecba4116084c1f524a22b340ef8ad873766adf3f1fe57574ec23aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8939f1a8cbacf632187c8daf20721e88fd2c0bbef3a3eee388ed1f4a3cd9b979
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a6762643b78173fdd4df737338adbf426d4b74d5c8fbd55438b4cce368241b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 275218cd617d28d8242a7361cfa4f5706b2e88550b723c3cacd320d78c5948f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0bce639acf6fcaebe9ecef77b4f7cdfbaa2d0214119f1f9eeacee14fe3379eb9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de230a4aa61ec4cfc986ef1ad9be1d5eaeed0acbd251e24731fb2c43ed1cf1c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3856780e0fbede7d94d425495c0c5a12bb4c1ade747ff175751ad2af1eddc9bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f83b4872ec353dcf9fb8432761cc0a1808054679dd9e7fe27b188131611ae63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 611939034df0c441996e9b1c29f414781cf35967d8e7720ced4c366fba6b53a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b8df7c7bb0c3097da5fa14c49dde331bd271479494d6fa5543f032ab7fa14624
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 435148259e02ed308dd81878078be72a15ef3324a368fa7668e3490a13a05d9a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 45b5dec36d915705a8d22aa93c9bf3ba521249a0e13caf669a3ac01ed22cb6ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 650aefaf98e1a21fc6c1a54334817089e7d8daeeb1d23fcd0cbf4bcf522a8758
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 84eb8234052077854cccbd30cb209bcd719c6e13b2a077a11b0da37f5b8ffcf8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 17e841cde3dbfff8adf902581e7a9a9f496237bf0a230b8590abc624fcb17973
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 33417a0976c18108813aedfac48dbef271f095ce7dbf524d1d4d4ab8d88b5aa8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec315275130eb36e6dea3bc9cf9ac1a4bf8a105533d1e51132cb071b6c119853
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 52d512224e7279bd871d2cb7a5597dae83b2c61cb0a53c6caf5aa76490f8635e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 87432851513e158649bdafda960ec40152025720ba7dfa6f8b49d4959db90521
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 05fcc2d52fb0835efa1fa026c9a30df695c9290066d6eea6c0991f4949e22a20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 91fca4a58b4986eda4c2d12879ab1bcb1e52e7e4dce05ef820b5920c6cbec844
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cae1807de1960fb53af93ee00873e34883c719c74cabdcfbd45c658242843d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3e57ab3651147d966ce9b8e1a5de13dd7e88d8edffdaee8d1e827db6d3ca95a9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cce1e65ccfc36c354cce77658e3801fc11a2fcdb92f8a614579ba1f73e1ea791
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d6bbb26bd4bc5f0fb262c9518b84553584dd4a4c03f86e21fd6ebd6d7217889
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44f969ce1ba1836a1317c55c58c57a3dc0770e7cc170a9e7cf924e17d40c2469
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5145e0853e5a8d0b4120c7ddaf272e4e4e0d2f77dd0a1211fce4252133c1b54
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d11670609a6fd751dbc1536a6a486f7769f16544821f14ae5b7c4e50951d0e8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ff90770082eee34cf9d39e8b2e33b9472b16fea980cd42cd481d55a672722648
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a304eefac8612aaa7a89df54fd66acd026597d2063d60c9937efefd61e7735f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b8c880dfdf0dd6d57f8f0b8cabcdefe6c7bf187a1f4aa82a550b40729420f5b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66c82290e27926b4e62c33fbabdbdcb801a035790cd51307f111a1fe9870b6f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0015b698ec8806b6e65c7a4b96885a9f53ae20e1b01ec27b6fc9b9cd3bd70df1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a44680bd0d03a1e6fe7a687b623de1d7147d1ce1275e7bf5b289b79798b32163
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ac0816fcd153694eba204b10fbc7150e5b3bcf39d7c48a8f20cad469918f90c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ebc4e329fbb69a6269129726ee121161e6c036653666dfc3e9f48ae4cb860c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8984694ba28adf7b543b4167ff01cb88f68a11c2b94094c534b54c4ae0339276
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba13b1928ab4cf5025a6fa38d67be022a9756675cc98ee24a975cd241ab0a869
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 77638efd917b765609b67f49777e47e4f347906b8dac09c7b3b2e1af3a26f2ba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e814399d9b3b87960ecd53487d66a3b3099384edfb6f05a5de10b0de8d480594
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24e4ed3d91ac4ce7e2822d587826e28cd17680fd175ce9e66ae315dceb25a060
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 61bd9fec9df9d45b82e53718f1bec53cbdd038df5a5f157e7528c3ed0be20241
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 436df4f7ddbd48df63e5662a057d3c70257c76ba6172d6d97ace5b98cb621fdf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e20e4f1ec7654e246c032692af4f833a43f755a09294698efeb25d85e637fa7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f1282bc6d5bf10fc781646c29bd4b9e379a49923afb85ae0a3060922f50c21d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92595056d4bbbb0e6abc8e5a157f92b45b41b10da57df8b40155ef6ab61ab173
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0120b69a9f535218ba23f32f95e730834bb9471ee7b9b460ba1f4d06451db648
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b88b21144f1c006b163d0b82ea3a65e18fb4bd6977b291460ce59026e5e226d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b305ab18456ffcb4a07ed1c7827526694d26370a166b7d2ee284de5c8b7641b9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4053f10e48266957e08655f407a1538da92a6672415493e7161ac9afd623a7e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e21f47bd17ef9c895ed7223b14338a8d7d027648bba7673d65cbaa6cdffbabe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f63c8310f3fc44d498e7583c734f0e93f33781ae42b43dbe8cda33f46e4ebe31
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4153eeb8d55ee342ebeab9cbe25102bba37dc5143c3936b96d3875310457bd0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a9f9396b845f5cbf43f2803c4f48d0e7835a278d294118a02a4cf9a8a97d98f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 100a0eae59cc806c805a4ea2707e9aedd950e5359a657a3154f6ca0590538a3e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 80459bdc080967554e98ebd4286d66eb81da9035c5357dbbf8374ca3c77c7e1a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 45ed54a61010da5ed548fa89afb4ee042973706980d1f4a6051bd57596e43f69
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 499ed3e7afda94330cd21dbeb1c74c9dc9355e0c6190464457260740c25dd2c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 426192d15e1997a86df97fb71e9fa9028ca7b9771125bf948adfd1b4d368cea1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c67f705a3f5654dee49303c1785bfadc3738f57b5f4a46179474c107580395a6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27637df51104e62517c79dafbc59c85e82f0a91db303115ae19dd01582830364
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c90d45b79afe3561ba678c60fc99171c4491dc5a034af3dd2883d17404cb5541
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67dd3011bb8942b10e93ae54c9ef86c78460f802dad78b4c1a25bb47927671f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ebd1fb2a04b88436d121066e7d04da00a35d4c57fba71df0cc42a0c7f62500ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d39de118c01dd71e438ad7917d3c524def962f1b5522be42fe20bbe8c8af8a51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83c0b4a6be1433bfb369d4cbe2383cb3e095c9fc32d7f2ef71e95b3f603fb009
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5621146aecfc16ca59f5b811e6f2fdff375cfef860e0200bb72f0b2f569b0b1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a95bdcd873e6655ee8a91b69e394ea1aa8a0182e2b0e01ff032292b99586c468
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ed4e390020f8ef2d36b280a6d89cfbb10d35e400d5f8333b5efb1a1a4de08c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf60f253a27ca93be102f2d7f1a6fd82594c86cbac05b02d7b912f489b78d382
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fabc4a6767c69f504fcd5de0c619ee456e48343d8feacbb0307d080a8b0a02d9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0617e9d3d17e2a35853f1cc4bad39b8714c6545901e23897acae008a77d05a02
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a11efd7a469107159648cc4a6777391fcfc86fc17eb229319245a2666e748242
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 61643aed5ce54cf54d3805f7a18d35aa44351e391a44d6ba9aae7d201acc96e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2307b20ea55f81696c053400dd03747d459703485b65e03afe8bdecc387d42e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5fb31c637a269c7127872ef3376ed15df506115fed56d97ce131a1eb26aeeec0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc5b6f1771c00842b867351cea14cb8f983d2af4bfbe7ca13cb50555ec52f5f5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e026bdff8880d4adeeba62c19f67e04c20af0ab3ef573df485730ff02ec4f0a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a681f417765392ff0a51d271ca42d4e5da7554bce06a369d78ab6d88b4ac444
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c2e50cc38292e4622e613bc0969ae0885242f5a5a51d453a3ac47ecbe1be53b1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6c969258036a4b150c22b95a28f81ed0c79de0388c305be6a0cbb543e8697235
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78056bec2ce78011bf25e280460f512f50334eaabc28d2b55f121edb04d30bd2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e923eb40c707f559a5633959b03fe7f5de89448499338b7be7dce51a5a737305
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 51509c98ce7dcaf2c227afe00d6677405f21c18dc7d70dd41a9d7d95d314507d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c08d0ad47224bbe2ef81ac6670db4c47698e25f86e9759a36257ef167c229684
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72273334373c0b11c65ff72249a999692b8a00e8318785141fdccf344706ddc8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7bb5889b0d78a1bc9842546887a84ba6553fc0a2e10395195c3f40fdc241352
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d15e3ffd9f89954dcff226d3e80c7859ec5fd0f3338e45ace1b5b7222c22017f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 468e73f9e6eca8839a12610947ac3ab22cade4785985b0c05bcc87e4dc001169
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44903c94a3f3c4cd667bcfdcc1607a82378356bedf0dd48c97cae660ee871d6e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7c01603ea17cb94791334b8759a2486e862d262c4bf73fd12a138fa0f089d7d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08faae460be307347991504cbeb6c6913fd57f24c51680a2416178f4dc2d0d6b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1400035a767d8816244c792fdb5fca6237862a02f9d4f98ac04a58dfc35d7075
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6f858d5796df4c07fedc88aa7f05f22b88118dfa4bc9b47c6b10c80302b75c10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d56fcd7a9a677beb3bb3b44293f3d4ffa0ab730c25bac3e5dd6992c50b3022d6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e68e4f91202d4f10b58f0bfee0dc8b7063e68869f8be9d8afa3199e6a13cbf8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55fbee55c39bdf7d60548484dd9bc432fc41ea4fd24987435733352ab45e01a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f5e019eb5735747714387cc61a64765fb84403d7e3ce415e18c248351cb5a22
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df61a6f2e051df270d3d1a79c88677c800e5e4fa7c7eabc3b7558ad255990761
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d38915c3fcfc9bf8fc75f7612414913a6e194feccbc056923e126b37c64394d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b2cb067d4525747f74005e6a46bf86d9d258a655a65859957925ee2f835a8d33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3807b6beb5129ee88ec92757ed66ec76d97409362cca1b7c7468de952fc6a68b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3d57a274aa8820575ac28c47581aa57c9dcbc650b5e431043fcb49941a42d5bf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c2004dc0262445d4f276908a035ea894b121c4f3c307ad2dc83fa837995b29f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 077f3a8c02b7025e7308a99660ffd4761c0174a70346ef7b6406eba5a9a3018f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 de27c4f9efbc2161bedaf298803045b3671513f90f01a2121eb66e7eb3b88f21
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 796aeb26bb6922835fb658a607fd40853da878f27fd3ad4a06cdca6ed52abafc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab42637c94c9415dbe47c8f4aa1ce64a6a590f9a1ed750d83b9ed7565697f77f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 37cc0549f8a4c067409fc15af5a6bdbb40da97ad42e4693d6e95d3ede3a7b0ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f0125fcd0f4b91b4183b893b56eea8aeee2127c865ade05479633114bec07e7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9f18bb9f2188e4cfb01d81022f792a28b1357d4d48e8b524ecaab5c2589008aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b5c65a35cea345c7d39fa228a1fa5dc22addc37233883e7b66dcb2da7128d793
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0501ddba10b4b05d7efc0044cf8e8a60ae23fe3790e05d11dab2660cd57da052
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 58eb4c92beca93642ee9579a7b0bc026677bafd4ca63623784629c044daec8e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42a611041b701376bf01866c7a2991da28afea57b231d8b3142f62daa7128eba
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\Windows\SysWOW64\install\server.exe
              • Size 280KB
              • SHA256 cc4cbef497a795ac520b129a2b30f9671543bf9dd70a31911674eb60a87b354d
              • MD5 SHA1 SHA512 SSDEEP

              memory/404-17-0x00000000009C0000-0x00000000009C1000-memory.dmp

              memory/404-18-0x0000000000C80000-0x0000000000C81000-memory.dmp

              memory/404-63-0x00000000000B0000-0x00000000004E3000-memory.dmp

              memory/2292-3-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2292-13-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/2292-9-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2292-8-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2292-7-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2292-150-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2292-16-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/2564-1-0x0000000000466000-0x0000000000467000-memory.dmp

              memory/2564-2-0x0000000000400000-0x0000000000467000-memory.dmp

              memory/2564-6-0x0000000000400000-0x0000000000467000-memory.dmp

              memory/2564-0-0x0000000000400000-0x0000000000467000-memory.dmp

              memory/4304-1119-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4304-151-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/4304-102-0x0000000000400000-0x0000000000467000-memory.dmp

              memory/4648-166-0x0000000000400000-0x0000000000467000-memory.dmp

              memory/4648-173-0x0000000000400000-0x0000000000467000-memory.dmp

              memory/4816-176-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4816-170-0x0000000000400000-0x0000000000457000-memory.dmp