Analysis

  • max time kernel
    150s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2024, 00:01

General

  • Target
    3b3da5d5ea2a026890beb330041ea00d_JaffaCakes118.exe
  • Size 672KB
  • Sample240712-aazj6szfml
  • SHA256 7317ef4b388702a2acee453629505031650a2a2d82c5ec87383724165fd45094
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b3da5d5ea2a026890beb330041ea00d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3b3da5d5ea2a026890beb330041ea00d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3252
    • C:\Users\Admin\AppData\Local\Temp\3b3da5d5ea2a026890beb330041ea00d_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\3b3da5d5ea2a026890beb330041ea00d_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1612
        • C:\Users\Admin\AppData\Local\Temp\3b3da5d5ea2a026890beb330041ea00d_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\3b3da5d5ea2a026890beb330041ea00d_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2032
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            PID:3396
            • C:\dir\install\install\server.exe
              C:\dir\install\install\server.exe
              5⤵
              • Executes dropped EXE
              PID:1748
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 544
                6⤵
                • Program crash
                PID:2904
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1748 -ip 1748
      1⤵
        PID:4956

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 d0733f70b8ca0ba8a4a447f6e1106618ef25a4bc2936d24b3eb925de0bf386d7
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 cd536a01f3f568fe76dd5e933167ea03ff6d76d2cac9cf5fdb1409f934e201dd
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b875c5742f17e1dfb0fcc329f73ce38353db554a6f93ac3104d2c59bf227cf64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98abbbfe3cdef3b7ec0bbd920f1fd509a273f0bfe7140e934cc1736b79507e6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 823f1e835b7f3ada66e28995f89f01e5c9e1d22b3b95e6938c397f76c96e923d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 faa22b211c4061af9a9da147cb585c5987ad65192dc53d8290329c5fe7da2615
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df53a88769c623b491b06f72f55f44b01fb1897f3d41210b64c7ac550727f9b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 791b31a85f63e4e090b8db22059224051c9ba101ece1fb962edc1a34053ff59e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e24ecb578987bd4dccf947624acd3a65fa908c857bd0c7fe5db1a256a83d1414
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b22ff141d3a33e14a3fe43c2b5ab53f85c09faf43882d33eb2550a89fd1d323
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1076fd9ed3db59e0b661a706dbefd17b7ec3da37af5410d2c58a9b73a593565e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 290c04f193b9e626b431574dcb696157f0681f4c52c575171a859f260c69afa7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd5988f9877cdb7437a23be7d5a947150bab3e8fb2cf931d23b9fc5aa5a0c938
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 752ff7f3cd62cb065176aabb5a3075769d5597ce28d33e073d36a7b022e07b37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6dd89a3cf5815fb47ed04817e37ed029b462f1e3a7d5c94bdfae1ed3f702743
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5371c94633ec2385d397b070559c6e4893ea59b167974f213a7d5236cdc22c15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf8cc25ef963f6b08dfdd6f8dfd37f6bfecc0766da0b5dc85be6a3006f20e919
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b7009c0726eb33e58ca9cb7fae38c3f6f26de9f3366187156d4da786f521b50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f364210741fcea459e331d3d1efaeb4ab22c41d3a109cec8d249656857e6e5eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ee1ea9a8ee13111c309a5144f58e19fa4e3a1942cd1bc503a6508595b88f742
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef3dcc6a64b1ee7d132b7197e769820864dede48f2ac759750376349a0b26ec6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2d7418dade609012bcb974d7e86fe58f69ed52500b16eec9237ba8cd281fa17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af05efad599bb67ac45873c555134c235b268ec9099afc439a460c074f12853b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 459d6e1c785e8305c79d46083b9817be7938bbbe8120efa3067b4807df15a8c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba5d022412289d317bf654268f38ad24c39138ae95f53c87e340260989636ce9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cec4e4cd7ab68d4992e0a0a4a149e8b8cda91974991d19ef84766c2144b43cc3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ab9eef485848aee419a2124f1850f59cada08879e933ff3f7c2517b1e80d46d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95ba359c5e2983513f0f4833067863997554568bb2a8cbfaf755709dd4d61f63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8b18949fce1103af3eb900295985088faa9523053ccd115191eaac621ed1b6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b20e020c3679b9b2aaf39c837d95719991347ca13626470e6ad89e508e7f822d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a7e65b2ce6f19c02df23c7bf97fa55a19f7009f81893feebb2fe1ce2a5df274
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d7064bf2de72cfcc7356391af1df143789916fe36f5b8726f987ccbd4d89dea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de4ee338f12d11a9c19a913b5b59b2bb31b34d3446d243989bd49b396bf94c4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ee6a1d3f1f0ff51c5de754e0d79e585cef75bff84d23fb02c3ed713e5783c03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9a12cfbc1a0ce353519e2e4b3de737f66764ae633a1109bc1025a6d12a64356
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8c7baf52d04803d41fb0394a6c90de0009ca7ce765f5192ffba103971a766f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c944f64bbddcb83be6c2dc839abad4354338ed131e25dab466230a75ddae6cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2579d9ab27e5a6742f78be0341aa869590d29dfc682185725ec0aba85baaa1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cfaacd05392dcb624b36f54ccd6428a9f571586443f5694a6606a5b98c91571
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6fbbea9f803c155077443deddda2f6de39b0089a6b358ac5b297e0c90bfa2cb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60ce72fa3f437733e00be7bc5cd5ed69041f2c3ec7f30a7717041f49c9a18ba1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e007ef47ee3b9fce64dd5d1f6039d6498220291e8a4b959b9c8f689c989bcb63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d33b71709b9d207ddd1152c256678dfa003c6c03833b0ede37c38c115c5c034c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 827fb2acae1a5514718db1fc922d74fa6c1b5b06931a73fe27971c5490fd1ffa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4190fa4d2cfc587905e8ae9f6c905c1df48a22608c847c2f73fefc3abeb0bf29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4fd242784ab72a6b26603431d2c2751d71d1e1b5fda95e3beb6fae7c931de6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cfdc6c5ccd0f03b1f01725572e84cd27b85b52423fabeaffc3872ee470bdb9c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4d49a448904ccd1fb26c9683383865acceaf547fbdd9e1cc3c718eca5e75976
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0145a7ee1ae896132c67fdf6d8eb983ac9ad8750424b410b9bad9c9f5392811f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3a756af6a8ad1417f65296e93c4dafb291de2cb022d8857bd52f36f52ebe3d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91623528369851b04777ba062ca9cc7d8222c2cfb9ec5b8908749dbe4a8cc23d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c041fe1e28d2379edddfc2c823b59c3dc703f07ec981d746e62d3d107c5c2ca2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ef089a84ea1477e2d1b879be16cd0e540fd5fb2ff2c6e7f31c072fde4fb6dd6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65d3f8fe45a94c79434ae8dce0e69dc9a0b7bc0a754a344fd9b9208f09b0aa31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 006a8c4cf8c0ca97fe5438c84e5d84c0f84efff7213e193879405cc9bc128fa4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 784a65deaac71b86884bd2646f23f5534d5350cbe6b62c7349afb002e16149cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c58cd7762853cddde6c2935d55bc913fe8bf1041d1a47ddca2d820f13c4c7d91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f64ba5b5371158d8745dd66b66804862b06907f15f3a5e6ef4a4fe983e42d25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 767f2ef46a9444807f6bf3845c339db96f6aee28a34113221b03a033260e69ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67eacd8790d25f055be9c81f44cccce001b9f70239b38764bdc2134c477e333a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96f0e49337113ce9d3176810032072e8228af4b0502f6e316949b636e0e00091
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df005e321e6748f33bef7b49f9a85ea37daf989d6fc06fbe9f4f282f2bc38c90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66c41f7db0bb8ef4e130a914b72d8088e95f9cc38e4f9e6098f8c9bca1035d25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2c9f50161c6d9f4219b8726cc28300313c707754c752f540f346615db2d632a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc7b5ddbf644bccf6410dc261393c5a6b7ebc08b3fe5e11fb351272dd79befec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5832281a8607ce726a16b04dbf70cb19c3bdd682d48c5fe2b388aea5b8bd447d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1df4823a785711ebd7d3c7cf6a5e668424e4e94340895b1f1b0b9c47b6cf86d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1974e542816a6c355ca9be63d832dce527f11d32d8a891f1ff3e4ceae3163979
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66457ebe1ccf34c7976283fc09b42bbaca3d57eecb13c0af4023451786500fc9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c64277caae95920273b7a7c913ca564d8fc0bacb5593fd847ef19a610fd3d394
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56a1399123b4e5b94d95ee309bd32467957bb7c1212bdd143304e93a513bbf62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25269089077c8210d3f0e139464af3d10196aa580d1020856733cf87dd616cf0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebd0bb1a4b1f00ee2cafcb10972482fa948772e5318972cdb91ad293e3f11f98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1b764986c9d1a44e8414a30e0016a5df0788a73ab6ddf92ba1523b3a59fac4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7451a9bf8d91597092c9493089fafb5a4af5a6e87487363dfae13f9988b2f1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 802768cb19e81077b78d46daf1b2aa204e1492f1a6e72671e9135769620a279d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fcbf4e705b407e50b02ed923f59ff69366d3649e391faf6a7e2ea35e274caded
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e45bb448e8799025ff101157ff5a35573f5996cc5c26620f3f80c738f2bf5de2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e5534f81c29b4e8cd7ec8e694880c9cd32fc2c3eae392c34cc751d4de620417
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f9d07adee997861e85e5817773db57441a7e5a781cf89456376cad1e87de547
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3da976dfb84ff0fa2e82b13f35999dbc98661e02881622268836738835cbecb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37ded97a29eac9faf7ebb805641a6c0bdde257ae5d689be9acf09abb933ec30d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a54c10aa8e07a4f336114ae8e4491a5bedc3de23690e901fb1d1de56c914bbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a9b296df8a2a93eea1b4aa5bd315b0f0bb7d290d3d3429604e5efa237aa36dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbef8d205d856776bd1928563ab168a489e5904c6374b15651b6a91045c09206
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4632449f87e7a74b5a2870885157fd90426fdc77f95cdd46eb609435e8a196a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d26421b3d8f4a078329397d1b0a47fc0adb2d7e8ce2410959f02954ca86f1df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 840344e327e8e3b55a25f9ce37148c0e233228207fe34b45e5a01e79e0af416a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86e938606d7f2389c7cbb1a4b089122c2f807bce3b49d98bd985a4388296bbb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d79437d092d48776e031bd41d78f1b4cb5904ee59613ab7af8c01a31c2624e8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e015d46b7ca4625eea132058489a95ac0233908e2abaea35d707ae04906a8609
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 866de718e7200d3d8cd2bad9a396789a1a1b728204c07d83920dd1401f15530e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6ce68134b99c148c9d55da749b3044b95c988cc5bebd4bab3d0486556401eb4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 636aac0120fa7f2192db9b8949e1ab21ad6c2dc28bf9e7b33b086e1e6ea985bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23e13c0eda8e3659b8c9651d77c6972f4907c7862f80fbd254f59ca4ef3b9c58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7e3e745b9a616c7514dc775777a928fd81fcd23b2ff963ef1fa162684761c00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8da373800c0e53b416650c0a355f950cf8134af4309f00786097fdb88977e3c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66a77aa6a041e9057d8d9ab8e7964da5cfa7d2aa5b8eb6923b91ed449d3c2548
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c71a7699af771cf3efa5d2f201d5406b44694942f3d28fa2070c29173ed3cfdf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7449ee2ef936c54ec365110c33e5dfe498c205f9aa845c93b1eee432f6fc1d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b1d903581b08c6e882cd597020ac1e8ca4f9a4296174dd61bcee67b1081ffa5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 520d663c1e2fd1a8352d8b75f88c83e68f5b18893ff0b947c9c9fabd1521a7f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4bef3e01a70437c9d036f8eae1422ba760409e78d7cf1d7ecfab35a4d23f67c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9c45c68dcc0fe87cc7a6fb2d9f4801c14dbde3bbbd445677c3f3ed5822efd96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 563248e4211705043b88c5954086759e408aade7e4aa7f878b4a1381fb4cbf9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 684a80eeef8c2bd7ddb816ad69f739cbc6e6cf4299a26e957d1eb73b4ffa43d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 380f0d53dec3d35089f387f1b04fc854471983cb4e9bcc3a213e76b9391244fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c75f08dccf6073cdc73429d9aab1f06b226afe799ce4c29bb92700347afde9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 add89d67c57fd305023d4428ed0aef6bfbbff50ebadac7ba59d866d2279776d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1106e2816a3cc349046f7a6c0c007e20a807417b176d814d9441d7e8857d4c37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6878b11c1d9eb3f33c6d8fca79454993f58c2f38a774ca3d9b946c6cb68d1b33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69594eeb2fceb676911356a0ae098e07c219a85830d7b3c1a60b22d624606173
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b9e22d9c235336708003a554da5597b82b5d638fe8c94f0eb2b29390444a8e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbbf3eb7799bdeeac43961cf479a2acbe82dfbcbe44f0d66a520762b9f1a290e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 033e333899d6015480d82c0b2638289cc33423e6892d10b16ed27c768c437c34
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 789d514879c7d2548d2104621eaff005adf5bb2f0df8b4745f3baef380f8583e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00092d95dc10fc8bb0507b51601d74cc203b2ea0202ddf87ba9c281052d7ba55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56f5dd3f8426834b98bb3d0a9c6bafa05d7cf9e38ee45982c8c84c6f1b39fbde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0807fad12565faafdea00fc1e456c369828426869a0c9f6e75ebe2a453c6fb5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a4e2d2b67718c7a824f3416811f698eff769b7d5e3fa5c27ab0c654f14c0a3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c11f2c19afb93c2a93d1bce737874fb6f32ebb958fa656cb80ac4d51ccf84d44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1609123327c890e611aebda0fa5b9a74ca4fac4c49f91300ad503a391d10f1ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 223ad0ca362e8ad222afba6dce6c3b2753166f85b27bf8693c73d0db4f42b9a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f84a95505dc321438b40279f03e5ae4b9fd5043ea427d9a337335ffaf75b0ce6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61b79e46ef29af573cd2e6379813f4ffe0d5220d83bd4d7ffe03a275af56ced3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 422f3fa7acfab114696fd8cbd3c72cd5ffc8aaf0f83a554127a11d3a5ff01ede
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d6c2dfe885f7e1132fd2b59d4abe032200a7673c85fe233f8750880c3dc8e7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f503687e4bc2730a53e641a81a4f4403c83619c83c9dbb2abc0cf59fb85a426
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5caf2f749bfba0cbc836d40f4c9c86c69835c4876a270188bd0be9c84d1593aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1c8c4adae2b650ef88237f1713e9b1fba94784a4aec21c7314576ea004ce2af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65310b28c3861846247bca21427ff9fe95bc9d9214910142c75a1f6eb1a8c142
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2309901e97c693216c61b08e1eba9d9e45b31952f466992bf3834829f113a2c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 097f399987379f962eadd4de7581dbb1d68cbc501152197a527b06f299f68eb9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cea9a7ee0c4a2ee5ce731a2e4cb51f63d42a22eb370556888f8655ec4b48c354
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06b2dd333070234ffca2c4fe53a08f6ea16121a5a023ae0afe7e0f86003a549b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3c94fc729007b086b645e254fd667fe11b58b99f6050122f359c77d05aefd23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a632273c94bbbd2afccc3222f7b1bcfd7206582471b8c52f15b590e0058afc7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20a3bc8d968117009cf308140aca4c6c8d7836ade26c4fc6dd550c7b2c5f7719
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f41fec4322b38bcded4de0c4ccc804a4c12e25c847b2f521fa64af26159a5406
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cbcdcaeed8010988cc6a6418a47699a4fccf83df3ab188f925b3e5b7eac4059
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbc257061bb9838dba303c49d102203417fa059c940c44e7d2d2805a2944ff73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fcaceaf0a7c4db7b8e77a6649029039971c94ca75dded7694ce78c6b44e75825
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 672KB
            • SHA256 7317ef4b388702a2acee453629505031650a2a2d82c5ec87383724165fd45094
            • MD5 SHA1 SHA512 SSDEEP

            memory/1700-6-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1700-4-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1700-78-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1700-2-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1700-9-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1700-13-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1700-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1748-109-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2032-14-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/2032-15-0x0000000000610000-0x0000000000611000-memory.dmp

            memory/2032-63-0x0000000000400000-0x00000000004AC000-memory.dmp