Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2024, 02:55

General

  • Target
    3bbc15f5bc9c478adb9b567114c4bc0b_JaffaCakes118.exe
  • Size 277KB
  • Sample240712-der8fawanm
  • SHA256 db767d04755a393c29419cb62cb71b574ec6b1e9273aa15ee882ed207869f8d4
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3bbc15f5bc9c478adb9b567114c4bc0b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3bbc15f5bc9c478adb9b567114c4bc0b_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:4788
      • C:\Users\Admin\AppData\Local\Temp\3bbc15f5bc9c478adb9b567114c4bc0b_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\3bbc15f5bc9c478adb9b567114c4bc0b_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:3700
        • C:\dir\install\install\server.exe
          "C:\dir\install\install\server.exe"
          3⤵
          • Executes dropped EXE
          PID:1236
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 564
            4⤵
            • Program crash
            PID:3492
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1236 -ip 1236
      1⤵
        PID:2868

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 0372bb15d48da49265b1466ae79bf377a16d043be51a694ecf00a66adfba786d
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 230KB
            • SHA256 7eed3476ee6a066dc28cda424ef457e0d467dda5c16dd981c5cd089cba9a39bf
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8e2f4ced7378af183c8cba5e0af68066ea7a7db33ac77d457bc10fe9bfc7d65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ebee6d242f6e25773ffb203b053e366017ab34d4e2060ed4ef28576d21d66f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc1854f33884aa3c1e47c9263b06fd56d5398dbabd18fcd0fbaca3732b26f5ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e963939ec0b2368b2287cb0e4ddc4ea00fe7e34680caa88db4a90b50db9847a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57b1b475a4316dd3769d23dfb3e87584e32d6c80475cb8f4e61221a672331d7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95da709ef62fb4bfa5adb2c371e15e14daae330c711eb1052da88c6d602134f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee79024c9847396d225c6c494e52b08d7c9c4e0c87f0cd48b430576e0bfbc0e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62ebb0c717221afe0257f8aba24cfa0ed7ed0d2bfdf3c413afe2899b7504f359
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b981e9cee860196e0c5f356277cf212ddcdc78001e8a6d1a76ab3500971a56c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fc0e4e5b0c2b8487698348f93579f5a44db0a1ecfae138938f94dfdc5f4f107
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58d1a5caae099f0e4ba9929926fb8f2cb90cf38ecc5944d244143f1c95781f7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24d2e071fcedeb60fa309749343d19c552a76bff5a251ff555e7e8f74ce3997d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53feeefe1171db065f1b4773ef8578454ecefc20a89a6e107836fc93e5b84184
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4652fb34faadfa2c39005fb303bbf7aa8896bf74ef961674cf93485b31806fe0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70c58b08324d28bb3d8399e837d4b91afcc868a50026136313805a1bc56fb88b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 accec71efd2be1b700e239dae56ddd5109628eeba6a09dd54a394a679d622f1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6733f984910040b3befda8b643ce69e39f0b3a2590ce6e6854091aeda9f7b29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ff0b081552e8cf4f3d18e7821bf60e661ead9a707376458bb28395aff381eeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c03229ed78c860c94059dbe14d6d8db9638fdc5dcaf64384effac9c87871fce8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa87d32e26d44312c675a2af2028961078642bb6fb338e965efb5ebc99007577
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c04e76a498f414ec0082b61b45a5dc00da554644863ef5c7586f4acbc6ea60f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9dfc5c66f2f3202e42e9f02536c51c7283f3d1c99ed274ffbae867cd48220e98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c46df1ea6fa06b38d40f60ef54a78f27ee351cea829fcbaad74814853e13331b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44cd8a5bb18feb89c744bac42eeb303264075e304985c201541fd61dbcc6c37b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2e746f41f254c259dd0731d9f3eacfde379c13c11fa29e101d099d57a8e99c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8aa254e06e63442d18fa6a6107f54e81be4a5d33f34b66de9035532d35d4877
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fe07787bc77d666ce1b33ed79a91a695ab68e0d955438aac65b267eba3c3786
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46de5ae4e0856d7bdb56b1beb7944855ede65da6eb69cc3168098237954c8f97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b72c1a578d08177a6fb42bd7e89067a4126dedddc4fac33b2c229de5da158d8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17f924c0d0aeeb3b84a6eca5d59a50360c5fbf02dcbe179bc1f2edb06fd3936b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08f859133cd3c6ecb4e35e0639ebb98024c6c06dd7cd42cc2ba19f2398561b81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce3246d0d38913bde5a4d0ae9722286c863bfd22824cb32fb6c6c3828919e7bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f0efb0e231e4af84a1a692e0226bd16cc24b497ffbacd7315439ab5f7cfa429
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ceb8976f2104f26def33867aba5b1e12e4d163f3f19fbff6527b0186bab114b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a13e7ce0f8925803d0c20c0995cfa589e3e63ff8a90d2b5fe2de7ef8bd093d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6459598e7f180289aa604b610e5259297086e71a49b5049f0c00f2b98f634496
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa7bb97eeafc9355ccce2cbcd14657f1c7bde8a7db6e6c524159015f90ea30ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 992c00610dbfc941126c05e5642cee028740e1a03b6b9ccc95bb5ffe98afa36c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff3891e382c85c2861ed7ddf524c5bcace497c4b57ee1348779e4cb0d88ff92a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cfa412aa9335879523693cf1e4d37428adfabb08694b2c6cc8904016e13b80f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3043d10b42e1bc13088fee814378c31e54d1d1bb13f923b9e15b6093aa2d2aa2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfb026b3f58302d9f07e09918424dbdea9e6a11d2d1fa71c16a9d74ad98edf0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a702a6def39705ec4f3b85fdb4192e4a2c9639e84839c21976e32f87a37e3aad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 235ad792aade55e0b724038d72cc7c5d60db7b8611ac0101fd2536e2c2eed302
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f2f2059dc82dfcf1bb00845adc28d1012e104ab903cf3dc1368d2780ab0bc1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2e4759a2a3a5933d23d440a883cea154ccba7f59f02ec5bc2c43ca3759966ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d82820202872a80a67a3172b78ee12e4cf8da1379dd24d0458d8ad0bfc47aba1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39869095d877b3a75141f9f9230636bdeda5f26b13fcb81ddd31e6d6ba050acd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 726725396d6b63ed964643ce620e2d74d92719b32f24ad8a2af168e812680243
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b3ca99b9a39f96a2f3c6557b54acfc6b282b0a5d246b1c97d4b8c8b282069bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aaeaddfbfd71d2a5ff5b8a8ccdf2a05ae699a85fe39e987e31db14687f32b41b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ca82d9a3802e9eb2bd256539d96a102c3c46673c74415cc555fee02651870b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6bcec1d6e9f247e79c1a985fd606ac561f05a3bbf409836b5268e1154501c68
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce2fd44495245d7b68649c88259ecefad342dfdd0518c85568b00d31e21e25c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36013e3987df2761f6f4393bdf783ce7d617778323b6a185b2dedb6e55e6b60f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6aa733c80dfbede0c83e83d2a44286da257ea739eeb0cada4cee5e3588cb469d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6dc05655fe0629e71032ac58af261e0765bab5643cccab23ecd9d31878daa47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 685756e0ecc176454f0793164eae3010443cbc5651faa91ead008d762720518b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9d209620ac33af63afb797e5de07265c87a2e6d2bcaaa88e16c070ddda90395
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfa4afda58e0247a0a462c168f609d332c3613d1244b2e6da59d19e7790543df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be739734da2247ad5b07ae3224977694dfc256bffeeaaa8e23cc0e9121442f88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5961b8fda1b5277bd8c0bced016be2e02bd8f8c1cee7adabb9639da02871f718
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c798684289146d94808e78ac8ba00e98ab762c1138e37b42adcf685139ff2d7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53d0141249353dd3cdc035511265e123313b92cb35810449b43544d00c7c11c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01c51c367e68168d1a02ffa374968e57b18c1b798999f1085470e77cee5005b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f7f8d71ae4f12853f48a9ac43ef392173eb7cec25a34e36ebee2a4c04356890
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8290c173c717262bf66012c9a6d3216538a0171dab28eeaf22c98b04269b55a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba713fcef242ebec7d2d03df2dd6828c069d41a4aea4c11d3a70c0646abd64d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2f937c9380b1277989ddfa01797da85557cce06e42222f914b7c06a8bf4ec6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80ce523f0032a38d117f3cae320c8cc1c7eab174c070e02cfa56417c3da1c3bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0dbc50a14a70a6a08e906f72e2947661d758e28a9566822c284e0f265fe97719
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b89c1d253bfba6b3b585ef99859c420a8f02a66c6e606243a2f374c62e11df2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e76d8c7e8a316ca53a5722086745cfbb6fa1a53835f2d9d40a104a902bcefd90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fd666bb8da53909394f1e5d4a62122d123ffb1cf0f20394f2ecf06a53c25123
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 389ccbf89da8d1d7058f68cae4aa3662397940493865513a870581c46dd7c6a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e98ae592589b280a07c9c8fdc4572b726e0d699217f9bb46be67af02e497b8ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9168940c2e2cb10b4af4081f3d9cef788753e9a4ef775e9009acf7610e6d443
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ab57c10593b5401c1dc90bff716d5a439a8dbb5e88e407542689307eab20e24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7595acbe94ef23f5182d19cdb8a1880b087c9fe182f0522cc8d38170aaa32553
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cef2bbd968b318732cd3ce69c5ae7d4d25f6c0f20b7aee99620cc42f359e89a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42239d0ab6101aded5cd4ba79ddb1a6b94fe037517f68059b483368a6dcf1a6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e49e72a40040d4439a378cf5307bb36cf8561818ff1f6c753f4540f0494ef14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5baece69b632576791f70a4a9a053cac70050da2d5bfe4d3d69a6313c07061d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbe68e8aa6798313685896b6a0fbaedb540798723cf3bf96d21650e8b7d7386a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d37c25ea5c46b9a59703e66c16dbedeb94b1c403b984f2ce2a09582f31682dd8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6aa932aa740a1e7e7de153ffe8d1d1fa9c99ab1275073465bc1a324e11f1ef31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fc79836ce6593fec96cbc9998eac3708a146e8c82ef688fa13865b92ca18731
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 866bc4eac53fe52ab1fb3bbfa63ae810c0fb430fb06e9b7153ea7f5ea0109918
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 855e9aae6341511d430353566f0320ef26a64dbad81e4792a04a91d9c45587ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef41ea20e70572f7e81f5ae884591b284142d55adc74ae2b4e1ad5b728ae9c3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29f84bda52e9d50acc7ae908f348c4e469742fb5b82f19b01ed9803044348e17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21cac69328d2e31f39ed7ed67ee7f2ab63c70b62bdecdaee7f8f55c276106c01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb7982a26189b220a495f1455a559439af7505081b1f03ec0bcc65a079f85074
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a648524c334a9e1db8f3b272a31151f18aed0b34e879013be93f0f2590a250e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d47ea821f9b8cd22b0ff02408b3b640f6c832d16986891e17ef6e12b9b10959
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b43546328023e3f5a2f29334b5b13b547f447342c6983c225595941084002858
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7f76e4db86660593bbe3ea8f3453f85d126348444d895a01719f578b2673da4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9475c0a3cbca4c2fa27adb64506113f984be78483aa523067b8deb5c391c1d79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e44519165550521fd8d64ace8bf2649a27c56b0908ee12594e791b1c820237d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e0894aea629f39569006b64b6b93625e8086a0fa702753e39ef0cac2bea87c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b465b430c6eda01f1e13d4785688845c756b22bf1d29fa3f8554d3fcb5cc14c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45e313c40c1bdcff7f96c324322f42f532b2621879a0cba0425b90e2d2a2ecd7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7faeedb03320f4809efae2646094253684119f44781e746553a8ae1f8b0e53e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af2bb37cbd9504f78910af4f88aaeaaf1256dda8baa680bb25511ac389da2c62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a526d26639a4203aba8da8475148c169a981408afe562e26ec77f522f9aec131
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22e823b33b2d23a3b55d5d6796e9cc44ea778b86f1edac5f4bd841669b6c90c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af94841b76ae72b46490ae2feae9be52b27656284e7d29ee604af5741f617dd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3d344e9e449fad146fd172b9308e9df27f76c0b08423258692e7c9f2da608ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8b77c99dc9656928940bc17931f1ec782042dff23208cab027a6ad59e644187
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 541a7a0227a4b96ca3c9b3a0bce9c6c7244d9388f20cd4112876393ec5cddb08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88ff9f34434719437871f35df2836d26f7f930cda68d03619c5aaf87da2a74c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5cdc713dc98adc399462546e7f0eeec5794b78b65b400d0324056f6f07d58bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 711f7d4a349c73efa1d95613769fd6db50d908b6a2881ea657e1d396a0b960b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e682e53223c9a9b8a2d3ced7f1c1328102f8f25d9ec60e7890e24e22a2e1f94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77d9d393185c6d7897951732d767d8585a2121b84efdee0e24b86805be16854e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8a714840b194c1ea319610fdecfc95c80544f23e95ccef124dc5bc6d9e35fef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab6b9489341cd337c0dee9375dbddd916a35d4b96b1992e6ee84a93236e3cf27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b6528e946cd98369b757560e622160b0184477abeb840bba17a08b696a9a620
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 efd79bbda7282f505d0c39525bdb6ee26612ff8a662cca48d0bca553d91fcb03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da01c8ec967c0eb86450cf6bcb426c172ce66137554e3d011e16a8ab1201582c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d764bade5d02ed630a53f392121526111a34aee41770583e142e7149f0587aa6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 448dab1c24505e4449e5ab9948001b62aaf923a87094531dcad2d215b9225521
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5089a7df03933e411599d510de2d05e4d3f7ef4c3d52c2fc3df4c8c0a5278429
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6bcd268c2642876dae233802859be237fbc0668f1dce1b4aaacdd19591706a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bca0afe5785ff183286a73451dfa645bd8f3eb7295ec485e1aa890238e0bf4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b3c118791740078d8669858db8a209ee5760356c63c19327d51a7bf1dbfc488
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68bd25d34534bf638f28c0374155eb69c08fab44102ea4d922db522d8a471ca9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4515620dc753bf56b36b22750a40da850412291782ed9b3542252451404b87e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7d01a611cc2da374362e3f2763a5cbf7a536b15bdea87cbcc35669b8fe364cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 400a1c3cb4e24ec3464121f7e410e4223bf541477df71fe49e8b97d234c8c0e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9204c01fa59eaa645eb39b5b152b15592a3ea70b63df166f5e8a986540547b6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 879e93a29232d298bec4df9da6639729f39f56422eab6fae299e3de70e8779f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b9acf3b24dda928826b47cdc15cd241654ed1f8215a3637f64479bbd94d6a14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75671c92200a28b7ce9d03259def44538f714b6ba5f257976e82d4998ca41764
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 715a87dbd8c6e0ac542d7ea45a072e02fe036a43c4b7c924bb1e6a97647c2aed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bba06fbb1f0edacee56fbd87097e2ddaa5e279cda4a69dc283f19a23e9ff0cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79e667c438438d01082a12c2143c3823b54d15d94b7384d84d3f7fb55de248ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1882680a302542c762a50a63feb4ad595a35af562be0e81b0389cff98f2aa176
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b93a41113afd7c2ac41ebc26eb6384b4f971331ef9da3d3c3acc01dd2201f3f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1dbbe6e0d4dc142e52f7459201b0b2864c4dcf83e547383f99d4be461875fe0
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 277KB
            • SHA256 db767d04755a393c29419cb62cb71b574ec6b1e9273aa15ee882ed207869f8d4
            • MD5 SHA1 SHA512 SSDEEP

            memory/1236-96-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/2168-71-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/2168-0-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/2168-64-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2168-4-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2168-7-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3700-67-0x0000000003DF0000-0x0000000003DF1000-memory.dmp

            memory/3700-1189-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3700-737-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/3700-69-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3700-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/3700-9-0x00000000005C0000-0x00000000005C1000-memory.dmp