Analysis

  • max time kernel
    150s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2024, 11:19

General

  • Target
    4174513672b530323e0fe4adab14738e_JaffaCakes118.exe
  • Size 274KB
  • Sample240713-net25s1ane
  • SHA256 c719af6203d1a2888ab0fabeb15086edb8dc4abac047dcf0c0cecd6c55d99409
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4174513672b530323e0fe4adab14738e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4174513672b530323e0fe4adab14738e_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3368
    • C:\Users\Admin\AppData\Local\Temp\4174513672b530323e0fe4adab14738e_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\4174513672b530323e0fe4adab14738e_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3976
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:4628
        • C:\Users\Admin\AppData\Local\Temp\4174513672b530323e0fe4adab14738e_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\4174513672b530323e0fe4adab14738e_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1356
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:2984
            • C:\dir\install\install\server.exe
              C:\dir\install\install\server.exe
              5⤵
              • Executes dropped EXE
              PID:5080
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 528
                6⤵
                • Program crash
                PID:4168
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5080 -ip 5080
      1⤵
        PID:4972

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 1dd6c01ca03a1c787e0e0df8fc59182cb7036500fabfc23711c2bd5a4a1d62de
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 2795d241d70db4115844b8246b1abc55cb9c242938d3c49414ab698af6ed132f
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 451309f8b0bf7464bbc78ed55eab305ed91cefad2ea303fbe5c3f8446cce0a00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bdf40c3f73c0fa4c8fa677282d184f59eb4fd4686c37e3f3d55ab064853b30d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 137c8533611259e7cbe5d9cffaa6aea7e849f11e0e32fa0717c2c622bd3d6624
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cce71d002aecd64672845ffa7674319f116a3203331444194b9909632a27c24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddd13f65f986712827623e1f6e57890ff1d1994b744b4009afe4ea8535ecb537
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce33e53fe3dd8adc95352ff5a2d4c8dac282ae88cacb62aa81050502b36067b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65adc6c74b14c63004f483f53a951cf19794b3db6e9407e98a8c14422241908c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54947418f474ba7d21ad6f6bb3e3f6cacc789ba6d9bb3aa939dbc71a9722c58b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb39a62100ae539ad365c943acd0493f386d87562db6dfdac5b62889cb34ddbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a6f844b284edd3706578044c5ba7341c4a6c9e8378dae8f93cec0419ac631f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4d0934d5ef30baea2ea817d1c7879813f01b53c98060512923c0c6afc2769dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0372f1664e01707880d035f09ad80502d17a36f2dee3bc557ffc0411e17340b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ce4825fd16974ac3de9f8bfac11f77c0930ff25863b1b272ee496e4639e6c1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e36fc7e59ffea951535d167146f0f88669110393e39ec24147238844372336c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49637b1ea8bf2fd5638be8b10e0dccf5df6b3778ad629c42079b2e10f1e23289
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d039ade81cba3334fafdb47351458095ba33e83b38851fb5f1c79cb00d706d01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 066637aa4a9894ab043562cd6320074395277585cdb159bf613da35f97c8a6fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d63abf34cc634d50101ca4210a2d666faf6145dff1cfcf84c13dbbfd4cc63307
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db226a2744b79cad30f25c3d629fa8dd08074208b98ece7d6cf0c99590693df9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1830252451395e0dc6791fe03f2434d6f7568a7d1a6f6e2c2b9e91343317a8c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bca89483bc1bbb6843314886ba86f5bac62e671355e812fa515aff40273ef1c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 001de748094d840830c4b9c4bbc7e69e67244e255d76144a87c49dcb2747b240
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c67ef39222232d75a3d1435444d047c05585333354392db0db3ecbbfda633a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ac7a64f551a9db6819f71e7191600a33fa7dbbf611603fad0065cef81ed35b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5ed8aa87b2c59db2f6877139b47395b31e33ffecfc13a9103e673043d542dde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8211d7972a79ba243e9ab899342c1882212b50a4cf968a4b39cac6f2ee4a06d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 baeb0b375bfaed765674645d821b6c797970629e52951a087b8ae418bc60bf2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5be36874e61dc34a306fe1d8ac7a88f0891b8b1c13a2a9bca7714ef99b85141
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c631859efcd9c00bdafcc7ff7e7f8929ca90e5065a56c24254736014f3f12fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48447a74267574e66a286c84c90a8aa8b911d8f04488b8e66e4ef54989a54a87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 383345af99b77f15debeb4f92faa32fb246d24c38d53453e8cb4120f86b59b24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04df30b344bda3a8d62b865aa1dc0b7d2fed863635c225e55e667f8fad10953a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 254d19dd58c6340936e681b83fc5bd3d7f55c00ce4f9ca05d577cc2a99b1d17d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4153764f14c02fa2eaefe930bc2a758ff0e92984b42968ae76bf59b3d2066a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cd23e82d5809948b331794ab85fcdc1a14b2ffa69e04a4313b4d28dd573d218
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a91f790f4bc4cc4153b31097b1b704430c02bf5ba7b8fe6606acdcc0c5f5e3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f2bb144e42c1224a64782ff75a447456285cb8322a8f159982951d7b1b1b79e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe142163b1171081719e358329b344a89c7ebc209f098c752ad24da372d45b45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ddad5212c8647df90569053208bc5537bcced3bfecea899afa2fb9ba33579a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f9b9a8d007498367eeb44e1f27db71effe0ca353932be38182374c6af0441a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fb7183b4012562a15e18ec6631d28f91f4c809d3216868698116bffa57bfc55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64bc477b34c972dfff943717eed5e277dcb4da14c30ce3a146324b3296f14cd2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ec598abc94287f660bb770f2df93617daddc754251195071abaf6277df05004
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 733ae7a62abd7d9cc302d7fed75fb6d41d225da5a54faceb70e5bfa860ec45a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a6a7339df3571c69fee473631590e6bfde322dd16a8802726c7f157ad5b94ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e10699f4cd595256d748abf36a4d1143a78a0b3d1d583f52ff4c873cc47d51d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 034c07fddb417b21b0f9238dfb49a020c1dcf3c5a8f6b894742d6f48cab8e7a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27948b0d70722f1143f70e82b6af42d4e16d03d6950ffa4d4722d0a77a732596
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 250464c5f6097598a21763d6050459cf5552cc201c24d4e977a8776fa53d9428
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0854a0d73d41a525d65539b70d86460a98a25bc972d1b9a347201ee0c41876da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21ddf5a3fdb6d77c65e44dd3571dae926455193e580ad829fcc326b2ae8d7832
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3256ca59efc0f3c8fd6cc068828efb591924448ef1eadd31015c837b17607146
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61f50cfb48fe08a8e43207660e174adb13a25b1963e5337f5cb79b6629db9201
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30b27a88d91a7c340393f43f94a8c785d0447b89e295607757b9a883853e937b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ff8b6e2689e27197330ca56eb348e63a43755c1abea82736544a6d4fc01af9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 044f310e7d73bf4dc26965a58c1fdacbc53de4330a40646234875faa613f5eb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75e7abc1ef689f9c0e73bace53e907aca4cfad19a9ad36868fde621901b723e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8948666b9207029d0fbb7c0bbf01b6d54ff2f6a7fd9787a2f3c100a4ec162f88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d65e5a4ddce40254149f66dec741eb1b2def5bf76c64532a6fab290ddc42768a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5bce4b7d0dad040aaaca471e25ee913deca84da37993ffcd1f3ac8ccb9ed045
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 864d6ad40873e114201a1dfbcbb28303e8d1ec852bfb6d8bc0f659263b4ac9f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30bedcb9562e503a6c2862959ba3aba525e72b1ba196c50369ae6265e8352898
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7e01f75b0e6a3e36e8246747e5e28acd322422a8ae21af70e1f61c6211ea0dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1377bef5917ae7b9632545e33e6bf318fdb3d7c78d6bf10c634a69a776f4ee8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f7db87d2b69ad98a44510112a1b80e064002330eb5b4744e0982dd5d1c79447
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c6617e2c369f0b661883e14870728550d31b369fdd79717fc29d781909b9b84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a3df3471c2f287d585ed37280e95fc3a91ca9a77e7de5465bda5d657bc716a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2b9d0c19fe274131c9998197c5eb31d44b1308a72bc3d86774abf930cba92e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 592244de3ad5fee112d0ab237ccf354b83fa8c9a768bfc7c2ac838a126ee76c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d87de33a3710bb44c8f52e891a68890089e6dfe62f34aecc9e9e9d5caafa78c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f535b0e76e539ac0cd5ce28c22223eeee0a5b8e99198ad5d2d39f4fbf8ee43f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f31bc0b4841ce8dd011b221938eb58f8a8f8c29af473bd1049f06bdec8f2e36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2056d8fb83a7941b6caac98b4c50856011a8e86483775ec25e7eded4719b68a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc1b351ddc6ff1d3668a1c8edb749987040f35ca0e5def0ef7b1040f468452d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75bb27f09f71d1ba834fdbe7b8b0204837f6223aa54fe5340708f5ced94bea9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd48a682cd713808b24897d3f051fe6fb57a129202e7a8de5300829068ed479f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d38096b08e0a7f2b51a6c2ad08304a92bf57a3ee4f612035e613a40ccc37f9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae874aabb3c0f66334939e3b1ac55267e724a9081496fc71cb2e3f2fb2a63318
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e6be6c091ed6caf490964af0c6bfa2d16cb53e45537094b482d01b32e8d9715
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51ca873f094e8ac4cf81347424019413d2053d588e87f0a6f7de0a06fa7ad5e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21092a3bc8ff9859211b039f5092e6046b6536fe8b46c66d072bfc2f1ad21aca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04a39cb864a8ef207a66cbfde414296755eb8bec9279028b472d7f068b0b7041
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52be8d834c098b4334af3c5ba52a4a094bdacc6be88fe717231214cb84339774
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78c7c75b7f3b7a7c2dfc2c0409ac3f2bdb13a59f221b66f966e895bea1add517
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 642f2c9501e95a80613d37eb3e4ed012a065a5f3e18122d48ff46b7212d327b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3baff3b5a4f340912ce1c4c361a0aefdca0a4339119939301402f9f9a3629a1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f578dec08c0ac1c649a115ad376ded201f97461dc823efedad87c115bfb1950
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84a814fb07b16f4ff83a542caa685206478908d8edb3d8f6f844c6f17fdac131
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20d1e235e21fc31f6991b3c7ce03d59742e5f4d369e2305c80704814eb68f791
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 971e79c57c36f33bd7f261cae992d64b96a0f4858fe99fb34f14e6c7409d4ffd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22a963ae18b9b881ad2a2253f08acd91805d261a687838802e2e2a88f23093c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b03487bf5c821f1f57d8044ba812902983250a58772546e2c1cb43341f224d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fa501a1d64700819bbf4bfbc6c4308ab994720bd5a18121e0721e9e30242dab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c49744f3cd1bf964cf264037e6c5673602b06b742310c85e078a17b94db546c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91da15860209e746325fa413196d978d6fd65d3fc8b5e002872aa65245b0b180
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba69e399079fbf0c17a56c4f444b194515a9213ac0fd931645e9c693f761afed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f52ae25959245fe8b38c7c4c59517deb051ce5b92bc61b28ecd9d887de36140a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf0fb93b88d2b3586b41dba1c3e51bf86cba3e3e0e17b4d666bc20f805cc0988
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acca57356c81323492b646da201f45bbd8ce63aab65e6c64d79240c58a40fad1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47b98ef4286cdcb460de845a7c493d62c98163e4a6e94dbaf5ba950a950e9428
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f3c8c43626190143bc364fe1999cbfb607f8a78b7ae5a2e7e000e24ad581524
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcfd5a9323435db7996f4d74fa4e39ce69557cf37decbccec1bc2859d48f03ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9087c1206b1fdd516cf8ed9a418be03cbd1015062f8bc95fd0826cb02623e8af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e0f805473d7e152c3ce2a74ffb77464dd7e34b55c488da4cf5e0384a552e16f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ec6f8141a12bd54c872327e35b61e763573c8e6ba97be7e539d6ebb2926c52c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c386b2d721db46fe0ab8ea24ab35a2bf89f014a6768e07201dab5ac61ef7cd13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c04dee586698634c946ec130c7974d7b2d1986fe368369a1f7d0d13cac0aa5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24f11b1ad8ca7827cbd46e02a6173c8bee9f323337c8f40e58cf1865dd13eb41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7881f3a8263d11d1b4640b5edb392ad719239806da4455ece506e31f6fa24db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 430da50a35b404bab734eb697be14e62616b91b78bb8b444a6603dceafa6d2df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af8aa9cd2670efaf8bee9d0cdb70bfad0c8013edcec67d4954f23751accdd2d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d7c34cb71f8c77c09db5932dce71f67e010801d9d9fbc71a690532044974e1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7c6e6c8f193a67daa8f78317bb1bd858cffa7ecbeacce91b22ec477f00a809a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b340997223172c58d07dd9620c392d21bfe09c6fe4d975c6090097bb9342d42
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbc4974dad011ff5eae0cab65b007cd4d9ba4be87896aff102ccc69dd098867e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd587b926a05b12a3de86e487cd61d2622c4179c3b7232715724d5c84e1cedae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8122119c6e82dd2466d7faddb497f5e83b90102fbb9d808bb4d915fb71c3e574
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b8306ebb2b6dafbb1d5791f9a6d772998e0ef2b6d9ba1ac3fe3f7508f7e0194
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52d6d8187d879932ee6866fc7cba4cd40ae17f517e09d9fca42a24af4084f8e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2b0d582af28206558093ef4b844d22aa110a61ad9f47bfa6899d78ac7014d0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7932bd1b4ae8c1172209900b0805159985d298d1506c9ecbe6eb826e18cff53d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f865ca2bc2b63d6f0fa23850301814521ebfbee8cd220234b2f56720927cfdec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ba173f0e903cd83274ffd04ab0ce213c34deeb2a0f202f60287eb4121e4aaf7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ba961fc49b1050cadd9dd33e11b6840c191f5ab4b9890153f90f4d2aa8c55c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fb339ca1cfc8b0f3358bb065479360149b1850a3564150ba0c846a976482c03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a00ee9b88ef2ef4877a38a49b25316b32d9d354f64ebeddddb3d98ec6696724
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f99ee4a5c5359184a130971ff34d3f84618d35853fb4183ef09eca7d7f1367b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c52abea703ef00bdbe3977e9315a97bd6097be5289fdc58b8f27d8bcda10e6e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89343b5570b3316c55fede11371196c6a99cb5f253779878e9de4bd15aa4e53d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42f8bfb308100354dfa6dc7fcb1a096121791f0ea6470efcd869af1c67aa88ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29e8a12facc6a884d1f10b4854003fffb982f656d78a8f87d5d6a3e3b037e137
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b24574b56a05d5d7358dc96a887b81a6a1cecffd74430edfce377cb921d4628
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b08a440f35a13a01c37a439a7b336ba757719493b9fa451d573f344b9bcaf5d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e99068444702f9020fafab8dcf35e692fed2ffafe9f0c0da055ce1e41992343
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e264c9edb900b2ff69972520b91ffa96355f7236dad3ef40988e819d525c18d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d7127ddcfde444408039d22382ae3a126ae3736264c060ae92cd773f29147dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67fc896431a08d67822e081d3fdf281276b28c5b99dd23023c648f0910f3959b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1bc21971dfd1324997ba82df1fae1c87fb5f2b3a00ca8abf9cad5208614c06b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1c982d1f76f9e4be17074b1c0af921e45f2f6595a8529246e3a6aac6ffa6552
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 274KB
            • SHA256 c719af6203d1a2888ab0fabeb15086edb8dc4abac047dcf0c0cecd6c55d99409
            • MD5 SHA1 SHA512 SSDEEP

            memory/1356-22-0x00000000005D0000-0x00000000005D1000-memory.dmp

            memory/1356-1230-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1356-85-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1356-37-0x0000000000400000-0x000000000046B000-memory.dmp

            memory/1356-21-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/2984-123-0x0000000000400000-0x000000000046B000-memory.dmp

            memory/2984-109-0x0000000000400000-0x000000000046B000-memory.dmp

            memory/3368-12-0x0000000000400000-0x000000000046B000-memory.dmp

            memory/3368-0-0x0000000000400000-0x000000000046B000-memory.dmp

            memory/3976-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3976-1-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3976-17-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3976-4-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3976-6-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3976-20-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3976-13-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3976-7-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3976-10-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3976-8-0x0000000000400000-0x000000000044E000-memory.dmp