Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2024, 04:39

General

  • Target
    4457dbb9ad625e436941d78251b09b8c_JaffaCakes118.exe
  • Size 398KB
  • Sample240714-e98z4szale
  • SHA256 a1d2c8b0025f8b06d2eed6001957246edb28801c9b51fafab8d1fe8b02a3156a
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • g00.no-ip.biz:515

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4457dbb9ad625e436941d78251b09b8c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4457dbb9ad625e436941d78251b09b8c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4048
    • C:\Users\Admin\AppData\Local\Temp\4457dbb9ad625e436941d78251b09b8c_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\4457dbb9ad625e436941d78251b09b8c_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:3376
        • C:\Users\Admin\AppData\Local\Temp\4457dbb9ad625e436941d78251b09b8c_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\4457dbb9ad625e436941d78251b09b8c_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2772
          • C:\Windows\SysWOW64\install\server.exe
            "C:\Windows\system32\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:3268
            • C:\Windows\SysWOW64\install\server.exe
              C:\Windows\SysWOW64\install\server.exe
              5⤵
              • Executes dropped EXE
              PID:3192
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 564
                6⤵
                • Program crash
                PID:3584
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3192 -ip 3192
      1⤵
        PID:4456

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 7a428953492bf66d3e1bfd3ba8f31d75143e0016bf823d02b3ac88f41a60ef26
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 ef61f6f5360fccefa7e8a390e83057bd88830e8beca8a4bed3c3ba45ae187f9a
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37816b0b8b01fe65cc722040a6b76cd39a0ae152f7a87c04bb36c9512553c584
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 944511074a4e765bb09171a62c3cd95b049108d1b7d51a8d886f1ac261769a6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ca9d1d3bc7ba96cf765917bc6aa75a2e47e76c93d0dd0cc0121115afba40507
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b206140bf2f0c40f38698e02c52fbc36f3777bf8347c4eef881179fb43a4f3ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c5d17c34a5d6a7ee32d8ee8495eac1d68c6f9fd344faf32ba1848b571b8fb7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40a69e1d5d92dd78c2008add22fe77c2718773d6640e53552202fa879e572252
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ff60fe74e11996544e5c3180128ccae572b668c656e6b92e5a23b31f44bc2a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb4bb9e5b9467866ef6265a9c3962c496ad065eecc00c69f37c7ddc2725999dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 493b199314a6499341085f0f60e2c0ea228ce5b6dbd1bc1ff7730ab274182933
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da069b76a274d777c30c11292368a9878d6d237c2fa986e156e84749a1c00efd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49cc5e21dcae98790a141f24eac57f7099c4eb655e0bef76ac54b44006443784
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e897600c8a64ec1939eebede6b6a94fdc91350183927a844c66413653c5e4c7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46c74d73ecc0cfb923be8235dc2fb3740bbc01eebdc640cce4cb58c417957308
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 628a2d07a39e3fd28d8a171d0bd36bbad0e56af42e335fe1290098d61db74ef1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02569c35964d1fe5730096aa8fea42ec11f5ce19c932e6711bbcfabffec3d2b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae188704bb02bb9d1b673cd30177b7d77bf053a93974da4e4133029ebfc3b0e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca10ea33ffab64278a17320e5d7ab308e093da6aa4028e09fe2b14d2ec1f9604
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ff5031c44782b275682550332750ecfe32fda29f3667c6950e96731cd8f64d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e168aef9c60bb476f1e57eea2baf589b355f8bb302fe514cab749689daf77ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7f4c5f4416968ed9742689cf1fb362be8d50076c26a761a174579a838b49aaf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65c0744e238c78acf15a0effca00cd6c0a0d5608e3ffe3e162328677e1a627e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4ac910fdc46d8230a8390cc7d5c10a6d516ae1c319e6d182b125252fb9e6ed3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84899977773852b794d8566c2fa79580bd64ad027d1b940c625a1ce1a06f1b95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0b768b36e67f5ca70f9e709dae0f61570fe5b8f80d6663b019bb1e623e4e622
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4644de0b707fbf359fc3ff48fe3527b6aebc18d31107cae23a4a4eb5ecf6ac9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 052546198c5e98c20f09f0ac498a62ee2142d5600bce74b228e88f350465c87b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8aab26fc3dc93e82190878f5b1f1084c8ab7cff3c45a772c1d13a35b5658e36e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af64f4a3e053492d592c2ddf861e0f9bf882b280a5f7507c27bec1c7667d41d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 705a09bb1a0f697b117ec93f4a2cdd6344df443acad2efbf3cac1857c5fb29c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40facfce67e0dae31ec6d832d03ad61629593620c6a8b4fed738409cb9ee0672
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e79578a0fe0584e9855f75fad21e0f5b34f368f8bcdfc9d849b44dc8aa01b5a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42fe420839d40d216234c6fcd0b8745e575918b2f72f40d661cf536a5dfc1362
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 363ee0e077cdf819bd86d9d2ecbb404eabbd15e836c5965415db271a1c3b06b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 877791e5ee09fbb0ea3a028371c19d91282c3d1d9d8e670a9b9c530a97a0bd96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a804b3bf12669af260d933363d438bfe3c369553c4686e5efcd5b37dfc619d81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bd525eaa8c69b7dc5622dd2de25646c98fe9613ddbd3e5655efa4ac798b4fa4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aaec1461bd841db56f990836487acf032483d76c98704e43c9461395bcdcef65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed08c0a755738f6464db2a65e97cb12d686805f87cad908e12950e2c9ad2c7f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7873d14ea837ca82d29cd36e40e35c01956465977d9715d4a9b60de66971912
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 991718efbfb2ec0fc339009c451207e6cd0be00b8e3aba5d926958d649852ca4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 933ba3a32cbd84672c61b74994b0260e22452b2a42bcff070923d7063e845984
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f7d459332ac730c6ddfd7a4622b30932d932988537b078e93d8d02b321bda47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13b31f12f9a5b52399fd779cec2a38ca3cea832657003d8da3e79247e0647925
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c5d2ea38dcf626fc9c64f689a0170772082d626f359dfd1091a65d28fcbb587
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03899221fbafb6fbb4c96927972ef180cd7f45297668eb6c0e34218e1089c669
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3e7c7c82b7461a329322e62a0c30bc3005c4996b2815eccfe4d8227f1130d5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e22ea3c86f2f8c84f39a495c6a47005cac75415cb01b44d21907bf4e31dff622
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d530c6d103bc13e9a406386fa16f2e78c1e8f40be92ac4a0370058b7cf4a91bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6af4c472ea774c2d56c339bf9b2196edf24c1fa5a931a463becd520c7af75f85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9ce969f0051994682dfec20f6f06222a05beb9f9e00853dbc7c120c326a5856
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d0aad9761ccac03e8ad23e4bbdfd4fba3f879250d0d519afa5e031256baec4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72344350609e63b5986d4719ed2af585dfc62c2fb095557e13eb88992cd53aa8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c07f29a3241d18812682e4ae7b1ddfb23151c7a4e5c20127e41231ad3c27ee7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99193b8bd10a4681e5d44d3c80662bbd2861b698c52ff02fd4d1b65152f506ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae743a89bc12788b6fa956551587768cc05ad4ef679a14fd92a279bb6a2ac970
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85a0355d1460bd934179c2d29f3c3d1096fe1fc6f12ab1b58194d5b46f0f618c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b86e7327951e3e2412b6fe668d1113a12abd930f5eed8f8fec2d0bf4db88e230
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45b578a81a84da2bedeb5540d213be52820bc4ded3d9c901c6f7a5f5b56687c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6180a25fe02652883a5a76ba37b565213116abb31e5e5784592ecb8cccff9a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea51c6790a78193b2f9bd87d529e530c0750e5b075387c43ce7aa94b4aebd28b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dde1a9273b077670cd3a48dd98c6e868c56b9293c5921b948a7fcc0420519130
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7ff7d33e4fd02db823124b8a6b0a7a44b99d6acddde3f45597ef60f344575fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3f925ee6e32700df69d7c0ab58642b100b973d2c6761ac6e8683152b80992b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9048480b9098af3589eeae40feaddcba7edcde8b5474d9f3bd0532d339a3f20b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0aa5f3bbc44bcec248b00a73b2ffc00e89ddd6b9579e8925b6a82212979f0169
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dac18a60bed7f7fb3c88269dfe9c1501c42aa4f73c3692155017244c47983094
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 221959496ccd366dcc6faeb77e4d047ef9ba662ba10b7dcabdb7cd2014fff539
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c34ffc5d93a2ca9e21dbbbbc3421d024c8429b4404ac9c2b8231376bebb43c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a48c447d218099dd23792dafb5f7640ac198b009cb285517d04ec6a12104e2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37be833796816028d140433fa9cb36dd234b5d5cf6bebcec28c7ac6c0239872d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cebb00bc00a82e2cffc29d8a032613441b9608937637d4ed169efef160ca70e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d9aa78ce0dd264f74b8ce9376bbd2b38679ddcd0214668da361c5f766330f43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fda1e26fd3703b4ec5e671013e9cd086d221274f7a7bb5946ce32ab0f7ef47e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 189e5bfe22cb3cf3ea01a7726e17aed83336ea20031bcf502115277bf9a29a20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00753f1ce420902d2fcb3b139c10d348a113c6361a0538ccfb23c95ca4a05e3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef10665f0e60e2fc131bb7d7b66461e93f6585432d19b529dcafb567881581bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd3c0017511e8330c7360b325ca304f1ac8c71b0ba9d8e0882f200316bc66d6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5852807e23eeecad5d4ed5ea28fc726290d8b72466ab5a6a78950b490eeeae6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f01eccc363752804829819a44455e11b30d349813880b62744aa7e614a0868c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbfc0d194f8926a05332a057e4b04749e955ff5163fc4ce6b74f4211cb7d879d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 509c69a6b5e0664e1ba6c8c64528c8d7eb9cb8f4a68b890f434c3356b6d0e122
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0dc4a5bd69849090122f7c535e8b4eea4cbcfab01ac1b2d3aa8a14815d369fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e78cbac1a5918672b4e624e8ec2b44dfcee0244aaa1844b7eaaa741d00cc09e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d744f3b1428c26bb065dbc12b7c9481b056a4383ae7e759fa9c9053c7cb49cdc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c12995d6ebc0392ac04153f40c66c95d794544af1bcfb30de8180ee9e672e567
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b77b5cd249d1967c0f5e401759b412bfff485245d7a7cc62a97b3e30e8429bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b93f5555300cb98c215edbcd1401e4131ba5de3b96e417b811318915b5af8b89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6d4c05ef5389c3d4d2961509609fd40312ba80fbc29d2e2fcc145e437d36caa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2187835e8f6d1df0e71f1f2bc357892affa76b83c9eb421ebbff51102796550
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b825312e8fe4c286cfe04be8c62f56d16b3ececbde8efcba7c0ded9b4c298226
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e93de668e5fb3053b851f161353cd76107b15b1811edf04aa6a31cc274b15d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5df92246a9091e04654e43f648a51000fb91d81d297cf3b063a6ecf287b6af4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30492fa4d94919fb1b01ea92fda910738e21aa48312297d05ed0ac553c9b0214
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a40ece9f730c69c994520fd5dc0cdd74e27ca436c3fc80f25ce1f84b9187c423
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25f42d545a49802f9dba8b86e71e0ccbc13bec270f71475f3c68b9653b0f883b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bcdd2fba6b25cad4944a589bdacaecaca84469ececd0b69e2a9de1f44956c6eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2572b69f38d15cc73e4a25c94a07dd01eb08097842779ac62e743c04ee40d2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36a4f2e4e0fb5b7a205ddeac965c1c04890bcdf8cbc09ea766d79f7afa6c4006
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bf2726c3ce4248ef38db5796626b3b20709c0a926f362db7c281fe287f7887a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be67fbc943f5e0bab96e1945b42066f42c537642035cc8178c97a7719c5fc7fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0787cd10e0e922f5b220ec3596ae0bc0f098994f4295a576aca573148cd0e12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7d27223e106264298107374fd45d832d8b207ebb80e47d660fa7a81ef07bb63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ef826db63a23f012b11e0930f25ace2a54e8f0739045060279aa9e40dc7b783
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2298edfa468227545162c8db98b19fa0c0c4e29501d18c24a98f451549f56000
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c5c94bbcc18791c3de1c22f0c36e4541ad3d506711ced76dd38ac781a2b2c70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec6b169fef47b502f10d0c8931dbe4c4d497e1982010f48e4fefd455afcca353
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ddd692bdb1e92061a16cb66a3c895abaa0710176883b18ae3637260cfa493b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10bd68eb9122890e5d22a372f2cde40709157286fc929060a4a4d49c393d40f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 459f5291a55fedbe963d69c8d8f89d1d8f78828f78f60f5de148732e475c37e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1fc98622345f5b246e08600c99e6029551025d0dc9c502379dd017c504187fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c87fad8715ab5e169d7dce3a0c82efbfb2e18aad0d71a910236240f780fd6ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3da63a44dad9cf820da931eb7a115a91e92ca397ae79c12af735ba7ecab9278
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce31875883ea352933114e7714253b34194b3748b596e5255cd3bca7335737f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91eb933b85b27d7b6912768eee79131c7fc36aa536ee9c3016e0620eebafded6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf5fc06c4094298bb7e554909ffe051e9c5a0f530715767bc723d02f7d510307
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2dd332b559b077d589e29399ae332e2fcd6980cdc7401d89478aba25569c6c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5dc658d80322b1edc80addc3ed3161db03997ed555713135f0d879eb61a03d81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff76820957ba4f231ffa8512fdc4113633d5adace3aee1f40acddbb943c087d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98fe3deaebba3ce157d6f6d879964819d8c624e79b138540ecead032179e154a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 820e8bad8f04c754488ed9a10c283959744ebb14e144606295b765ed025c3f55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 552a7554ec72388135f6793bb2002b53920e4702a3186652f698f7aee488d550
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 686d9d44d81901c161ac4ea55b6c49660692d3e307a30ffa349f11980226e5bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44c8af7ea6f2fbb0db2d41a9bbcc3e05879d0acab9e47dc2d36dd25b7981b909
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 acbec13bd312eaeb0b76d6cd7a7f0c86bdf8427aa387e4606533e9063c341792
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90137f66f70f8112524b12d75f08fbaa8e9864bb043eed619e22e62d909348ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3426fbeb9872941cbcba29b709ea44e1b39060dbe6a79dc8d0b352c48666a39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00c31b9d0dd5bbee6c53580efce4cd788db628ef65d0287262a24ccb494923d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4cef3ec31f64033ede3c386c22ef31ec9e839560fec2fbf7d7f15f4ed2967ca0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 563ae1a5e4a84247aea5477aadef8843fcc257c9ac47d4f746aea81ffdc6bd8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8a5127329020d9dfda5a93255137f203383ec81327b1cc2158b3e1c698be39e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 038f41dac402263c6b59ee5e8e09d8f689fe897659893bc70e85613590654538
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10e069147c568b96bdd76043e34bb2ab6c78a87b43ed720ae2e95b58ba4bd42c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 297381b5fcda371eb503ca4608fbb2398ed34761e45ecf0b3195bb009c03ce77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60fb1dbfbee24cad49823c60edfe1da1c969f1de10a064d4e877c12ede52f00f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d59a22c6b08c1e88ccbca1ff3c0d27ed45d30ede4e24a799dfb878bc8b6b0006
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32a7ef47aa81586de69977cfafe3122aac2e53339b50f60529549a8b55c26661
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5615d9b65fb48faf78192107d04431d165e8a5757d2b16d5f29583003bd912fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27446d8a9068471c421b5fd2be7a4dadcca60712d89686bab309e80730d4da7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 346228d9ec8520e37bede0f1f1dedc68d1e350140f8ffd4deef737a9f77eb6df
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 398KB
            • SHA256 a1d2c8b0025f8b06d2eed6001957246edb28801c9b51fafab8d1fe8b02a3156a
            • MD5 SHA1 SHA512 SSDEEP

            memory/2664-14-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2664-3-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2664-9-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2664-18-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2664-6-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2664-11-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2664-5-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2664-0-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2664-7-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2664-1-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2664-15-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2772-1410-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2772-20-0x00000000005D0000-0x00000000005D1000-memory.dmp

            memory/2772-19-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/2772-81-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4048-10-0x0000000000400000-0x000000000046B000-memory.dmp