Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 12:51

General

  • Target
    49dbceb03715f4f1628179717abcca98_JaffaCakes118.exe
  • Size 1.0MB
  • Sample240715-p3spnasblj
  • SHA256 6a5bd7b4e40ab878083b976f32760317cf66e63f4752ed84d8e54a522d216201
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • iluzyonist.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    OCX ERROR

  • message_box_title

    setting error

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49dbceb03715f4f1628179717abcca98_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\49dbceb03715f4f1628179717abcca98_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Users\Admin\AppData\Local\Temp\49dbceb03715f4f1628179717abcca98_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\49dbceb03715f4f1628179717abcca98_JaffaCakes118.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3524
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:2748
        • C:\Users\Admin\AppData\Local\Temp\49dbceb03715f4f1628179717abcca98_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\49dbceb03715f4f1628179717abcca98_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:5040
          • C:\Windows\install\server.exe
            "C:\Windows\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Drops file in Windows directory
            • Suspicious use of SetWindowsHookEx
            PID:3560
            • C:\Windows\install\server.exe
              "C:\Windows\install\server.exe"
              5⤵
              • Executes dropped EXE
              PID:448
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 532
                6⤵
                • Program crash
                PID:1580
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 448 -ip 448
      1⤵
        PID:1588

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 d6f7e33f562520dcba90b5a3f98b93c8d5486f796d1472f9ad983df7a7b7b901
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 00d6441602db46cb348df75783585f7f94a37e2a4174e0e3a95fa2df2493497e
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb1e0bbd5f4b3e31d8361b4bbe04822134b1a37ef2f97553649a634fce80a111
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d562cc9b2a38d3c84c9c2154118e09102eb47aaeafc88545d6fe5970c5da41f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc8d506918acfd2a3e70099c6cf75d7f866452955f9df3daff22b8bf824d0144
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 617437f14028a6a8b46b0cd8f8e1a4fe175e50e984ece3c1a1a7cb1b85fa8056
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5774a80262529c93250c64748fe1ccbee3acd80a127c840e60fe736abcbc4969
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f82bf34499b2fa2794e15d258372c39c5652d35c62848c30e327babd32fe2d5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6731617a483b639d41ff2009d728d507f1a04cc6dfb95b081ac79cd34cbabd9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d96b8994deae3004bab1e574aecf7c8f5a98da3ebb5881a01cbf30e9bb0ac71d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0ced7d60a65b82a600acb383ed7122cd027d0af95909e8d5f5f3696a9d5a6de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a17f292c30c597d9c2ee018fb8298be4e37097d6fac64004cf0aba777251025
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 562b9125af92553c9a36398a30bfeab9ca28c84ff341174890ae3219143adf4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35956be812d57fc6581e5aefeb7f4669ad050dbaa9d14e7cd4d51e5b2ef7359f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dcfdcf3b32acf2bad9c799c86dd255ba139075cf670d099d24e003da5d12ac84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 baeabcb9f56999ce3633fb984efdc1ca0d269d6c0854c843d38aa5424e51396d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46059e122c05601815ddce38b8519634db066e590e827820ae6a30074c1e1449
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c60353141a2ebb31c9f5f335058c620e34fa5d8e49241abb554544576879d3ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e49987710987a2d1f46fd3cbd06b4c90f0d394b9626a6163e8c5403a18c3764
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01b3ef544d70ad35ec51682a8a7749d02b7b3c833da8aeebc8842f06e9d7e4d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb30a6bdec00c933e1c2bf84df2585b0ccfd4b9f289ea9f49fd6606fca4dec74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d6e3dcdfc6c314256876522272daf1a09a68a278e0c38cbcc52f10f66ef7876
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b955d702649ba97b83c06e2c2425d7f0089b1d5704e765b52fb0b6036a6e257
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8959ac8f8394e6c4e6662086f58d247fbaab9b4b2c76f81ac21f3ee6a0b73cd6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d48662f8035e34ccc0efb39cdc43a94640fdced36a22e2cb4ca78554b305c10d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd67b9e93a8647b524eee1c91531464561d24eb943116031d1a90a743da370d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2e91175cd345d8b3919bab9f0c1cd931522046961e9f429c11dc4765795cabe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a60aa6027ace1e614c3e9d9bb963788a382d18a6608c96d3b70b05cb5e49979
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 678a42958a8a9542d24e351256c2d9d3fe666e65b9436c3d617c460e33473e64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0ca822af7d01fc80857517ea3c64b048abd5c4352f52bf558e3fb01f6634402
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9585c6ee9273818eb2876d9de2894f02d13a83479596f13e37159d652bc62a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f85dbd3964b2c6d09581fb8992cd563d9d34b5140851a93fb2a439fc04c016d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afd0e942d6c236fd2d9666bfc020e6bc1c8c2caba7f8c824d1e1a4fdce212142
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1ee8fbcc6f6ed817a0229cb0759c8a2305ad0c81abe43fcc283ff448d7dc88f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e44071c2c4544a7a25e0136b4b4f157f445633fb7c9741adcc758b55c0a25cb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bccbfc6d64ae8071a01300b7ebde21c82169bb94631b4f3ab15c0ded3e7ebdb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36f6f948edd5967d11acaadfa0043fe76ba9356c3afadf0fe17f4dfd960305ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0c857d336432e272eff1a6296835d8de72aca4ec9449f998f8aefcea8c0aeac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fdb9d3f72ea372bd7da4496863c438a2dd689bf06c82d84b2e7543ad7f2588f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 554e92a9c63b29e42ef03a68d54bd817b2d57a017bc8afae2c0ee5174ca8eb4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f68d509d4348927211cbd51fad48ea3551228abc1053cac3834a0acbf9dbbf3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b8ef377ca184cd679ac9943381ae4895d2e751e1bcbb47b834c724e2dca6c61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c004d7e55ba92fea270ef799c21c147a146a21ca2480c2d92c01654c8636ffb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42be6e809895aed8eb07997ce7e41bece80be3ee145cf4a475915c60512373fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b62077dcd12a1a5bf85479a3aa6bc0044be493eb7cdd1c760799d77a9dbb13b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66611f529d16ac6b05927900267991840c808f46972e869710214f8c03cfc639
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95f54be4508562171a54700ab16fb1fa612d8423f5831547c7d624d289c0de4e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65ded70060a3c92674a963d724715177782a6906577445226eb0804fa267d473
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e1b99ec58158800fd9a885332f849532a24dba62dbb311188a83f1b6c190711
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6dabd0d60792934f659d5949b96fdb84fb98598f3ec13eeb98310d11bd5a6eaa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e9a7feeef9cc6bf5c7ea89567e73cdd069f468441a7cba9b482b25d483c3dd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e02c3638712ace90fbd283dda73002784d64ac71dd671165f458cf3f70c9c291
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 336abbc3b0f628b724d6c35c5dc8c3944aecf203787fffcb072cfcd76a4d4df9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94c91c842c005861b91c3ca2b2454eeb643abf5a4781393639d64bcf008d07d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99210c56e3a65ac5f4f7b5d3e5c8c2bdc1bb647780885d61071149ee9fe80804
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da769ad23486595018acf666ced08655074f0ac7aeea87081f21a707788f90f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5190539de74e372ba49d3b6b99ba5e8ba055037153b6dc286f94a24292e4593f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bff8eafa256869cbab02631d9aeaf16f1ce42b9109be8c7757016a45c0becabb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f054841b8ffa70fd3a178237aa139eb4dd8143923c82d7b57e878c4a17189e86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dae943c541c3430cd299b5a4c3df62ca0562c8b05626a26aa82d7655590a8933
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a0fa3df41e6a21fe473841beecd1df331bc7984ac942b27949b01f5bce7a8ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d5a13548b14e5b3b3e189d8873f00142ab195d3213e151604470432cc581c7b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32e972489cd360753a1a3b4d57229038a53f0612b09dc5f85fe6de0b4c387c56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99c2e36dfe84270cc483179ddbc33a33a386381f9893373d0995a79c96cfc495
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da70d1f6253351691d788fcb8389ec0c051001cea5b161ee214db7e53c3600a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8204e7128fc8b63f6ea674c4b7e13d4f3bfbe434a4f4a53a7682b0527a7815c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19329bb4b35fbd174aeee8e6b0ec4307db07dde3e0f50d713c179db5c4b34506
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28a21bbe02484112306a94cc27bd58509267bed8c1116fad6c8a89f73a6ee445
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2ba7631d415b2083e4434a35952bd2787cfb517d710e78d9275a18c1dbc7aae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 52cfa323c6746b9b1b9476bdd8d96330931c6985082cdf6db3b506fa2799cd03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d82380b89c0f14fa0b4da8cb0f0e2aa97a3c38131edf110fc9d0e8fa8cb6a71f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80ee1c6b3cde09044cb89ebf6a8a80ddac1d36d935e62bc05452ebcad9057b5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85a3c1f7c4d445be035d02682b5c7045f7acf6b04b0489842a8fd73ad592086b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42cccccffa3b40105594aa0966e88ba7805105f1ead2aa30b76118480617f3dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dffaa795fc05c84b417ccb2f9b2a26b46ea812d1523ed791575951f5807bf72d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c1b7126fbc04b3003ed138ab7fb672a4259b4eaa279383894d5d2fc2634cfe0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bdda57f1ba77f72336fbf48b721d2481cafd790305762e4e1b7b8c1af1277f1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0563a151845016f4cc3f0cc3b14237ab77b0f29464de97d56eae7ba4e25ae11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb7bd5d2975c5838a391665dab72e51c0a528aafbc194c2c390fff56d2295f39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45cdde2390f855b609a7ed6e53c2f0820d3169382c18dc914f8030414d4b24e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e080b49f872de0aa22f900e40e41e540b0043c2a2a5fa5b4fc7f1e8017cb0112
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 861fd55d2ee73109eb80017787249c9e4e054e6a32e3b8f7ce1f06d0fe50798a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 772ea1ec73b985f4eb84f475a3f208f8e855f0d8622ebd729ebce965ad06841e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b82c3b84d62be6c9a0f28fa7e6586d590c4dcba3734ebcd3664ab3a3e475ae5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34f49ebb54d6c104d977037c41b62b3f4c45aef5021693ddf8e2de9e457711c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06ce87b027d4023b7aa587f8cadbebad25de959ffa1ada80c25c2a8fe2e57aa8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24b21a9e595bb1f1aebaff5e31f2315efb1f280b3a4c25d5dc1045ad2a246bd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c63efbe14312390e507aee8655346aade01ee0e082616f50b41e2eca26491dbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c746e49268e3810f709dae24d8b36cc99c2f8231d4efc3cc404c542e98d51f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adf42f7d5523a87fe942f2da60171e0eeb2682d43aecca5e7d7308f9931d7caf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 610ad1cb3bb8ed7664120277d9bc2cb4364f08394dc87fb539358dc8f465a912
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a66c5b6097d968b6b50f9874bee01fa374f5407bdfb457848d20a3e7f66efed6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4156631a16dfafb048d75c8e0de8a12fa3a080b57044888058515d3634d468f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d662c188348381af8564e2bab932b944678f70354f56273ae802f9bbfa13a1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 594abecf98fe9e35d75032a7103cf832eafa6d3b79448a129f5f15b1211a8dce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f99a051c59fc7fa44e28e91538158feea6d84478774c554265179b9f14e4ca98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb848b488ea276d1953805874a1b162c02b04ab770dd3bdff1f3f8641e362dc9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 481b4915eb017453c414ec555566e30095e159040b6265742d05f30931c92255
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19608b35ba7cfabd6363dc3cf55bf57836ec1eaf1149217ea4236e5d6442d1e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 efae0e85d58ce4862bcb8d7ce9a3b6b1f6b7a01ff055150bee35c9bf774e710a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c065f2da235cbe5c3da61db8adbd64184da0d8c159b16d08d4c5ea2f0be2223e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf5991a7513d5e2edf70903d4c406b00b60a83601894aaac867e0ad072182b84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 207b2421aafa78de5edc416c2442639a597b66b7875083c99f841e8ecc6eec82
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4532c47fe9c3e8f98f911cd9da3554c8cf42c9a1ef38e6c2441de6c42e112f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f11c8201e7a1c0b6e115326403d6d81ab446984b9fe25b9375c5c56a7fabfcfd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31c2555208a13284506610c6c229e5bb0a4766d7a59727186431c711059f8a2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d03faff9b3d8f04e5bc5b94096a9a8d9062c8b2592f7c442ec1fe61b550b84f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b834ca75b8e791c7678877e4f79fe561d9570438be727ae91fe680094e880133
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3500b6222996a9ff70c63626fb34b20f9ae3a9c7f17da64ad17e6157261df9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a3b1042790e31dbea027b5802f6558c79c88296e6a6880b0c2ddb01ff35b30c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 646a1121a9a66c8bd771dfd30d5a8ec8036d59d793eb3ea6092491289fe29f95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d9ed74d133407955b17890064a7c31c20675cdb31e07b0246e8b13d6ad0eff8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d71630de92036c87378bf22b4ac89ba6d6fd15f3d129e46fc33365ce9e76c54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e04307c246287287be59d0d17ed2320b0223f8333e8cd3653882a4446ec07f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c9f78468f46acb2a8c58036480e1d4a8a6292119b7b644a077b90429979a2c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1778f4dc8a9ac145008f81b1ca3e056e24ac1d981209e3eab2197bb87706c341
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d3184d7a368cc8dd00f807060c7c67a49a6ee33bfac8c80158e821a5da013ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e222be2f2532632d50d8981cad3b9409cad38da353827f06f24b68ff7b1de45c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96091b3bef19461dfcf5ea6e1fe8535e9dbfbbd6c3eb294c7a348040b120a79a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 530705d46b8ddbf379aa925797ec02e7494440fc2ba216dcde42a166d49cb56f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4eea38bb96473f84676ab2df8b4b1d54e43c435e7904d832fd653b592c721cf7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31daa63dd94a7a23e5d7aea502125811c33841d58d54fd99f81c13e058a81098
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 694aac6605a6cd6c668a71d82965d8d9714339b5ca42e3cc35e54867af8cc2d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c82e1fd14fa4f5635b52f353501a10fecedbc675990e5a850e7f9a283630d65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5ccbbae695bf06ba0ddd5bb0c41e88a606afe5abdb54652fdc489c54b7e5fae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1e87227c9aa439db9615b1045ea691c24d4fcc37a7d0ee237b0003698231139
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c361397000c0541bb7d459c7472c0474f326072ed23d2d25cf7d68483eb19f5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c070f91f983afd0277e78f2a8356143b8788f12fa653988884815ec89238d0d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c309f5804480657cf37c01feacde14c81837322adf2781e3c70fb8fa236ba9fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 810e9fee7ac5dbd59c65583f9d2073b169b17bf45ab43f7c7410710c21c15d80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 639261bbc094ff7add9ad21fe586e8ec25b1cc7f0c402d3c3394f76eba759794
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2230c7cd6a54edd49c9b3beea6e5f9f9b951ef47d01b982ced67b1b2365e5527
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 587e4ce82dd77b4954882a555c887b445c6d648b9698274c821377208e4a7f00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13c84cf175cbba3535d0ea2c987a06cf9dcd99f254e115b18f9c02385b4a8c64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 457b421e4b9e4c0c10da7279d2ffbb70ee9e4d616357722b89ed7080863b54e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9359c5fe4609024e784e3bfbc7c7b545e448a9f2998a2e5cfe49b3e73631286
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7689c8a5bc6d8b3beba8a2bf157bdd56d360fb7b5795e3662d0eeec52ab8a64c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f8b04c4f05068bf55212c9ef71577982fa01e84b70fe807e754f779ded0007f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a8c9ab655da39bf9a2f6e719742cd7b0c3531c871a3bdb55c26debfbd763379
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71953b2823359218b0f34fa77a1a7e9330cf46061bc215a31c5786559ad36d48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 120aa16e1db00a6b437e1ba96a7b840c01aaf07ee78deab9fc8c3b96607c667b
            • MD5 SHA1 SHA512

            88603cb2913a7df3fbd16b5f958e6447_9370e86d-1eb3-453f-8ea4-ee21ada11d8d

            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-701583114-2636601053-947405450-1000\88603cb2913a7df3fbd16b5f958e6447_9370e86d-1eb3-453f-8ea4-ee21ada11d8d
            • Size 51B
            • SHA256 374e0e2897a7a82e0e44794cad89df0f3cdd7703886239c1fe06d625efd48092
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            mFc71.dll

            • Path C:\Windows\SysWOW64\mFc71.dll
            • Size 1.0MB
            • SHA256 4da5efdc46d126b45daeee8bc69c0ba2aa243589046b7dfd12a7e21b9bee6a32
            • MD5 SHA1 SHA512 SSDEEP

            server.exe

            • Path C:\Windows\install\server.exe
            • Size 1.0MB
            • SHA256 6a5bd7b4e40ab878083b976f32760317cf66e63f4752ed84d8e54a522d216201
            • MD5 SHA1 SHA512 SSDEEP

            memory/448-119-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/448-117-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2724-11-0x0000000000400000-0x00000000004D4000-memory.dmp

            memory/2724-0-0x0000000000400000-0x00000000004D4000-memory.dmp

            memory/3524-8-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3524-83-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3524-15-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3524-18-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3524-6-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3524-9-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3524-14-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3524-10-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3560-120-0x0000000000400000-0x00000000004D4000-memory.dmp

            memory/3560-109-0x0000000000400000-0x00000000004D4000-memory.dmp

            memory/5040-54-0x0000000000400000-0x00000000004D4000-memory.dmp

            memory/5040-20-0x0000000000640000-0x0000000000641000-memory.dmp

            memory/5040-19-0x00000000001E0000-0x00000000001E1000-memory.dmp