Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/07/2024, 17:07

General

  • Target
    584e7b7daeebb7774cab20186ea5f786_JaffaCakes118.exe
  • Size 1.3MB
  • Sample240718-vm3gtayapm
  • SHA256 6389f3b0d3f5e0346efc48bd168b5729813dde1d806b877b90126c3b5f8d5962
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • x6.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\584e7b7daeebb7774cab20186ea5f786_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\584e7b7daeebb7774cab20186ea5f786_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3224
    • C:\Users\Admin\AppData\Local\Temp\584e7b7daeebb7774cab20186ea5f786_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\584e7b7daeebb7774cab20186ea5f786_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3604
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1964
        • C:\Users\Admin\AppData\Local\Temp\584e7b7daeebb7774cab20186ea5f786_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\584e7b7daeebb7774cab20186ea5f786_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2740
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            PID:640
            • C:\dir\install\install\server.exe
              C:\dir\install\install\server.exe
              5⤵
              • Executes dropped EXE
              PID:2916
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 540
                6⤵
                • Program crash
                PID:3348
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2916 -ip 2916
      1⤵
        PID:5060

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 05674132323ac0830fbc37b06a8ba7e487f541fa17ce1cf4683597304dc24d9f
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 588KB
            • SHA256 c5f37a39d7fe3c91872db43265359400995be45dc44b10bf3bc5234611547c85
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc9f9f80888d23f946ac709968206a16154c5613020076aff5407a21d4789646
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af6ffa1ca8df5117dd61a92ac6224c6d9f95f9b6ee99dfd48d5f239ca74cb473
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08afdf1dd0573e2d13eab5815268ba5bb6eddcf2c0b3223d4886f4422d4f79b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c53bde2ba47a13bdd9f04a91edbbc405961f1f48ad9f82df1859c27d6f15c547
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9097d27805784a20158cab659bd158f03997d47cb7c7718abe78ffe51f82dd72
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97b2d3ee57220699868a323f9c2db0d8ceba8cfc76fcac1a25484b32297097bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fac9d0c8d40c5a2934fb0ebe96ce946e391f7741fe5002f96dde5db948e10f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2366ae0b83d207924b6502108ad5025f8f6bfb3ca8d6466ad2b4a0376074cb37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49c84cdadf7535616d40a53ce2ebe5245c080e60dbe3b47e3325af791ee58f03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94d4c2e888632ad9e93a6644fcc389a9e3e0cbb21a7b097371f0f1f99c9b2c45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2297f5fccc6d12bb590f5a88fd89f743eb7f782069fd14576698e6575f574a59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 813dc056ad1fea897fa1f61857fa29e3f8408f9722c64129c09efd87c2c45487
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13dbb64494ad42ae7fc0216c4a181f2d5774279e8b8514274b33dda1a0346082
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6cf694ace840f290c6295350e9f03a3898994e4713632544f6b8249109dee451
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1e1b996116571a5a88435f489ed98b6e1fb08912403aac973354197a494c336
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eae896029b805f07b7143809f8e8c97fb1165d0598117efc0eb4ebd14c1d8a97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60e882357a805ec962e76ef338127c806399469b87fa3e339fe85cc71631fe08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd29ed4d151f1e553364aaeff2ada7c2e6c238c488484d971c1189879e9c9629
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 334cc13f1994fc7433dad9211a8cc799fdb80a326ff782bdd1098e43931cf7c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f86e557838af7b0bea441d472817eac4c40a79eb56aa621f8305bd8358b2bfc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 815dd5e26c848591d84cb09914c65717b9c79f8f454a71e3736c94f9618fa9a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08248e34581640d1172028b03da672371a43fecf46870eff9dbece7ec378259e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5aed4bbf09bcc28aba0b354b70c6706fc7b828b682553335696c0f5020982e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 551f7a28c069dd0d0e781a87edda01f7e5eb87691d46bb34dc183f954b8c7331
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eec96743651a86309552edca989f30af599a3abb92b12f7ed39f361bc49c6bea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f43aa832e61de62d719bb6cebfed15834c772f4b74face8998a177f8e9370f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 152820960426eda487eea4bf2ee56c93e38009c95f5b37be2de504bffa500a11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5637fb51e404905f994cc8eeb56c11296947b7345adf7e81aa75c652e626117
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8be0d693b61449a1db87a14276ad2459474d3bef01ffaa2de7d3a17f67884a0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80d7c2b2149dddd7ba87006d0a871f5464c4a8a23232e9cec80ebdf0cae70cca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89cad4f3aaea2850d3386c5d1b9b71fe535f4af6249309ed996a1849f213fc25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81da8efe12b17e30b66d7735d31b3ada1f8d5929b127d1ccc2f605a6b8190885
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa377468bf3c401af7029026dce801710c2bb9369eb084e88dd5ad559a3d8109
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42de2239fb6c85b6cc4e39231e0669027c91d4f139852e39ae32b5f3f0d5cb80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f685042704e36cfd5f680d4798d6eda7d6b7125eb271f874322e417ccb3595ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aafd96316bd107b11ec32213e43dab3df9c6c6c157e59fd992c37287ec9fdb89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db4bb5df44b6b9908e973d8234354a7958b683470dfbeaec189f550005a797e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82a739818375b5dcc85cd4c56f4fc9db3a7fe36dbc671d006a20b2e91315a642
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3359e406e72621003ff5e9c653bf00279ab2a58be16e060c2f8c8ac0776c883e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c87c1bd9e636b70187c732b7f2b71d6afdb47b2bab026451274c448478d2ed9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 feef06a09333154faf2a769bfeba2c1a10e993d00a0beecf5fbab84671e3b987
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e2c743d3ceeb6d31feaeb8d301322fa5b4aa782c07088a537b13adf6e5c65e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7dac85b077d47e0d9dbbeb40f9e05b046e1f6b41860033032602138e82e05ea4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19c6a2215984b34abcb6411b184dddfe0307a61e56c78356948e233bcec8172c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fedab3bbc894d46ff383ea7c2bc8f8858cfb542de750e17d78f73ce3380e66ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cc911b2d55be69efda0df0083e179a5ecef70bb160357d0a220d56eec5079bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b081adfd223af01bb9dee55010001361cdc1abfab7ffe7f62041e36cec2e1dab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb6802f87b2dd012e10c1789f9c4b2f77880ded53b4eaf03df8f40f6caa8a875
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6744affd198e97ce08e12f0896345fae97f9b19f41f68c18187ef3710afa01aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 681f803aab23eebc47c41773f7459000191b2afc7b0fb3f219e77dced6a64e78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9aaeee93385d20de529102d5ac591725c81c0465f2a54820a323fa4bfd7539a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12e631be571422a724300e4eb2bab6169227b21a3eef14fff025c1c1c1829797
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6068c4a7cf0b8ff3c690a22930501a024b4dd8a42e2b0c35b0312f6ce20535ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce22ef12f10473e80cbf9ba6ed4480fbbd378a5e237b49cf007f969c6111857c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3927dec5f597c643f0339d63d003ad22c8821f560c20c880766cd52ccd3c019c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07ffe00c783dbb754dcb113e646f67c6649098bdc83bbf88374d648d8196a5c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ec5475d4557c6491658ba4cb61141f4d3fd6580fec1a7bca5aeb904d868899b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6020c309f078a3946a1aae326dcbabb51ec7fa709919cbe33827416ff3fb2cd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b57e1b12f713049b3895956dc867f8130cb404993b3510bd834611570c8e4f9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a569f453fc9b0504f52dd04e26c3c20a748500b1473062f37b628b9cfb4d3c71
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49565bde1928919acb4675492b7d90b874ba73be7e02b5de923a9331b29755ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4599816d178c6fb7a0359dde9e1ecf30d1fd7e62141646daa86dcd1820f8b798
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2dd95e3144e7eaff6461d8b598bff10bdc514204ec32b4d1cdf5e9460f640fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7da01b35da75c07298750d530cd353f6e924d701032e55a116977c76bbe32ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50a315b495f48493d7573586383ebacd419dc6e96a462a200003ff49bbc0eaa3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7793aa56cd302aa6b8b9a9726bce7369e81d1742cd1dacdd1c46e981cd12b4b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5508ae955a752fd04511749bdfcdf491b0b6a6d99ab052cf008e2a2a1ea20c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a5f40ddb869451b44c28dba5bd29d3fa8ba3e8c1183b0b32c9c031cc9d63960
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a24b53ded73c090aa38ad91628cc327139e1108a5d733583ae74735ba3971c2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b5917cd70cb36841bf028ea51ce4fe6bf197afdab21955f0d58b027f894a269
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a9ddd6b7d52761163baf6fa48bdd485b43e7ae02ea40559ade64286581ada01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 713db90fc35f55c4d394c2370c6bb063f966556af8516258f116e2589e509aa7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be77e3643687182d7c37e2b4ef03731d186e0d998c4e22c9c3f1803f9e500a04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da8e9b58adb822fc87c21b10423ef13698a87c44623254ba94ae6bc7ad45146c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1b656611336e2cc66a1205b7b67ae663ee94c697f45caeae8b3b40141b4af83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6b80fae200464920e14bb66cca53717bbe19c1332d5ec14f296353368ed9199
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef830c4aee91f05d4001c0c92a4827f8678f4263e542e6089adfc56fd6ec2248
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c068a8ff1fb1eeaeb326f2fda86058931a9cb57b4346b516d843192e648970b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c7e09dc7043b5eb6051fd0c574e44b8afeff12fa1dfdc84c9a88b7736bdc4b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5820cef99662939cb7ec9383e624556313565b429df0f50b3704da89233a0312
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4454393b8bd43c0af9bb4d335368610c483cef3b906b42426c36a11f07194f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d6a50a2e4f1f7100ea76cf01b0b84ec8a39b67ba0fb87c40e210cbb501c3fe9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbee34fdf8739c1dae254454e60f34720bf7d8deddf0ada682c2b1bf7866bbbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4cb7b7e5eb5576c840b1ec9f5b0fe5c531385f0900482a3d3551cd6612d1702
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40e36f81f729c65860f1d11ac53e8e04c59f3e681fbb966fad715e58c8d920a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e05cd00eaed5152f5bf2c7ff78d94980a019a76b257d234620b059820834f884
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09381fdff594ca70abbef375f3f87ed56a1fff9af66261e02a8dc7d462e621bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2aa47f5e2774561ecc62b8e32b99f62d6d8c42e7619c48d4adba31a32c6612a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c43e27a8e82923ee0477685d8477f3769cb6dab2745cf8be663b3f0a9d585194
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4033701d0763c0ef6cd82caa13043c609ddaad968f766d51e99e26d0310c4a45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e6b64c92985aac4692e392575a57a228fb177f4ab296c29ade909d7324c6825
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6da4e194dd1d433188391ec39730460e29fdb2eafa79003771bde1bb56702a68
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f18a2a4b886812e3c2c047ec81085977e8b35570fbd360ca9bf46da8eefd1187
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3792d18ff691e5721ad868a0c4004b42b70360e0977376822e0611ef20b169a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2059e371de8d875bff5246060a4d58be6095f20426572043705ab666a68f1581
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b95fb0c80e928b4055ed979a4e81b3a73edb5a5ce072de9f3de544c2c09fc8d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49bd24f3363c6fd380089024734f290566873dd87b1627c44490a60078f533b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19dcd259cbec2844e4efa369604494ef0da085988ffd68cc946d194d596fe341
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 748e77988d3b759bf625b87cf041958e4fb12c572a22609edd7ab963007ed49d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1994163cfb1413a97ba0476a2d7ea17309b4c59465c7a5d596488024409e3f69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3f36be4e965530cabef47d69efd50aee564ad32e53f986937e7407000b856fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 949de5458728743f274ca0064bfe3c544e747a02206c3fc2e431b04a73b5cf45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bcbc6def9a298fa3e99f25bb8b494975e2aa7e7deb90c86059014613670619e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e58a18eb5f3a930d1bd5a34e60f8988bec7e156bb231343a5c19b29c487f80f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 062f33b227017008f361c24466da0403f4416465af3f9e95ec317eeeafa56581
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bfa17c849f3726d9d5210071faabd610e90fa6edfd7f23c6d90cade7a305302
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f840bdf24847438847306b6bd368afde3ca85449cb68e6171cd0474fb44caae1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d105527f3b39e0fb309f44ffdd75892da9b0eb9448fdedc7c340ffcd3924bddf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 107172a07c5f27075100f439c0d6eac79fd91a19d746ecda65454743d493db74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf9ce2fd2753697f3015c31b9212a92d0eb6a08fdee71a9e4c8c5fb86915056e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f7fbc691c5745cf2959fe2c385878f9345c35bc7b73c8fc8cee40f3771b2b17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 867ee0ad2a4c0dcf93da74fbc7c267a5cdf070fedb874a354a8480e7aa7e4a8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc6528433e7716526dde60d194639a68401a454c27f58a8a7b8ac4a5a4715233
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f87b568f792515c29348a2319efad067e09b78f39b8493fb9b450033746080fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4819fed269a9a3239ff9720cfbc7fb3c48167c839ccd388eb3d3c8b8f006d721
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1c322b4f3717e93e37b82666112e5fd905cd3af8f5731e29e8b0e7d49c643c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbe3e678486ec9e33abac12d8fd8ae51d2f36303f8e78f424e3a35e77ca9f7b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a34efc44d155bfced5caa238eba16241aaa27bc65a20d450d10a0f2924b4823b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5af4c80ac7865e9c20875255eeca51cfa1c36619664d949f8aa8706478495afa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 919a6a19b7af125b58c8fce78d5769f93545376ffa86894602835b510b0e422f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4896639198387f98cb7e36f8e6f302c89344f36b685b04aed0eb4bffed54ef8e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 548faaecb8eee2cfbe55e37dabb9b5070cd518377b27e8df7aa8f3b6bf790905
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9468e0129b20ebd79f140c134e7e13eefe61a6a3cb089ebd299fbf038e60f596
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45ccce327bb38271ed2891fd1fc40f8ed968b605788659ccdba8414b3dad413e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb49f9982e1aef53d3565642b3e8b3c9f8c63d2cc555af9391c247e613ad8f6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66ff5ab1b32c74b4152c6ad04c322308b6e83f747eb18fdc4bb615a7ab1ee580
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ace822467c9315d450e093c1d99de7d96fcf4dee79a0dffc9e2604030b62ab8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb3e19fe11154d9ba77be4663d8c8606add7880d3e0d857db23ede9c9e06a095
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ebaa7ed0c012c020022e4e504c67c9ccdf5f990550f6db0e521a57299221806
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22d1b5120c8887efaa422e318a18a4cb564bb85906ed77fdb479c54965c5628a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0bbe8dd260e55921929038368e3e4fbf7cc940d9659aa02e2ab2c8d48df3e7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 329c4916a1e7239ea0570a15f062e722baea8d4bf13da2946b80cf4da0f7f6e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35183013aa948a7a628e9bec4eb6f9b65a82846292385b94b30054c98668b3d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a1ea01ca9635c41e04e37337ca0a10bcaa4cc1b2c3fe3a6e5ef452d94f846a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb14c45d23395cba32e8cf7c6899f8cc2ca3061d60f51d76d8ad0dbd4e11dd65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57b7c0617a159157cc9736bde70f1e30b93ab18328ed752b9970f74251745011
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d97f1817b284285fa4369af7e9e10e8282deb9a70d29b9c6704fc277dbd5f19d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 474872e3e37528aab89bc54d14186bd62cb896ee8a4d33fd70fc13b5c45d68ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 394faffb2c2f60eebc8e412bf7aceb0738a543cdd95a4ad07bdc7b2f894ee2a6
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 1.3MB
            • SHA256 6389f3b0d3f5e0346efc48bd168b5729813dde1d806b877b90126c3b5f8d5962
            • MD5 SHA1 SHA512 SSDEEP

            6EF69DFE

            • Path \??\c:\users\admin\appdata\local\temp\6EF69DFE
            • Size 14B
            • SHA256 954bf74cdf303b99b4e39ed1bb2c9e228a7b7fabe1516b73cc38fadf5c031945
            • MD5 SHA1 SHA512

            memory/640-722-0x0000000000400000-0x00000000007BF000-memory.dmp

            memory/2740-20-0x0000000000920000-0x0000000000921000-memory.dmp

            memory/2740-21-0x0000000000400000-0x00000000007BF000-memory.dmp

            memory/2740-19-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/3224-7-0x0000000000400000-0x00000000007BF000-memory.dmp

            memory/3224-0-0x0000000000400000-0x00000000007BF000-memory.dmp

            memory/3604-690-0x0000000000400000-0x00000000004A8000-memory.dmp

            memory/3604-11-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/3604-12-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/3604-8-0x0000000000400000-0x00000000004A8000-memory.dmp

            memory/3604-6-0x0000000000400000-0x00000000004A8000-memory.dmp

            memory/3604-5-0x0000000000400000-0x00000000004A8000-memory.dmp

            memory/3604-4-0x0000000000400000-0x00000000004A8000-memory.dmp

            memory/3604-18-0x0000000010470000-0x00000000104CC000-memory.dmp