Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    19/07/2024, 02:49

General

  • Target
    5a2a7f1bc89cf311837766d868487ae8_JaffaCakes118.exe
  • Size 689KB
  • Sample240719-dbbfhssejc
  • SHA256 1889a92b238788e5002b6da79bef83fca7831e39177d0c3a9ec51489f8e0ce55
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • 127.0.0.1:81

  • sayhaaa.no-ip.org:81

  • sayhaaa.no-ip.org:82

  • sayhaaa.no-ip.org:83

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1068
      • C:\Users\Admin\AppData\Local\Temp\5a2a7f1bc89cf311837766d868487ae8_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\5a2a7f1bc89cf311837766d868487ae8_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Deletes itself
          • Loads dropped DLL
          • Drops desktop.ini file(s)
          • Drops file in Windows directory
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:12260
          • C:\Windows\install\server.exe
            "C:\Windows\install\server.exe"
            4⤵
            • Executes dropped EXE
            PID:6196

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 588KB
          • SHA256 8abc0493f49a811a7fea09451c547f60fd78442178c8c105ce95ea8b09e5d486
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c4fe3d1f76cf6f1c3fefabc58b6436dba1d3f8e9138bdce4ddaf5e6c847b22fe
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2a727d9522b4ae8aa523b0b842217b642ce17f0ae8051324b93ca30db1479215
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 15d23e9397c129ab52c2e296e169dc19af3f374de8a749d82b31b2d6ca856d06
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b025bd4e5e289cd7a96b08f3e0b8205ca0cdaafb31cf166f2c1afbcd787ddd8a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2e071f791df94bf21ece9e4854e4fa9f54899d866a88d1d484422cec20252ce5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e521a520f0eee958d8fca09cbe476924cc3558173c3b4fabe82e47aa84b2f9be
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9a33129020e5738ec42b4668d8f6d4f607034da053c1d1d7b49798e7bd9d95ba
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5ad3123c3da5539f5a2449b1601badd280d63b2f68bd4ac681d909300fde9131
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 578badcaa10f0c50e6f3eee62338d0ffccf7efe4a90e101310cdc7429b4a415b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3ba67fc3af4add89eeab79a98c9a5c843d487832546a27070a0c87bef8fa8342
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6b0b5dcb929237668fc52f9b8ad332132a5a3366756a8744292c2c4040d3ca25
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 29231274794b739bd15e29616b7e2f63e0ac91352eb8e0573c193aaa208850ec
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 eaaa9de7e1b6c18398dc8afd76a84c779c4be6985f55d9d489037547f2a730d3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c892ca5513fcc226684a7f9be1aaef3131d1137f15e6552ce8a411561a0ec760
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e6aabd803e267b0af602378a8c172fc40c90c35a59f48dc38578b942cc129a5d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0059627cf01f8b974db647aede4cb66967d89714bf2ff2937eabfc4c2e9f9cf3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f64f9ec14fe508c61ec6c71741d9e43399d53aec47c53f479d2bd14539ae7f3d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9cb1cd730ab4faa68f97e485047bea4b89a6578223b5e5c153dd366e253aec0f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c04d038736f0572424dc007d94d28d32f1673a1c429c217a4b551ad076ad02e3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 35f22a02e1113fb7371e92be84d2b7dc237455716dea9a884ad7649ec714898e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7698533f2755e6888a85e1c25d86815b25f65c3885d73ede5a466cd026bd5acb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f3e6bda4e9e91f7bfc79966f121dd1feb05b729a2eb9fe2b836cb697ec773002
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d6c8382bc2d680ed8779446b45c405dddb844c1607147d8a08a33270ac95bb5d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0ac0ea8faae4644483f806841bcd799c8e5df6009045d13b7acfbd8707f0748b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4bd2d9e5c8c01609eae94f6516ddd842283d8a58511e0ca391a8eb3ed45d83f3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3813e08f975300844d49ab6c249e97f27d0dc6906789871009d48196d2aacaa6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e4f742eda0a37b39e3ee2d6d55f22a2ed1b1b469516bf7e68a82e46decb432d8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0dd75e4ba19aefca1e3cf62eb28a20660387d8978537aa6d757552e39a3aef11
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2267122528b621f92b8469bdf269d9c842789562478710334ffa057736daba29
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cfd6cdc0088869bcbe0327d07a32fe110da2fbbe4087541b3704ff77953d484d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d8eae17186229d2793f5380fe6bb11e6225832f6e9f87432d227d79f3d15cc06
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 daa3173d8b0f5482c97cd6baf8bf45ed181f83f8edc389ea05bae63eb8269116
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e10cf689fd039a8354a25ace64f2228084179947f8be147eff1f9ff80a8cdd54
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 415d630b7ecb24f48cc0ddebb90d213e73495e8f3513020492e06682857d86aa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 061d91cd4bb1052554660e0f137babdb6b5b23310d9abce8d49f35d935e7ebdb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 385c70742b95a4116d1fc26a4fbeded5766a195adf456da76d98d728582e9855
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b80e8a6a902a4a3dcb2f00d1394d7e8db5c5ecf3a17ab067d73779f42bd7f1b1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1a15e1763fa4d7b6ab917431708f7232a947dceb6e24e2e158ccd6f32be89a60
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2d9d6dea5555ea89c1f4edda4721bf4da495878c0764ea4360d4ee603b853247
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 35839c4c9cf204d63059c64c419de903512fa155b1468f521a55e91807de8a64
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 80a0391152b4de76a5d1374290bc94d4609e353c3d917930e1eac203e8b30289
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b87edf78766567b493d195384483bb5f1f06c3684970d0cfc521c450c61918e5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f2c8eb104911aae4370408f4fb4fd2391e576d46e387aded7e4e14a87b7f8f0b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e044a398ba60f0de54825e25ce4237e50b861a156e67e83e79f66b0e7bdc0bdd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fa6bf76cf5d562d46b01875714b85948e64b85fc1d90350fe6eb07522c0613c1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 47ea7074d783b2e842d95431d0b944d6a9c3bb5e891d979b989388be7736a1c4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a988c7510936f76707429335a5422f4b923c53dfe4ecacbb489a088e0ce5a530
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2ee0c4e36ad4c106e71ed85f778905ca44a7291680e85c1d1ab4fc9a673435d3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 997b8e42579f2759cf6ec0878a0eb0b1782faafcd5aa4267cf121e0081811239
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ba8b878a42d7897bcc5538bb8f9b402eab8b06086cb054f8f7236ae277d73fca
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fc24e9eac4a7fa580a03c81c6d07062f805daa47ba101d5f7c692556e706a7f0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4bd574020b1575f2584bbf3e3477b71605e55674c52ac9ae9b9ada4ccbb01945
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1180d04f44804eee0d5d96681983c4c75ec865fb64243299e32541d67a9a0f9b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ae24f6512072cb7a90a2c214b900386f641d426021a1b05617e35e5e84a0b30a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a665eecd0d0176b82c193d02d127dc95b3e2a367f91398d67e56f7a21f7a4c86
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1f2276618081ad7671e8918d895c40134b21eae6020175123e4dfea96b7a5b4e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fe22b9707e476fbe66999e47386356d0d2377695195197dfdae8967a59ce23f2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7d456be31c91df400be70319615319f49af18cf7e2fe2375e6e7312eb97fcc0f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 67a6e355aee63073ce6e167ecb443e48d95c046fc8c1544a0d815a50cd8fdb64
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6c58c09a64dae1d34bdfb2dd380b23247a48dc352564f01153b8ee2863d3751c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2e665aaae8ad4526090ea430194ac0788ded817f7bb0c40e71fee4fa6845be82
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fcea2b475166b8016c6e57d61b1ab57ab103c897e6b43024ff95a5035b9ebfb9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 33f2525408b8ba566668b74a02e5da855c0fbc50efa549b5a5e37cad2232e9c2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 40de91fcd90504584804e3783e289b09db195ea60a72d32323038ed05fd2573f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e78888ce4183fc6a26e4dc167c25c666f34253582de40afddc6a622c4137bd93
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0951bed46a5dc0b574d8a64ed3829540c9c0799e676aefbfb8173b382aed3f80
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f178eca6a4bb813411f874a4626f9e71a9e320311760e2f424362de721dc91d8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bc8f21da7800d982568263476eb6ce3e98809a0ff3903f1fd45e75174884c9cc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3e7db9ca15db496024aea565e17ffcc2646301aac189f140ead9be056e640d4e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a7f03f85d6485ea688e3a1ab3b003e0c7b8208b09dd215ffa5ca488905f4a67f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7cb3ebbfdbfd1f4b49716f022e5eca54aa69993a0512cb5049fd3ddcd398b5a4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c2d00bd98f09d237cf4d3de97145fc7ace05d22b232d6610571bc67b7e830285
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2314e6b012cc39d00e8f8bb7c12b63c11b03393d7bb353992cd1b60430078c24
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 17f71e69e24b503711b12e51d10e108330af494f4a5e7cc1baf72a9296849e96
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7b9a72b9443f75d5a7ef898fc90844d6629f62f416c63a9691c42c5e2c7094a5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e2e359bb8759e8fae587c4b798f7fc343574245df0c7e0222ad4c85ae23b1de4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c21b9e825b959164a6ac90751c2a1f0c3a268e584c2f0799072b79d10872ac53
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7623e19108c378c1f25a8e5f5ebd1695aae780ab4ce09ecbc5dc8375487e6d83
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f1619439484f62df0568395c84b3b25df2a633d620dac75e1fa92a15cb96c4ad
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fd50b27fe84cbe53fd5f5ba789e9fcf7e9a9f07c7e0d19124b4d7140c26035ee
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8ff3c0a6fe75c1ebaebdf07b15e1b5d6c538f7e3ecf06abf4925506f950d8811
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 da16c2283681ffb5f17a076b20a820036630eb0db43378dee7c86ecf73f37783
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8df79e3dacc144758d2b01aede67b0b13328150ed6f770cdc890e8fcf721b075
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ea68342725567d2f5b2be55089941262b6e005fadf703aef2d6745f522e687df
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 21a8a175db56fa553a8d225408bae60af2881308d79f8418ad2634de7838ed44
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5c62c786cb3542c2f4a303aad87fd13c33bc0548351a024a72e2f11b44498388
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 83b9c084b54419cfd3bafaf98c7ad732ba68c6363ac895fdde055974a740d3aa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bdf5174d2db0977102f02103909d8ced753f3798b691a3231d576b8042514b29
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 200fd5c9c3afd88eaeb623934723867d89a3fd130216b25f5f915ea0ae39fb74
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ed875effe05d0bcb12973c9800678923dec44e3e2fbe1ea332b9ec7581ca959a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ad3aa82e783a0f83c5504f7e741184cf4b4fc6653fa448fd212d3632f7292474
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4db767827b583aa5c3263fcf0c634548ce5c3db056d83b987a4da07aa9afc1bf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f834ed25f4795c96dc3a0c01d36c627f723fea7709931616af65df6482f7013f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 17d08ad4841226f22cff91b0f80d47eb3eeab65a234755bfd035d35bbcd6aa54
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ebb3a916268ba8c2c2ed2f0d3b7710661b55a44db155909d5b3f63c015f8db3c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d6e14325c0d05d56107c13890155cd627f92c8c4430784d8c3b874149ab462e7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 10a66a9fc6325c804ebfdf5b42e2696361d03d1579f6d2332214e78ab595ec00
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6f6fb2911d506bbb5c53f98643a1f33fba96ee85adce3506ab096cdb96ab2e3a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a64bdb58f57932f53a206a0121f0506a5042f330abade4af2eef2295fd874401
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f456e137e3857009d7d895e41bb492ae82da7621e4f9a2a6663a8d52177cfbd1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d5112dec56b21642293847fe483993958716ffbba7d93b4d58b84e6fea12ae25
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ae2f915d7dfad8d93dfdc9bc5771d74aeb708f1024f37863db157631706ab6c0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 00581150b1107c1b895c5c7c26188503c780e5842ff63e46c3934bc4ea270d58
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9feaeb8957cecf0bff8e77ba94bad2c9c2f457a0779c8d2314c1a7e03143fa30
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ad8e17fcfd4a5d0210093fc79a03ba617785f504052724971faacdca8a0082d4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 88697e27061d092e45542d1e5b36bc682311bfffc671be21566798dedaaf0058
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9f778e95cafa0a01c60fd2f4ed335d34845904044fb341918bcebd22c8a5603e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 019aaaf2c26572d487fbbb719c808c153ac540031544d64aef644d72abdc2c8e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f72efc2fc5e6f7fb6b2a4009f4ccb748aab6fa5bc1c49ad330caddb5b4db0a14
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3ec1276f0b85403eedaeb666bfcd247750406a3fa23944f44149aca187dd9195
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a489e14aa1f1ed758924510cfea782f40fc308bc2729c5adde6a94a757204282
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 af0160e662fbbd9715adf089650be40495b66f6b4407d79f538ca9c1590e048d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b39c848be6aa8e35051a2a83a35691e1d7d672fa2c21ba215dd8870d492252ee
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 02e425541f865a0c130e8ff83630d1c891814af03ab6feb142cb56aceb6c8c6a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bd706d517ef9bf63d26b9f4a67bc53a19c7ad3dba460411adf07c378ff2f9801
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d6db9bb96765414dda14949f0340d6bed57d8edd02aaa7fe39abcba34be9f8b5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bfe709ba97bfc15fbc12e4ab7e8522dce40281a71268fb8cae6330c283baecd7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a4169eb8569ef0722d156a2a7d01a6b346a7e2791fa1590e808cfada0a299211
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5933cd80774ad9a4d3564d5917fc540149aa7ff55036ded71f91d41c4cb1cb91
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d6724b1577960a0c4467dc63a6759b8b685a727bb0d5a4ef59e38f18d7a9d074
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 22e22f336b9714326cc4bb519740e015b4ec0260e9cf4a018c42760d71f20a8b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9e09447c2146949c33f7ebdc29498c39056424239dfd942e484fe6ccf149aaf0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7af215788a078ad5055b5e3469fe1e673458eed431707bef46d440982694f345
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 71e173135601859f02cfd03dfc91733f9b34b237e8e23de6b64795681525b4e1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b1c23ae37ae6fe934e6b4d31308c0f89735ae04f18a91ef2ad530fca00fd4b20
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 09f7cb7720e4c7b5e6b0609a8001c477a6065695d389dfbae27c02cd892957e1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bc03489b152393c72da7b8d9a1facbd562ed65d67a5742d4bdba23bcfc733128
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dba3971d494d6fa422ffa248a03517a67f11a846a047cfbc2b0b21f7df6e97ea
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 930fa35da0c4775fcc0d49a97c9b2bc9a0680d32190caa721f635f510782fadc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 72dabdf407a5adc23611499018ed2b8557e0666789bcfad3289a1560880ad7a5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7c5f214a14126f77edcc2884b012fa9d3066381c46e7bb978cb5e4b4472dcaf5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6135b6ddc836a523a8d4efe6a2b85531a14d9d559646953f9a0ec62a02b9b509
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7a1b29b7652f62e916f74cd4cc9a8f9ef0fd8aeceb321818db0cf1256a0dc68e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c9a9cd16fb19351d778a225a328d6531974141ac496eac2514203c4fc2da15de
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 31b405398e3813e9dced106dc8fafa80da06b5c469aac98ac688ccf4fe75da98
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 948da7bd22feb2324a2f060fc1b7837ecd8043a48919a869eebc13f14f63fc5e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9eba86250ecc286fc8b858a54112a74e6825900eae42ef83eef25eb0bcc65879
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a79be7ab1bfb7898c058dfecd619255fc31d03c959d3516342bec20c63a56c6e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f687b35860c2870466ab400aeb213958df25de550c589cb6899abcf4bb1f0912
          • MD5 SHA1 SHA512

          logs.dat

          • Path C:\Users\Admin\AppData\Roaming\logs.dat
          • Size 15B
          • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
          • MD5 SHA1 SHA512

          server.exe

          • Path C:\Windows\install\server.exe
          • Size 689KB
          • SHA256 1889a92b238788e5002b6da79bef83fca7831e39177d0c3a9ec51489f8e0ce55
          • MD5 SHA1 SHA512 SSDEEP

          memory/1068-4-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

          memory/2404-0-0x0000000000400000-0x00000000004AD000-memory.dmp

          memory/2404-6019-0x0000000000400000-0x00000000004AD000-memory.dmp

          memory/2404-3-0x0000000010410000-0x000000001046C000-memory.dmp

          memory/6196-6046-0x0000000000400000-0x00000000004AD000-memory.dmp

          memory/6196-6048-0x0000000000400000-0x00000000004AD000-memory.dmp

          memory/12260-6823-0x0000000009580000-0x000000000962D000-memory.dmp

          memory/12260-5663-0x0000000000250000-0x00000000004D1000-memory.dmp

          memory/12260-6045-0x0000000009580000-0x000000000962D000-memory.dmp

          memory/12260-6044-0x0000000009580000-0x000000000962D000-memory.dmp

          memory/12260-6822-0x0000000009580000-0x000000000962D000-memory.dmp