Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    19/07/2024, 04:37

General

  • Target
    5a7d5500b4710889318bc474d54f242d_JaffaCakes118.exe
  • Size 316KB
  • Sample240719-e8v2vswelb
  • SHA256 76fea1d6808070b0ae8eee5b77d17bfd01ce4bfec4896aba772e55be510deb55
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a7d5500b4710889318bc474d54f242d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5a7d5500b4710889318bc474d54f242d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Users\Admin\AppData\Local\Temp\5a7d5500b4710889318bc474d54f242d_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\5a7d5500b4710889318bc474d54f242d_JaffaCakes118.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:21652
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:21720
        • C:\Users\Admin\AppData\Local\Temp\5a7d5500b4710889318bc474d54f242d_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\5a7d5500b4710889318bc474d54f242d_JaffaCakes118.exe"
          3⤵
          • Loads dropped DLL
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:21744
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            PID:2332
            • C:\dir\install\install\server.exe
              "C:\dir\install\install\server.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              PID:22004

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 229KB
          • SHA256 f163e6f5d54daa64ca0821b521622b9a8e08536f540547f08252c37a32524ca7
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4daf4898c391bf6656e07130645760af5855c3faee86f88a1c4151d4456d86fd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e9d0e657ff033df53a993f69f303ba1692f56429cdd45469fa0049c0426eec06
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 473ba9fe63c1d69c023b432a4f37d0101eb81712590d438162a8c43ce746c519
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e102da072fc8904adb8b7386a86807492b0ec5508b225e9fe3235e7d5dd525fb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 edba7237c0c2e62710ce0b894a9d7b557252679e87178d0804ad04831e3b9382
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 66dc088a9b1a07378a66523d6cc718bd5640537774b4f9e9feaf560b0279ff87
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b3556404ce52945f202ecd5c61f18c9bc92b48df824405838b617bd977461abc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bc8c381b3aadd0d2ca05f68b494635669f11a00f7a8d4185f564bf2480650c4b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 06da4f52e0215d32aff8d39d61213d669c86458613726b14def3f47f00bc8198
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 eecdcc79be187be7e7fde8e98fc52be9807d6535edc28069db128c56cfb373ee
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d7a9099f1d2349e6a6fb11d348b8edee25a4e977464cebdfbcaea415802259c1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 33f48e9b99b58c69d3c8e6c23742524ea618567f093079a2ef96982fd7a15f70
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0a993df1143c74ca40fc59dd7e38453e25625e4bddea9e741bfb2e45377ed68c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 76882558bcadde43d1c7f5816acefb822d194fa14ac139330ae4bf828defb631
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cadd8254f2bbeb754f3d2fe3ffce78840aa733e855a0b644eb06d93cefa0f29d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dc66df6ea61f1aec129d5492c5384c647aff6384fe2cb757d4f068b12693ca57
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bfacdeb44caaee1c7cb9bb6184b89fb73eaa57a9ce1fde5058c65ede3135d5c0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ebaaa5ad54bb57b8471318dd62d533bc93fa96ced6292a5fb2448378c9caea01
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 74d24a06a20eaab3a717da60e0ce21f54dc0ab42276e05a730113f500ef87bf8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bd1204e147deb846960eec8ee42b7637138edea3ddd20b0186802bf036418f16
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c434a324f5f392e727828a889c114fbac760c4d9d9f950e72eacbf63f808c855
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ae95de7eef4858d83a4394a858bdd4d78b805f611d2f88a15d1312f95082d86e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 540e547cdf6bd4195255004910a23dab61b78b196e08ed0ae5e84185267aa966
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9ec5f2a5454e6dcfc91d31e68a9dad3175617e7df586d81737be030888244795
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 67b70eb90bf58aeb826bfe4a5276d04225210714773e35e7250ebcfd15e84641
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a2cff589bca46523e22c6839693194fe0edc1cb9067493c578442787084ee329
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 83983e3068ae502137b330f6923c57bcba30fd92987223b90dced339686c1797
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2f41108975f3c93180131872af537ec83e88071b3fa6bddfb0b29cc363d6585b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1a086392a47ae2459eec9cf6fcab39f6b10cc06b4da2238c808eb3e305757e0e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4b1e712504db5cb385a8146bceae156d49af0bf26051a543720b2b2cab8d4af0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c27db5a8705577439d6295f9c20cdaf59ab912fecc691b33b07f27295be480d8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b77da013e373e0320439b6aa2ac856130b70cc9c1791a03c41f7a1d249ebd417
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f3e946d1dc25b8a2fffcaf809fc91f445db266b683aaa4c483252bf26bce674e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1cb39ec395677fce4ba3cea9a40c5e8982cb4d475e3bd0b71967160c38b34da1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3ce0e30f39149f2e2f4034f458a69f2f8d548f17d08077dc0867d63ff872916f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 eb58417fdcdb1658634129da2c6d97c3f165c90863d527ac6dda765fcf055310
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1ca6eaece292da97e222271f888972a508d7ef2bb68f1805981e2a04e5c77627
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6380334c02ea909662dc424406c7fc1413682940b7331b3ec1cb2c15bf20feb3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 80d22117b760f8161eeb49f104879415d4317d7a0463bca9cc51444f4d3d3e54
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cb87c5c585914fb9d895f1f23d648aa01d2f2d9f03489a8b914b6f1c5f6afae0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 02fba1047febcb188fc62b74974a2c856e2a4e899b5493bf25cb87540d820588
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 94458e5fe7225ea91982d9528a340dad7af454a0b9441d617f1f87cce3cfbb46
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1248b5d9c67e20e7d0ec093fa55edeffd4876c9a721ac347ad1a5d79bd1af3a4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 651a8440b275a7c87b0abbee55d37098ceebb2b26c737d7dab634f52277096c8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7f26120e6acccf51a91e6db56fb13c856269ae644534bf10b967fcbc2b9139e2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a42d88806ae2bd0081861c578e21d5d6e8e0e602028874e5159d960b1bf20d45
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 30b041698b65e20054c38818495025b0467e4ddc1350396c4abefaf1b1ef1030
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 299bcdd505024afe43063db1868f6071ab985132b9205b5020cca8547e99b644
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1687b94dfb090b01a4b1e873493da85f124d51afba5bc126a811617a8c225c1c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f2c484589eed0148b709e9ccc805a2d33a0bdb790c737ddbc83d3bd89a94f8da
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 08a6735b5916534ea15e46a200cb2746bbe6b13ded2d655a3ed5a3abf124757e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7da51eb0036df6ab16951acd082168db6608c3b2d31ac5dfb6ccbcc96c7bfd2f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4f0b42224f8431c0d2f98209bf48ca192750bf743ca7be6c716f6ec962ee6d8f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d6bba96a3094488073da5645142da7a11bc2b3381e3f57313fda879d1417dd04
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6d853d12b3f877c08273f3a07d5c0716dbb063ed8e23956e07c880d1c4b3c7f4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e036d6a6acd54fbaf8e3693738e6a836a02c238ee86cb325e4ed58c85bdd4210
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ef43450390157ff040782a8d06c02735341e68e17b200beffc569d489e2a216b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 622d8c17e5fc13b36fb63fd27670075394a1a7a38d6b94f81e81b1dd07a74c5d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3843d507e844c5c5fa6bfa0c60209b0d2b4fa3bb55328464382f437d82c92372
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4f52279945f55d1ce0440d17e545d2ec3ad0e8c85b19a47b17e9f1abeefc0134
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ce7e5c513f552db41fb0e2e3c980f6dc367565001f0fb1a13c754e53eb3cb153
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 63d2370b38739f650dba68cf723d97feee5fedf43f30652e30bb3077c86ca885
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3274e5a6fe12e9a0b9f3191554d57c4f1c6c0a48a64fb832417ec158503366d5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c38aa7ffa0eb2d9b69069c81baf998ba95d7151fa91e20f68b73ead5f95c0cc5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5cbb8a2cd3d16d8773e4a6bbe7f35e921578d5627875e0bd05624c0a5304dcd3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ec845033657ad522ee2aa5dcb199bc7c6b6b922f762a7f258959a9ff2f42d81c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 051c2067fa8657d6838edf8c5e6aaea51f4ccd1f2c02a5d067aef25e61e5255d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dedee78d4e37d82eac96a8ce4cd705d089c07ba0b958d229df53b3008a03e166
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2f43a5106de97a4d54687eadab7fdb7615fe1289780209ba01603f0645fc380f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 094a99a83b8e2c6da567e64d4972043a09bbd75ad18b4389701fed2ba0ac5f89
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 10312d1f4ace7e44a83abb2301fb2d9667480bb50a7bb87ad78a301aca69fa18
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a344daa9e042bd8d7e5af64acfaf41d8f91f2ff9d72e0fb3a8f6f6bb86247580
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2babbf079dd5d463086fae4d17786401916c289786269cf544fda89a5ecefa58
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c1b84d0e64d98a7fdfdb9a55759c56ef224965b21f51e31e4ea77bf89f2ddc98
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ba19574490b5f59f1bc1f5dc6bab8fc3bf3c754ac86c0bb2db2539f1a1c94e4e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d40a91f74f3bcb060862c1dc5142170968229081abb1497c34ca4a40ae0de81f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 32a250cb1e59a195190e9d555c87befb4b72e6eb3b581882d259be327c4c89f1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 aec5d0916ec1a3272939baf48cd1c4c8f546b2ab98b62c3b58d1d96dd9cef957
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c43dff3de871934cc74d9820285951c80fc216b326317a2b804fc0f69a9fe231
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fe5c0413ccfa4e9438bd7b660ba9cc3e622721a795d5882f0c02f6d7c6bbaa6a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 61754cc036f4056634a807db79c3ec9dc768b89c166c903320861cd4f2c2855b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cb71e228b8b2f36dedd6daf41765a88a191f6ea2dff23ad25a094ead43856af8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ccbbfa3a7785bfc2d09471d0068c703dc8ad7cc214cb6d846853e6bfa1af0ffd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 347f37a63a99569c4522e4b4a86b8e8cd00c52b16925e226003c92c4a7813242
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 804b95b8a7382c2d208f1dbf598aba4e18c6997201a3fd9d21f5007d5a15ff9c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 61bf21214e623783d57d668cb94c516286d1b37d22018879b0e8fd0d76338d45
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8dd25026c5cbde8afefb2daea0012f84a16962ece29d5dca36c8306b77e51efb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ceecb593c6efb0b400c04bbc4989d1d75a913234c86bce90af351b133d5ab928
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2533a8b852a7bd2aef04b1dac1a3f16ed53f9cef25b2dd79a1648dd2f165a8f7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2725c7681f5695654cc81a6e9102afac94078aad004b5c17406a90e9c8ed732f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 469fabdfde13e42151202790266588509524171360581866d088107379fc8968
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bd1562a94def8474bd292604868ace2f74c4f702c8e55e0be3f395f8217cd418
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3d11ae5d6f09a0a21fa984345c0454abd62990177c73d22d6072b644e4d72f91
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5a297ef447208dec8e81fb615fbd00f8141d9f1e87c2758fa7f7b66791c4bec4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4c59d7b038cfd9f46304e9d77f060da79d4da11412a04487234d8db6ac312e06
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0d6a5ccb5364636b3f34345c4a3ede978fea5cc5e11aa031d4e27fc93c0de408
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a25c32e10774bd6033104413cf344a1abe86064f06e8e2b9b06bddfde1cf07da
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4e3a344d56d22de032b4b1d8dec95113ecc1c3f9d4bdbecd3d18ad081d927b6a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d846d508582796df289b12ee713a41df637005512b172353b7d2695b8a376b21
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 135e284b00b8db8d372bd189b39665df26eeec75779265de9cdfda8dc61722bd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f5425523a48a196ab5bcea3e3f338d022519ca0b96f0ef1cc6eb245d7e076010
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 727a20718d0eb55178970fbeb8a7700e3adf24e1a029ac59c61222827fa56452
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9120780ea5f615577d9379adb1573ffbcc5e57a34d1dc3c7ee6095476f7db4a5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7263e915bbd8f95569741f04c54e8b6e468777ceba8ddefb7e2a8bb98c91eeee
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2f133c10423addbec487aae6095fb3deb6f0d94d84b00efeb67694f1f6a9de98
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3c6eea24834bc32a81fc553460a65677c33e06d961c760bcd9850dc22960b55b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 224c859a56ebe6efa5f1512c85c8f020f51b6bb799e821683d730acba9c53c6a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 66fbff213cbba61508e74e6beba9adadb6a3b4bcb309fc6d89333312b34a3833
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2eacbef578bd64b737e7b6f7aacd74ef409913ebd79f3d8f1c8d9ff78ad29643
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5082622ea7aea02952e2e61dfdabcdd8b901cbacceab0305c5fca40b865242f3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2497092589e033c1c22792c6f7a63c4a10628d4b7d68e060f41281c38aa8835a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1c5c6ad5232ab331e048b34638fa1a595a9b439bb6c38442c4bb11d4558f9c44
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bac2893ae50cf71a9a8b0b959a95a8b35de8d76a1635498fa213f84e4ee40e9f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e7cc0400a89e8ec7b2d7fa5a4728a17874336b62ef720120ba3489048c815fe9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 83698e3bc628ab17dd10075ba3f10427fabd27cee9f68e41565f9792ea2e8db5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4c0a9b7026afb559e4554254b8de4859cf315c3dc1a7d39671c75a87b1794ac2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6b9cefd5a0983a610e17c8e3bcf3895d6f046a7669e07d7462329b647b1345a8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e0f03202be1da5f656cd12f11a0b9e482d71042886d526eb5305c4d458f98924
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d08136c5ec8791269620c9dca2b2f87d22b8e6c48f717c6ae0f893bb931187a1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fa31c5d81391377d5b63cf5afbf9a80f081a0d22737e3275ddd82eacfbcaa7c5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c8510af8315121087d7eae1eece1dd41ae43813d272acc09284d5593f262eb6b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cff634bc0fdb80b76adf6b9af9cf8cd36860c1406637c0be3bb4c6b88c9ead55
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3b64ec6cb8441cf6d692d87d79f2d59bae5f74499941f853e45dab9ff712f895
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 87de3c08e293ccf3a6a68204a6df277ea432e8d9bd0148b536610d7997fbf398
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0d63e4fb29351d5044eb85e09cdf9b1356443b399883b09be84fb3d06fec9fa3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 815fd31e7474754aaa1e43c7d30910ea7c7aeeefce8ee7491eb0302c20904a89
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c7d1b676e0ade18c329256b331683d352de95e499e38fe369aeb82e29dad68e7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b00ed4c4795c1b717e37cc96a271eef2dea41817b2ef21ba96cbae7c3fa2ce6e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 edabc4e1adac7a8d1d1f4f2b93a02a60944234dc7c8d6617feba9a2769b856d0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5b65c4278ab238c0b0852e3459654a8e67eb45a5d12c28ac32a4b6f27f7f3d66
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e04185ee6e243ad3dfbf1e031951b3c5dbdcc010b4ca2ee749208603a1aa16af
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7a428953492bf66d3e1bfd3ba8f31d75143e0016bf823d02b3ac88f41a60ef26
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c05d146551181f61213e3721c70545fb766d3d816a0c21b5ac77889ad1ad75f4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 eb6610bd7a2fb14bc5fd26d920d6799cda1b472aa4e41edc9bc20e3b63f3d06f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e49f833e28ed520c375739f737e83db807fc4487e5d28743175ec460a88871d2
          • MD5 SHA1 SHA512

          logs.dat

          • Path C:\Users\Admin\AppData\Roaming\logs.dat
          • Size 15B
          • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
          • MD5 SHA1 SHA512

          server.exe

          • Path C:\dir\install\install\server.exe
          • Size 316KB
          • SHA256 76fea1d6808070b0ae8eee5b77d17bfd01ce4bfec4896aba772e55be510deb55
          • MD5 SHA1 SHA512 SSDEEP

          memory/3008-12-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-9-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-53-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-52-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-47-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-46-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-41-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-40-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-56-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-57-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-58-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-60-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-61-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-62-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-0-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-2-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-3-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-4-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-8-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-54-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-10-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-11-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-13-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-27-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-28-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-29-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-30-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-31-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-32-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-33-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-34-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-35-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-36-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-37-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-38-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/3008-39-0x0000000000410000-0x0000000000460000-memory.dmp

          memory/21652-32773-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/21652-32437-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/22004-65171-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/22004-65181-0x0000000000400000-0x0000000000457000-memory.dmp