Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 14:32

General

  • Target
    638d64967a388f252e989e4518706b58_JaffaCakes118.exe
  • Size 472KB
  • Sample240722-rwdy2atbjp
  • SHA256 651ccc039eec856d5c40659a7ba0835d47c0527024337eac9690d79af2114298
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • ssslf-010.no-ip.info:288

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • ftp_password

    ªš÷Öº+Þ

  • ftp_port

    21

  • ftp_server

    ftp.server.com

  • ftp_username

    ftp_user

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    true

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3492
      • C:\Users\Admin\AppData\Local\Temp\638d64967a388f252e989e4518706b58_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\638d64967a388f252e989e4518706b58_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2612
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          PID:224
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Deletes itself
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:5932
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            PID:8120
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 8120 -s 576
              5⤵
              • Program crash
              PID:7992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8120 -ip 8120
      1⤵
        PID:8032

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 91ded069d7153b09685601688b0952be53dbcae3aa709a138cd19f29870cacbc
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 588KB
            • SHA256 caea6783df95a5c31aae22815a370f2723f0ee05b0387b5737a491de1f58c7a1
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 609dcafecc05ead466b9e3e50da1182ed65687e25bb10ec80e94fe32236dfc2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98d9e423540568eb52b6288f44105941862c4a59c33691bad190868556643972
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c80b0319623a6a6c753c107398662d9b32b025c7cc6c5618a10ca8dcb8beb3ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c3dda1290f045b9732b3cd99f940f0a5bcdc884843f9e4c77b7e947a96559d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7fc054cb3d9bf6a73a5fa5d3112a28b4dc2053dfa05fedb1db2525bd3d22627
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a04987a22cc6d7c33e7d448875eefa8c172e8afbc38c2768d66d405fe29e4e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 298d9dcdd96292d2035b4106a11e4cb7459fcd40674284d3ae40a6bc0736c1ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68e08b0a65171c4bc8c9098a54eaff1415642dba78f2f63dc02dd36cb7bbed2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9b961f7c9ebf1488a74b6f08586ab2977c91285b3ad925974cd673f83d41478
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8e77ac48d648b91c1d69d13c63d79a0eec200b04e1f16ec2cb98c060778182c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69bd1a52c93b96f2e53acfd77f2fac15a0b102f696527f218bf209e4adc6e8f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46c752de3f57785d4b78f3b97049991a43be4d6ca6180081393bf27b5923d87b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 312bf56128c14378493cc627e999d45604b953ce3fae2ae1fe66a3a35e96b67f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bef7189ecfc05b2ec3b6ce56fcb80931797d2410d76ce4f304d6be436440477
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d8aa05c85bd9c1d05272e02cdb39128bcbf8e41d3894063ca5523eb84b00da0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1a181df9efdd814dbf45c01cb14efcbdbdb6fee71ee7bbb612383404837ff70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84e5f27b6c51b318ca0b6a4df61f3bb1abfef4b75996e90c396fcc96bca07d34
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86e48d818494120df6cecce00c672194d80812c68c0f79df741b3f40705e4a06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cec4c8d3c007f01a0432267d8f0356badeb56f52e9eae246297f49e7d5a71d96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 418e9767b91897b87ba59467d0a88e95fd04dfd3371f948a18e2406edf822b10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7dc1d934abb0101d3a95d77fd95843ea4cbdab0889c082b05f608e49627ffe75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fde54e424d51d6803cbdf93ea8d6eb6f17edadeb93251826469ccf4c3fe54ec1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 361e04f756067418a1ce692e12cb8a9510f9f31d6c97086a2971cd908223581e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b665d003ffa12b1368b936a1c06c91b1c622308026c5c6ad1b0a7e69a6f7067
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8999ff4ead554de476cbca89826d88994a111a3ecf032f150411ab4335f1a14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9035f8c5ada702ecccf8a2c4d42a3a20a33d09b7cf80f7dd4cd2e4b63c423ea6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ab6c85cea554b1d61548f51cd8d6300c1f1f2624924570d9318da604fbf606a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54a63503819a002d5a280bdde00c79ee6a548be6239d5598dd2846f1e993612a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01ba116a92f2627387f8e986919192c0dc3d2021558664a871b97e0cc49acb8d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f68ebe8ec5cee53ab96e0e5c4ead4a5b5b96d4a593fc2388005acaec77e40a26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c718e6fbd76705204784fc554aeee9c63de69fefc0c07cfa9fdf76f910e14a13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6fc413930ae5c87676b3dee227b5b4cf2cf69a1805fbd0b2fb5bd1c14ad1a380
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b653844dffa96b701877952370319a66040c91c7aac081aaef2c12939ffed6ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5a74b33f7a15731e11f6158aa43b3d836d358b8e9d3af9d106c3cba78fd62a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a3e35c01d9eca822873deb7c03fb58bfb1b557d25e082e6a984dd3b6aac9e16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3192317082ae5da891ac74255ac49a70e9729cb7cb095a8972c2a9befd3cb098
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7807346ac2b30d43542b82b95a20caf6317b0edb41469b61bd1db479534dc75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09d00d82f61e89479866c363379dd25bdd8bc4b2647bd7af986512bc5df16cae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9044ed386cab3f1a72eadea900687d3d85be74e6e5ac5aee1158d6e586776b57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 388bd094ff65dc8a26472bfb8aa698585e689d0d9369b965f72b0c15db891ae1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d001d1f082ab1ddb831fb8e83495747625e458d8c1107d56e4725a97aede0e17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 246b8ce72f4ab1e9d719390d50a90737a2fce0ba89bdecf853af720ad284c2d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 192b61d79b2b48cca5fa6cbbb248428749cfc429a808ad45554fe0f43cf6c643
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45e73b652b3635ec0e9966530e1c5e71fec6662e7f2f879c23ad42fbb007e569
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2af89eeff56ef7aba9d71cf1141b709e88d8d5e03bbf11ec36709baec7bd6251
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f0263354eeef08974b333d27b2f5af33ade79f1f9b1cec367cd6b650ad31c6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37267d812dbc698b84f4426efc2793890e8c0f72540266e9abed4fb2900eff24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c41f5d3753dc5ce93cb17923d06caaea114f406937e394899ef2d3614ac5249
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ef00dab3f9ed0c29dbbf4ed1857ba2c2270297252230a0eac93d788e919fc36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65761a43405dcb4754d01350625c11dfbb155e440bda94d0147b8bbf4e2fb808
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2fb028f15e5207f992ecb770dd770f105caff2981128fed103e26c1deb17c1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e909f14e85417bf5df58ce61f8fa50e1efbdbb54c9debab6469cec802d4b01e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 518d71d34aecfd4934f117fe9e6efc4bcc390a69ab09e9ec930f7e476971554c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e448382242dfb97e76092226043bb41637c9fa8f3b6b007b926a11e6b360d04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a298e92bb9407d382b4d069b0466783db099e42ffdd305de58fb282d283075c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd60279381b287f1b0c1413326a2f1fb4663e33120afc78bfcac5938de28cc83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2439a7ecb78c870c0baeeb1ddffc0fc72e19a30fb458454139ff1b0f59aa9581
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2076fd09b24a9b92a6d72ef87831bd9046f12a278dfed788998b703a785a3338
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a073eac67c119d37b08fadfae89ffc0bb0c1e5971efd4b0e025ceaca294f4a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5c5883d2c356b727d13e04f99cc3822cf397cb0ac33bd399a94709439815e7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d688d6635207234fd4d8e8f05c71861bc721ab284b91a6663eb8b2c21c61fce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4460fd5824125c4231cdb3adc62c651a98b3ff202bab2393f4cfa44784a4be80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 052e3b52b5131cf3144a3f735c0158def83a9b4a340275d90f96a86e756b011b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ffeea8771fa93e55e07f29b5165a633dfd317a25a79d598890edd29f62bdf0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8415da644ec27a939d10350421ebef970ca4937122d94b92c579be79b0440e9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57aec9d3a22469bc382f41a9911bd67c003dacf16c4b2f5858f4e9a9c3a9be9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b535676041880e7f4069ace80ed2191416d2ef8093c783bc1e8e546309b114a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db69a63f2452df6b13eed17d0980b934e0159733849fea88e3abe3151825b1c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c2c741a637e229b6e75034788292bf3365fc0b962001207a98ca651622a658d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93dda629d28d0c7c14fcb9f7c7628a004af2f12db7e6b6da8c3e1194866a6a3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e4b214737ec9fd2611b0c323e83a05c440d5f9eb505b530d26ec96051368141
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed0060cf3781192ac780544c31b9a603fd19cbda3d80f04cf50b140d4bc95a5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02f4d597b8a6e6fc85326ac394c1a9f991a77dba038ed3d780576bc2ab851152
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b9a1103eec4b42f7ff436de3b99a75df6b1426a6bc59be4f0416ae97095af2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0c2197f7127e2e1208dcf2d4d023e082d0a615b559dc991c80857d118f539db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad3e76e062cce9c01961482de647c646ab165ca59da9bb15f957a03cdb855c05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6141a645adb502ede0009f605fadbeab83d4a043f53d341f9d8f2eca63620b4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f5acb1a2b2394fea12b41cf409948f82de348c4b84951cefd8a5dc19a698853
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51f672a3f3ac949b073f4983c4f08a3ccfa037e235382371531871fc4997bcdb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7937a97824c5fa10f0ae15a9c453f7309bfd313c5c71d838ef9e0398124d10c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9083054d3e07d4d91ae73f7c774732e7277e8cdadd98120274854a874f14795b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d445b13fe664808506040bc7387f4a75c750dedf9276ae63ca99736f0fc7605b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3f49990fc5740e5b5b0e7a580ddf04a862556897f7a221d375ba8681ff31664
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eea111ba4ce957030c8d24d4799b0d54e69876a18272d58095a960a3c10054b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30cae93995ad1b9415eff81f81d3be63c23940834f13f2e8e601be411acf0afd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa002584cf0332decc244b39dafe45310d09790a76fe83477466803358638105
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a15dd87bae22b15f6fcc97f072d054655139a51904426fb9d14bdd8d5275248
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b20715372de2b963213addfc351a4e2c64825d7306c4657213ea698bbc440845
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35c4ac1ebcff674db2aa3839cbb7a69edc4ffecb8b68bf1b82d4527af6c8755e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46abd8d9b74eac27ecbc55445bce37b08b0c159e353bc1756a645a59c0cccddf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6614ad463f0c9720761a9004fe63f508a62c7368a3fddfff72abb62915b6b6ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1dfa03d358259924a0aab320e47fddd85917dd85f65af60c27bcc32aea3b46f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c45e8bcec2c7c3225798000e2e255f5c2e36bd0ee48a35f0a491afb0e44a5cdb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 efc9b0bfcfb31caa77350b027506958b36e4c28c94093feae20ebcb15dd1209d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59a4a4feefe2dd8e3c414cf94e4f4c5177325f4c84d24476fb1190289de40ac3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 561dbb9b10dea43c71761ec20733c09795c3c3e2a743b173bb888e97c898e487
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6714bb60ca2e0b930213211fbf865f0c0ea8c740d4dbe552cb78c5ef98c0bcb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4a56bf87404c167529b61fcd805b1bb27995f666434d09385be4ce98b163c63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1988ce95ce7f8d582515c045d6526eda1c0d24abe991395dff71bac7f6975823
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e8d656c47b4fc163bcfd8485fc39603494bdf750707e9ca5e1c3dd2051eaa5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24af8219e09e70bb8a1da2e52b68ee559650ddcbfd6b8562c24b6e5b2b0316b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03e65b03116eca70cbed32d8b0d7de18deb05c8aa007ec39d6bb6a224d7fda4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8aa5d40950b1720ff92ea03740c396f59b61532ab2398f5af53577f0f738046
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac53cd47cdd511114c730744b8057e68a1dd10246bbeb4de6979966c1fe6a7e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4272d1a70c8b8d54fc235dd871177beff3e93c321f1fc3b571dcb3e552e7c6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bdb64b65cb85995c2cf773eff9d30b2db8bf7c1996e0176008aef96045863405
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b52755c613f3dbea38d8e6814030edb615031b2b0df19369f3c99231cc941f94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0e574f591087a7525906550d935615713db92dcca8f200f63b70f318b741443
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d960ac4119b7ad96751f1b00ecf9ef7aaaff59d7f06a8648298ce31e1790e0f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d51001efd4e5f4f42e615eb409c70df3571dffb9a528e0d7f7a3f47144e6a46
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d1114c02bd3c886828d21d97081c387bdfc766efbba802b9056f27f26b6aab0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39c254ec93b599fea9803c590bcf87e62b8ff678fcd9ba82a5ae01743c1055f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f43fcd4222368f32c0508005b8876d49b27b8708c48f33f5c71ab0ff369bedfc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0cf0fd713ab30beab47fd96aaa801ab98b8ba27773e73dc7e36f4e9e0c040fec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d466125383257e6ea671ab457187628802324e5751562db77a844af76639e58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7920d820c59b87ed4634e9004bbfa380b085e694f3ac236294cf9b33d8c3fd20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db628ec1a55aef8f235e6e6866b34216f5cf9ac18729b267accebd17a38a759b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c16d54c90321c993c9b663553cdb039b0345694e621d8213388149dbf4f7b0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa8c208b4c035eb7eb7c6529b374afabd7b776c75c7a1ffc6eef9f536969dbde
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00c3ba5ff920ccd109b9cbd98f4c0454b051967c88614af8de77f6a8858c89cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20cc9edc5ce212116322f2d27171fc72106fe4f912dbfde9899e03dc082480a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fe47c97bf874238de23f73b6139296e12ede4742609c1cd7339efbb518ea313
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 604189ad0c7fe089dcd6e65090738b7eb9638b770b98f48f9fa8858b5162982c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bc80a1229490c7ef254fc25ee8fe36b3f79df54edc84822b9af72454d9e967e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f543c67ec34e9432cf148958993e263349517a1872c62698fd5a54e8b43be08c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3db1b6f44415b387c45d690ed943ca11a72c8f4dee3cc4ae5b0237382a6e311e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d13b1ea0f129fd0c699ca9eb36018dbd1719c0af138c96634533eec904ae51fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44d25e48da8b348011d1a50ebb55f8b8a9f441598388d65cd4cb8d02fcd49886
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6346be855e6c2dd7e65c774e667b881b8ceb92b45a92c320a7fd33cc9fb2f83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf2a8b8cd3777d6f00e050e56c334920818bb27fa3f33adb9063c1dc57cf0624
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a8fadf9036612e4c2d8186bb9e85438395384bc40f6164aa3cd2f14e8e2676e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e4acf55c412afcad83085b8e6de628d602c34df794cf81a6b19698838841889
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 873afdcc7c1ebb9a3e7be7b8ef8a3396eec202c0f4885a9e8c97cfcb7f0f7b5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40cf30d592ced5da61d5eb4ce3af69f311bdd845a19770e6e5452422829a0ed4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd60ade0597d04130b33109005eadb653262d244a0178fbc071062cf8e6c6e47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d96aa580e0ef3e6ba95f0299abc5a2f84d3ceecffe4c92aecab95751b2b38a06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31c62edab6e7f497e7f2f113b188cfdde3fbffb58871c79e7c7b85c95ea503fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0e30905a1c9ef667f1571cb6e3276fdbcaf843659bfad2d9ccb3640a522c8d5
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path \??\c:\dir\install\install\server.exe
            • Size 472KB
            • SHA256 651ccc039eec856d5c40659a7ba0835d47c0527024337eac9690d79af2114298
            • MD5 SHA1 SHA512 SSDEEP

            memory/224-1833-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/224-11-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

            memory/224-12-0x00000000010B0000-0x00000000010B1000-memory.dmp

            memory/224-679-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/2612-0-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/2612-1352-0x0000000000400000-0x00000000004AD000-memory.dmp

            memory/2612-4-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/5932-1353-0x00000000104D0000-0x000000001052C000-memory.dmp

            memory/5932-2512-0x00000000104D0000-0x000000001052C000-memory.dmp

            memory/8120-1376-0x0000000000400000-0x00000000004AD000-memory.dmp