Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 19:25

General

  • Target
    647c2ef7c5de3e4fa5b138853d2e26e1_JaffaCakes118.exe
  • Size 472KB
  • Sample240722-x47tzathpm
  • SHA256 ae25d0bb3cbf9443ac5c2dd9dfdaed3e26f62e1c7124f1c7a6e4742cb0e69cee
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:82

  • amido.no-ip.nfo:82

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3548
      • C:\Users\Admin\AppData\Local\Temp\647c2ef7c5de3e4fa5b138853d2e26e1_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\647c2ef7c5de3e4fa5b138853d2e26e1_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4456
        • C:\Users\Admin\AppData\Local\Temp\647c2ef7c5de3e4fa5b138853d2e26e1_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\647c2ef7c5de3e4fa5b138853d2e26e1_JaffaCakes118.exe"
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1112
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            PID:2068
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:1456
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\system32\install\server.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              PID:4712
              • C:\Windows\SysWOW64\install\server.exe
                "C:\Windows\SysWOW64\install\server.exe"
                6⤵
                • Executes dropped EXE
                PID:1376
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 576
                  7⤵
                  • Program crash
                  PID:452
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1376 -ip 1376
      1⤵
        PID:976

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 ed8c7293acff81b7e7564a7460c89d8b2435f062da995a3eedd49284d1c360e4
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 494f98556b2129d9bd382196e0f828d14a1cb8239774f672c0cba8483eb49c48
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d7587d0f8063250f7007ea421e6774246f7f40e3531963583fa5d2966d58159b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8dced1dd5cbe7892b3927ef1c4d1fd238741fec341b2835788a5c2540a6f166
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79bc93bc4a867957cea90234030825e454ddd32f333acd5d8eae20d273127864
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c9cde8710a2a0cddfe142f3649f2083be3d5ceaedc1aed32368b03d21a52713
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03f83a44ac74aa33d463d03fb1720935e6c2cdfb58c374cbbeb7f8af08a9c5a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb72fac6bd5910c5474e749e682e1ede844441b5d1d42ea2ce992280533406f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45744762620631b27991263efeda39da2730ea574c6cfa041e7e448789b2950d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d23061903255f30f32981d4e7bcd3ce90ce68a044f4efbeb1f11e13938fac7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e2e2dfa7c5ae1c4176d1e8ee9d0fc4718e089bd637c334b08304abb3d7630d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50765c3cae2e3a5ba720c0f0e2ae7d527df8544a332b6852027e2022058204d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70db68e5b784d0e53e6bc2b703e140d5a8747d563737a5e03733185ba53a5df6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0f9cb67ce555aef9dec9a2cab55c70ea7b87e2138bffbf23bdeea83cd0811c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 620cb103ef275c6b791e835f9863eb690fbe19543dd16e29c8c70fade696f965
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78da2a1e3a83760a25ec6732e09886e8af1c4601b5c30bddfb5007624531228f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d68432f2ea52b39b7ff1673c68aa56410287ce08441d2dd9f1964b0c0c9a835e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6d4663c96bf24fedb8ea4c01357635c9e4e1074146c3e87f52893046c2e87ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0686e284de557dd269ac205e747ac3b1d38c11680d45bae04e7fea43d4adfc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85a21347c0f6b2b9d44708502c20697485d6be4a52ca0cda88e0cf593d7eb996
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16bebfb3c88c36956bb476c5a19160cf479eb77f0c85ca608cf2da4a03d36d8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 747fadf9c8f3f9d2b8a59ff32ba64fff794c63d5e756865aeace6542b0938e21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb3f048353af4b1ea18f6a27a436ebe239bb9c948d91867dff1121c819a83384
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 148a2c746e1973a7c7241b16b572bd6935edb70141ab4d171f0613ebb2cd0a97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e32862b97f4d0aedf40d4cb1b418bfadb40c171380dd15f32a73b5d671a43d4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1dff751f0293ea46c2020f23930759e5474de45bbdf469b269a14721a8fc238
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d0abf1777b40fd11b97089cf8350d738436d63acd64cfbfa1cb4719f562fb2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f5b07d233134049169eff5b7b6ea3ef8b7553c3932b5c47d2c8a6acbd630004
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99d2fa3bc7e79a4be9e964d6be6086264408f2ec70cb326b84a648c78c67d383
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95432643d1d139c739e04dfd98ebb034c71a541999b542a356d51e8d3c425955
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08c4a66efdf1556d26a411e4eed9d60e6ad06daec2e856661fff6181b91048c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71c37c6bf6857ff6822f39f2030e1e4e467ee325abc2e97e8303a39485a9aa8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0eb203a4b9f6e10f6446ec0533946e7ffa59e5e22f531a4336de90c2bc73171e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c18fa33b46bfdb8ba5b89fddda06e4126b1af42a73dd5a45f68f3c5d2326007b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a06644f7463e530093ed786a8c7f7b91b082ff5d5dd1eaa77a823881f6972ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc6bb007692d5e0399fe5f5441bc8330c67116f394289e0de880795fb8f85e5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e87145ebc40d100d80f05dabe5d865b94504634f35fc765565f375927ce215b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 922ae95d2d0e154fb48190b6a26255cb95c6f9e622d046fdb44f7c1bf27b6bbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8c0356319023a4fe1720370433a0fe0f5e815a012cd2b92f59199b7cde365f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fb2493221ab6730222bc64133a40e680c15e65e9e3bef101478f36f060bb32c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2282296feae131c4675566423769619dd5370139286649539247c9b9fe632725
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 351f534f1a47dd235f4ef4b6f403579fded42c658a091b24989e00f3b9f4231b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b91a9792c9f1dceee80fa37d19d81ca288c0ad203575e50bcd82c6ffedcc2c35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c78104d3b564e55a6458cd1ebbc4c360d4fcc86df663e99bbed96f75eb9c201
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da1c8dfed8952aec8ab67c985a27f278820366d4f4722614237f1ee1e352d421
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7cae3b835d867226963d9a2ae68dce3d78d1249fb0b680be9a65de0455be871
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 213b0b3ecb3b8cd8cc4403c685ef6910276f54e3d9008cf9792af5f10b176453
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 195bcb84b82c86d6858f8dfb077b346d03ed76876d0391dbe69abe036a17f066
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0cecd522752394f1e99d82e21d6e1713a727e971f2893183037657be8f783254
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf76cd015d309955daca057d9ee9c4335b8f7bf41b71ecb5a91722716f229b91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2efa0cfc9b74a779bae8bf8c3968f5833f41ccad594fec4618f604e68988c038
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eca0a43c1dec5e42f0f7f3fd30a7d05fd8b4d693714ab7f211c0a59dd6223389
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16329ca739c90779ffed58d804dabe665d4da0d49a813c60280335ece5eabf36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 468466d6d944fa88464dd7e4d85a6817421a7757f13ba0d7acaf50ffc3615c05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ae71ed257f39e4f240a020c3b2152e2fe9fdf14ca260c7edc781e56d316006a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37717362cc163a5a1cb3c8b0c7771fd73998ab61a3e6707dd6489104a1b110ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8275a2acf2b625e19222fdb57036a6bc8291991e6cd35c27f036980201e70b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b492e332c380c1c34fca36552a4393feb0e539952188669688e838fd3c527266
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1f1581f6510657d94a2fbc9afcc49d74c0e752392aa589746596c28316c3cc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edab68454acb2217e73493b22d88efd70413e9cf7249a0308cb03aacc6933ba5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7bbe4352751961e8d7dc7286cdb3d26fe8f08a85a858ac2f7a8e26741aafd3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8e19848c37ba5caa9b3cec830c94bcfdaefa83a5b3196d4b7fbf1b364c96d87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1cf43c5833d897b2557d31baa91afc31c23feaf99abceae0e749e75a0672b204
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99623c29c5f4f7b3eba11f77ba1ecf4c73a07b9ceb46881161507b5b2068262e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fb33c9d95b62482457afcf61dcff2d1f5219f38ca8d3e0bef8ee0bc31cea07f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adc4d07f47c7f7305ae911ed94e9a2ab44657df00b574fa59a4f621c6a6b6d43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fb751e3391a6cc6c7dea38e6c70c0a05e4f6fa01e04e559b1e5461bfbf01e32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e99882390ceb17314e05f784357cfedc5dce861036073a4a980cbc4c7af94127
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbd9e1c59bccb7106acc72672ecddd13076ecb248cca003b85bbc1c36feefa39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef6327d7f803231192381359e2594a76e5b039b4521c5fb12e31142e1a54b791
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18662fe25844076032072fd942cf6ef55dcdcd2ebc2fc599248743a17c06bd4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0a9b1f2883a225b74ad24e36dbd668799860e8ab1de01aec116989a7ccc3333
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06b489e1d087774ce8c44a40aad6fadaf79399f80a4b29ef41653da202f78e96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ea6d9eb7d45913ee56ea136ff6a1eb80d6a16cca56778da70de02ab201b8bcf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac8c7f66ba48d9455f29c8ba85d6bb2b0d124e3081194a2e660dd80488b758fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 faabb5cd956e581a35bd8279e5678f465d097a7c4a0a2f5dfd66b04c6b33bf6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ece2c8a93291cba9ea044f91fd861a87d033578b97def7e063ebeb77e9a79430
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58fbb67115235a3ed49a7959081c446ba14420420a6b38412e336bff9ce7d402
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b399be93eef0dce9897bba36acde42c138233d96ca8107e386a66862c5b60174
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c5054cd95ef2eebc62dbe29260943197b349a941982bf166717f964a86e4b18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98eb37ed20db2bdb3788a46ce78cdb8b9614f3bc0045d48eb1b01389aa45c180
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fb473bd803b731e9e02c294e4d4665cb8ee40dbffa39f28a72448eecf723821
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23d16346b0f0a397f81b1aa68c3f089df5b01633d58a7f6bd9fddecd24eab55d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c587c54f8f64daba6c027476ead33adb0e3304ee76d16ec6bef48b31f858361
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d698d35fb2f9c0cea850c2b1110c2816bf2dd08ff436e1e033e01c8eae8c0c88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44b37dbfef9a7d568f04138609f6e7c83c4b1114b8e3b671684e2dbe3eca8880
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0577190973c0ea893e8b92a331124590105a57d5efbdc419b9485b75d47b4230
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f006b575d846404cf97cda6d51e5cca79c27c385de981ccdb9ded151fa561fab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92ac8ab1a50e629c4bb7aa3dd4ffbcdb997e8f6401ba99e35fd282de67f8af99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9a9a008ba9d788e0dcf268f0487380898f6cdfeef36b1dc5ed104d0d8813e05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8311d6e117ec36c9bde8f94178182430b450594c687a70deb1ca2fa7fa7a6ef7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da07da7131b5b03767e00c0e077906d480741f4b49d81316af8064a04da03325
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d841f8ac5ef7458ab9d933ee4633f925e1a0c8bb2f5c9b49d981c8953e442723
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e053c9062a6434d848cd8e064bd807e5ccaad9090eb6e80bec0bf4fa4f6fb4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edbef097486c63c7510163b06333bfafdfb6395c96812def5095b7318702de98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e5d088799603d5ce3d236ae62ffd014dc3692a185931742c5270dd945879053
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d323f0501a90ec9e95fd52226b465fb718c1e94f394eeeb22d21dbe874d07878
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4041d763ec7dc5f235ff03658019e3b152a45ab7f7a3b617e04a694ce1d165b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5adbb49c70791cf65fdd95333df6ee99466c1fea660de836db7fc86784c96960
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09626650fb7bf0a7575d07c37652cad6a799f56e3b2ebeca705f8ab0eadf7817
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c38dd45fa241d053b658c989a09809e02d39f35c8e82cfec6d0012e4396b4672
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3582e9b5044ed23321a4f81e97805c6a6df7456625bbefe10090f9d85a99679b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6fbfca9f44b65ad8c580298ba29c0fd2f903d9dc5f812cdbf76ae120b099404
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4edd1cd151b1fc337a8f2e72d655f8fd8352fe8dc0eb6652935345ff05107fce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9d84961042e736efaeed1f08e432a5c07c7448c2fd152395a4e1b7d00829b30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2200a3d43eeec81fd0a78a2b4cce146be7dc5b54daa0c778555ea6733724d846
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44dbab72142c1362fe8f0d347bd20417a4eae2815efff83aba00012c56187983
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cdacd288cf3bc1c80d2c56f1c443e7ba4261d3b5324d86ec0b31369651596712
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47d6dd83a4499522b9406b1f3206b56869e778a034564c8c79511a13dc34864b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 107f767d5602635dd2e0b0120592f5f0eecbf5c1b4e9ab5f8ca1f20c117c4736
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9639d7bf626a9e9258b2e1e232f2fe3c6d119b65418e73c158180626f3bab2e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1562dd9ffb12f3bd861744e5782c0af736417d17f9dd990746f8b84bb10a7175
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01d0b4a29f93b492b2383ad4e8bd01edc86c5fe1f4ac0ae7420f6de926db2867
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6babd0e332c962351084694228b253b447d1c3b310255092ecd9cad97f5e38d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8a63df8d4ba37c66206cb42e71959049913d751425c7d3da1ed51f482ae2500
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7272227dd795d554861005aa28ee5614912ed58199c9781b87ca9e98f4398c7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5efe04e4801ec7d1236895c49c7cd4bb7e9f005b5c5c879edf0019cd313b6058
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 129e516b1cf78ddbeb1e83ea18b648240ac0a87f7b52010f68ec1be34d20a823
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af193601f8d1bd8b5e8dc2d8d8720e484e5450dfc989253d94c37cef131e9a63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f543b70852fe9c6f7d245ad7b304dc52c0b53fb67d94ef9c9b3484cb6df45ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7068f96395117f1d52cf5b248400bd8c33977234e626801187edc089e85874fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee6e3b37c8136715d82d29875e8e97f2f73c212bc6c9b5dcf611e8227496c01c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81ffa2c0ba983a51f5324026bcca2e91f6647a089a1cb8b657ccad7d6ea7124f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2052bd22aebe9fdf7c4eb696348be8e4ed7a15e1540f39dae12777655b16f06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1591f8266ada44250e21d08b588ac49ab54ba597e88c2284923e756cce6f4ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d77995566d17c8b100bbd521246398590ef4144bddfee49b969eb0e61069975
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0188c5117978ac14994dddd0d3196950734e0b6473247f3111f4af1a23d2b0ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f686a6ce1456e9b6fd433bc454577eaa9a7fc30c79c22caa6d5f7e5afaca6c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c4dfc1c65c1a64641cc74d3bf1a434896cc5d1fcb820b086e8b4805f8a1259b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a9702809a73aa5a952ce6548a0c88ecd4e0654eac4bb9e6c445ae07081ec9da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2added2f1a427a344c4997a0f6c208513afbd586fc56594d7f9a1ef370834c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8166e6791e9f879b45a03eeb773a9c424feb95d1646dfad9c364c954119c7826
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e72737ed0e6f57fa6eb4ffc0704473fe61d6835f2118fb9189780581a5f1640e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 791086aecf80c2b66c6cb93d4ed492543f07341c5293c71b2a1cf1ab06abbcd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8cf5bf2cc4805ee99714846467bf8c583a6d26b471bf02450e53351e797dbc9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8eca788a0b2c0e9db05e4554194b314de71d117aff1fbed5e07a06ae55be69e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f667303c518b1633e0fd8d24602b6803255f87d94f808be66683a5609a64414
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d216c429578ebf20e6e68f32260bdaac0af6ff9d754168a5fcd7bb5c9c937a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b8501a4770beb2e995811927547366b435c178508fac9c1ceaa1d5463ecf95e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0bc4644137a8030dc15d956a5a4f98cdfe0754a96d2fe4cb03b690f658ea782
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 472KB
            • SHA256 ae25d0bb3cbf9443ac5c2dd9dfdaed3e26f62e1c7124f1c7a6e4742cb0e69cee
            • MD5 SHA1 SHA512 SSDEEP

            memory/1112-12-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1112-144-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1112-3-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1112-15-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1112-4-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1112-6-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1112-8-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1112-11-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1456-145-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/1456-1309-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/2068-630-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2068-17-0x0000000001080000-0x0000000001081000-memory.dmp

            memory/2068-16-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

            memory/2068-77-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4456-0-0x0000000000400000-0x0000000000562000-memory.dmp

            memory/4456-7-0x0000000000400000-0x0000000000562000-memory.dmp

            memory/4712-167-0x0000000000400000-0x0000000000562000-memory.dmp

            memory/4712-174-0x0000000000400000-0x0000000000562000-memory.dmp