Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 05:56

General

  • Target
    6663b123f4352c2c466af5cef94f14fc_JaffaCakes118.exe
  • Size 290KB
  • Sample240723-gnb5cs1eqq
  • SHA256 9512a35900c3d1ae7c9147634389510717105db457e30408d85ab5b39fcd70f7
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    system32

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3500
      • C:\Users\Admin\AppData\Local\Temp\6663b123f4352c2c466af5cef94f14fc_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\6663b123f4352c2c466af5cef94f14fc_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:864
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          PID:4428
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Deletes itself
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:5080
          • C:\Windows\SysWOW64\system32\server.exe
            "C:\Windows\system32\system32\server.exe"
            4⤵
            • Executes dropped EXE
            PID:2780
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 564
              5⤵
              • Program crash
              PID:2976
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2780 -ip 2780
      1⤵
        PID:2176

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 58ed6eb0235b0554f831eb1c6b63f5629d91e28f61292efa9f50671b6a205969
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 21dca978ac85509bd66a664040b17a1d588d7cdfba9f88b0942d16c7906ac8cc
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a614eafce9f49915d08d661e8dc3b70a8136abfc047195f0ca8edb3a185bbc74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8dcafa08919c9b102fa35d44bba69b586bef3789b8c5203225266ef68c775e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 318056c8cf98b2092225864083fb85393d6e3970afd77fcbf6373196e2ff6b79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b864a85ecff8f429e321ed64e9cd088f94d244e05e318bcca393cd15e26b1c92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98dc7e9b7dcb2f4cea3100c6430c8a1cc4c46320f48c636758bac6da6ac84dd4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fddf87782b1241fc0b5b1289be35166250adf7a0465d5716eb3bb8d2ecbe02c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7160fe250593ebe6464815e2ac1ac2a850320b47a44a1edef619cc23eb44f06c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a269ec9e157e3b1570e1e3b5b6a9e1613d486af3fac2a3306d6e38b5342474f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2560808c4ae80a76687789509708391d2109ecea91f45adb12496c32b1687c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c53b4bf53976bd1027bc51c4df48af594746e1195c171a6cdf5ff86508027d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31ab17f429027ce16bb08f963fc263582bcf5a25a2bceb9d96593b97d0f00407
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a9df684b59e13f818790b4cfd243d69c70b0f6605d8a84f4e6b3778c9925978
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 019689edae1191c403c8027ab95165a91694ee185764d40a91197fbb8f447358
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d83efd4f0297a17916bae85a991c3bbd00c56c465f3f548776619decb1325a23
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83451c2e209bcfe92aaac1be8de70b8ba9b542e56f7bd8639587fb45e8552e0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc946b12cb784977715e0835749ca5d65136ba41b22d05bab9e3e0497bf20beb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dfaf6b31dfcf8f77b96c564e930c1ee48f31db2105b591757782c0bf73ff49dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3864b75de72e164bb4a9cddb232117c9161b06d33dcab8e243220a21ef24c745
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8284f7bfe6c524cda79f5240c53f7441e942ed286826268c188756a59862de8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1ed64b6a0a06ee19a74a25647591d47d014d3e8b2adcd001898461d58ad9648
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1cd3faa571f9b01884056b40194a4af262bf2ffbb8402e2b032c2d5f3447329f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45ada93a2418f6808fe4de2105e013f195206cbf2152b60a1dfaab155c65b5f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a40e7878e22e122dafe9c75bf10972ba0032866889dae771233c63b1087ee101
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6826806e7a2a169d892ca1d17f124ffe528da78bdf7fc22e081fd0c11c7d436
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b09212dc068ea9f0b274d1755386f3c4415d7f4bb24172840237a66195883b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c485eb096234ff8433e28398007accfeea03170d2b1f5047c58ab5129de1f326
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04ffa6ea666fbbe2cf27f1d133614775dc5c1fdcffce673e12362e9066748b48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30e55af82add2b3afc35e30801fb546bcb918af5cec98fbcf2bd9aef6a2647ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afb1bed15cc0eea4c2d516f22667a39cbce66880c0507e0bb964fae80c23dd1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0eb593de0c05f064d2db762d7c79b2c556f5704f22164f01b5469429a46a2911
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce83fc71dc19f28c4b5d9841a7d5e8dda3db7b5378079ce34879364f1a6b6da7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0479bc8dc2a0098b04d44ba9094eabfb144a4aa8f1fb8ac08f6e2cd646587991
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b789305e1ea69126f397f02a896f77e88513b4724c24e299cc689cddae56f213
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a814ce25862c6c234419af72d465a6165042e1f5277e4054b7978839e15cf6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39e6ec80eed7aef3247b8a5568e2364bebf9078f9bb1fe9328312455b3f9ccd8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab9937c0e13cd219fdd0e8e3009e634292121ce6605958985f1205ed5c536129
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e9f16ff9a99703444cae45c029f2a371f4d2dd51a319eb788fcfe141f1abed4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2a39dd96911d0fe191ec1565b4cf95590f9b1d5b24f2255857f019ad1c8d1fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9340f8772e9ec04b09e7569316b05ef4a9bdabffc453d0524ff4415ded5da202
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49d3687cac4059d686e3ab6bbe27bb35b95e7ab22cad630c2628508b81669d0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7949ff1c01e5c37779b45cf15dd5250069524565f30de6b1e259af8d8fadb439
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f68b4390d8b9d3c08568fb2a50c52b5950697fa59096b075094211ffcd3f82f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0592d60dd89f6d63d3c778a5a758a6339a316ba27d658e02bcf931220278be3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86d6af730c10954e78839210e6521b3fea11881ad944763cbb57488a9c3a52b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b74e195b2b3571823eff3da71b596e53453fa78ee78fccf7b58107b4b0d79dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0caca68a19c66a4cfcf8cb9dd4174a8da12d300146a0f0d7ef7e5a6e0b4ed682
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5eddde84ca1696e209a6889233879ccdf0254fdb39351d96c82d190f74355c00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c306592b684b3357362aae9efd6eca58ac2f880a42dd4b4c9f7e2302a6a6915a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 528c5970492cc20697a954c3129de6971c4a4612e5d6f170042e9b994de6196a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3fdd9ea9675c146c0b0b7c4beb7a4e2ba25253b7bcdfef17851127f51b64797
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c86a75dbc0bc67c9a42f90fe49f0fd8e379d4a05707fa2d6e4767230946552f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09665d725213395c355db8c5be0e8d045e620cadfc8f01c06a38669d3a6e67e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc2c872d12d7e71c92841d373a263df1f18579a1dd76e74a4c62154e077acc09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb6627974e4a1250a2bdb6ebe5ec2f82c354370a9d9f3f4a7c1d26222dbc138f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c13a143227a8de74bd8283bc15e822639dd8ae968053fc94eaa8ac73ac45fa3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 692c069c8b61ce1710b7bd33f41502e0db530e57101f0fdb40d54455d2164240
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8041a259c30588b836443136e65265d9d3498888002eb145a3c904fa5a1bfcc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2936ebeea36a493a3d718b33f1a393c4f3ae09d7b9cb9721130e889d22dfc774
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fc89a70a7a293ebf5b7c39afaba5c5c48dec557e04074cd337e43f9296ad13b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 322bc357169f04be49c36917cdb3af1c9f6713219403c3baf810f83e5079d780
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c263ad27a08d167ad9efa7f515829c82f32df63d4f419afc6a34218525d6bc1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b69fc35c182db8b543e3e682b893912563f9a87e97063fdc8c7f257c03234115
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f3bebf4e838561130b22b88d40e5e0bffa97158a6e48268795071cc5f92d2ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 877018305c8fe7498671f863ace3d2e54263c276009cea4d25d53fc294c7dd1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14941dcaf0ca8694d039b2d9e7c1fd92e07fd8378996c01f181cb797f9b59639
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 066aaf4128101a10fdd61864d87063d2d0a260d385dbd132c0114c833c986252
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a3e5da38f7b12432103dbc3de545983dec0da36964d4e222e37b74ba1e693fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc214e47f0d5d5e31d429771489ede57bd81ca8087ea7c521137a82053230f1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92dc7f889b6d69bcf0cf155e1b8a8cf0a14d6b3c43469485302207b9dd09895c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4f56b968a0f2d856bd4445ed897a743eb9725e6a3be1f0755710bb1ddbeceae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5b6dbff4191849c75df14077ffd086e2c97b91a6641a860eeb4e6137ad26f0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57ec9588e179ba5ca75a48e5e21774d2c7f37ee5dd5da3cbadd37f70de686242
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85cda01761748b479e23c95386ffbeb53a943f4b3f9f35b2b7ad35a3ea24c1ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 496236e648403d7154cc0233b773c7459ac4a3c095ccd52026be394918d7a704
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 709746c8538b08852893f5e0fe1246c62a9f7d378d39d15f9dece618b4f30987
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3a28b0ab646bfebe6b0f1cb7ab7b81a6c8cd577987000d6797f38afae9dcb85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b44afcff4eaa9beec0031d552c5cd3a9067c92404bf0ad5d0210a76beee6e73e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a20302a6108732ee1a4c1111256b2e11205c250af6b0cfb173ccf1fd34ae4d63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5774693063461c3cb15edb23e924f30c389c5153c09b91dc1aa34f49340896c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 accab860e784db537540888fea226d715badb703efa9e456b465638c2e8a15e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 720b3039a2d41fca41891f8285c4895bdc1de8ce683edc6d8c6cc87ec207fdcc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed435ff46134801843e9e01a64078db2fb26b7b47c8061e58f323e6167fceda3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13f8a9251a1c39f6e1233512487a263facef40ab0c4c57ed2e5d7bc23bea229e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 922db6dff7778bf75dbe3fa7af0b6536aafe8fcab272a98636c02a27980cdb40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3e00895cb40a9a6dc366cf545738c80351a0be228e4f7552645a472e2cf4959
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea2bc28e746502e25b18593f935ab6653c00837f6d0120d4b3844e3987741056
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5aabf83da4c8a5ae0252cedce3cf1d67f49699b38c7c408cf7ef7139121afc06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a1c2a4befeab7eb057a4a73103c4c422ca22936fc22d4e1db9ab127a7653562
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 309aded05467b33328cade5daeab155a73b6bb135e3510046ebca098d410ca9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c287bbb63a80e2385edd2753089821217c83f004a4d3a859d40be93c0396eeb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71de3b6276e47495f002321759bb75573556950fd1d1571e6d793a38cd0931b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bf0d74fa60177e09ed4071b74c296086ace88e9ca59cc054624d56a8e279fba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca60a994860fac3121f85f5a395102feed3720c8a2ad40954c0a9df5fd47a1c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dfeabfbddca68fe83d09bdb58a26bfcb3e09b121e4cdf47b0fa0afe950d55ec9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f8cc54f09371fcc946a027e537a18d683920361cc28e78099430e8dbb4a9017
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45d64650dec0bc5e216bae225b94b1e46ab7272786149f6d6cde2b69cf860fa0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fd3042c38e09db90d1b7d1b59ff8441577310754e6a9d4e3e9ae2bc5668aff1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8cdba96f2c40baeaf2b9b362068eccfdeb4bb657db75bff2bfd17b3c1b22141
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 521b16b7a2c539bbe46e813d7524f129c0026990f52544a1fdce125c61893781
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f8cf3621654ab31280b337f02295361fdb1a95315fbec2e2f08041f7b4e0c07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7db88cf30fbe272433b01f7b5bd7566b4259ba07933c0b71733d1d2b0ec9f2cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1abd5a1055b71c5dbcdbe745b1943bebd98b1866a6ef5696df6c43504078098
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83ff73c4b23d7549cdfc9d2a9c8debe3694f277a3d9b6634f281c75da1a80ac1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 226f24a0d7d5d5f16249b6bb753e65fa69a006fee14686e7062a43361b97e346
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64eafee97d8341edf000954c0fb4ea6439ceedab055ab9b5f1257f8e35c3bd6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f66a73f4a48a3efc8949141368e5bd10d0b174fc65b8e7762795a3e03ce8c747
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e08015f6bf31a10f7880c3f91c87d55c40f12bba0abf7317fa07ecace8e0a3cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7c70ee7f1873531ce0eed00a508fa37dbc972ae7fc16065d6a37b9c9ac4340a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dbf96dcb02b41c4c9e5748052d4384d1d4f498d596c517653cddca9b3fcaccf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7c4c2e3d47dbcba5d4d388b30889ec2dad836ad39958d1fe0f63720370d4190
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d491b5440147f26dc08c07d67fc8239677e99961d6c182650b8639589c1f51ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22564cfd9cc17bd406146b900b35b43da7be6e860fcee17c53aa14d7c9e24ef7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc1a07b11e8aad66b6ae34218d8296ab454d337f92daae25f470a07ce30ca963
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65b72a777e081a0b04b6af469f34c8ae23e6d374abefc87fe00553bbc1bc8ae3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11fa4453eed995289df79e002ba9a75c5779758a6d63acfa312430d522ef1161
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef86426133c61640ebd858f5613427e5e667e3b4de15ed5c59b6787c8f1592d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33b2d519fbe9e53ab25c59d8c32f6dd8395eace0858355bf8a3b51244f48f47f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c879f88f87efd43e370809ea63d862b84bbe2879b1e5149abe5f79c7f332cef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43a196e42d9b8ef49039636960cd773aa8be00678f8f4286a6d4e83b3e01528a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a09fc85eb270b1f7f775d3112c0e8c77305a788056c63c4e19c0b00dbbc9e80c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 871ea95ca4b46be91021b4f82e2c753a42f7433287fcc9331cf1c3c81fd48be2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cdd1e10bc0514f7f084d8646d35ebf078d8a01358ef758bcbbb635c120a78cb2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81f0e00eee97cce52b1ac7436dd5b65461ec6637ad46bbe305aa6b9534d6a4d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bba7e3d6ddccfda64e011c078be7a4b6ffe1e6bb1d1a8fd79b26396c709e8b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ab61da1bc4568672e6111ab5628dd9c6e61c3a1b33043be767db4ed8a37d264
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cbc9a164d94028b5e24e296ace4e9fe0d322d8151601769f3af63af026523f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9552644697d022aa4f5ab717aa3bfe83ddfc0dbbea264d15311bc8f04bb4e8a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28b4dffb38a9ca941e1807ff49a26a96b6d636061dd4548fc653ed7264d679fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9971c81070c047db2ba69c60239f3e3677e8708307231f4b05126a9c83ee1dce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8b5a579c70a73dc60dafd49ebc650f3e05f35c9ddfc18c03c9107c5bb4c421c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffbc59658c422a7164310639bb4af606b057ab4489741e5081572974894df881
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 921295dde8f5ab7c36f7da5203f630b46990a6b22b6cd8856693bf62470dd1d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c7649477a1bcd54a6479c64f497b0a9e710c153f1d65482f17e81b41379f1b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be7b052488c1d790477957259186580e31c2f2bbe85d4bc72d67b1f840460957
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46135057babc8a5163c604ee3d9672b6e1873568d5f7be34666aae6bdfd38f61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dca9825056386fcbcebc9e77eff67157439223fc8bf7fc53c7e668b725663b88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f02b338cd9aafb5ec1b1e830f228a80a35f9f61deed08aa6b2e798f8fceec08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 124f594e3d82c9f6fdac2d2c4d9f4b80956e8e65072671fca715cd387ccc1cd3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d38c77bc71433b0dbddca8b97a4a40f0767195a411576424f660cbea6e916ba
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\system32\server.exe
            • Size 290KB
            • SHA256 9512a35900c3d1ae7c9147634389510717105db457e30408d85ab5b39fcd70f7
            • MD5 SHA1 SHA512 SSDEEP

            memory/864-63-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/864-3-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/864-6-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/864-2-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4428-787-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4428-68-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4428-66-0x0000000003450000-0x0000000003451000-memory.dmp

            memory/4428-7-0x0000000000920000-0x0000000000921000-memory.dmp

            memory/4428-8-0x00000000009E0000-0x00000000009E1000-memory.dmp

            memory/5080-134-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/5080-1466-0x00000000240F0000-0x0000000024152000-memory.dmp