Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/07/2024, 21:58

General

  • Target
    6cf030708ee5b9e5dc833cad994533d6_JaffaCakes118.exe
  • Size 398KB
  • Sample240724-1vnarazarn
  • SHA256 2495bfd25cc7816eda11e8f551d6521c4f919c38ca625362dbb4f36acb03140a
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:99

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6cf030708ee5b9e5dc833cad994533d6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6cf030708ee5b9e5dc833cad994533d6_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2464
    • C:\Users\Admin\AppData\Local\Temp\6cf030708ee5b9e5dc833cad994533d6_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\6cf030708ee5b9e5dc833cad994533d6_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4732
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:4384
        • C:\Users\Admin\AppData\Local\Temp\6cf030708ee5b9e5dc833cad994533d6_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\6cf030708ee5b9e5dc833cad994533d6_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:4172
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:4164
            • C:\dir\install\install\server.exe
              C:\dir\install\install\server.exe
              5⤵
              • Executes dropped EXE
              PID:1328
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 532
                6⤵
                • Program crash
                PID:2028
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1328 -ip 1328
      1⤵
        PID:3052

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 75aadef4c65e40ae40cde54de947b7491ec78e643293939e8d4bdb182185b8ea
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 ad9f49e60721249b48c3e6b1168c57dfb973efecc280fb6864dfe0d7c197605a
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1933b3aa47ccab2a733de603a26abc0c057e090c1275b98a49eb2b3c88eb189c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e67183d2cadf2d06f9fe3cf9518c63a3de9889f3c8699e6632d7295068599a32
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce43acfcbde258453e2522fc3ee997fb2d4cff3bda2d688584e09b216229aee8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15d3514df44cd5118e4983c0002b702ca9d9c47896930475a30aa1fbb78b65e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b00463909e7adf93080a4c03a279015b4cf1030214ee795c4f3f9120c5a6772b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b281d4ff49c287ff35271f23f1e49d72c914ce22ae6de56c6c1f43d66c42925
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c00328e56a6a9beeaa6d304159d53250323d746ae4dabfbe61de01fd03c2c5f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28101761f23199012aafab76f08b6610a71c11068cb4957f30d929c518b4288f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 910fb941f6aef46ecb7754d52a830f30d0c9ccf21cc18fe18c493cdc671c3753
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41aba385490c70a83a27f1dbe52a676c256643fa21be2c5d8cd3cc8441b29029
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e23da33b150019b01d42ce4107e272f4bd8fdbfbc142918dfd7093f9ba0d06fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6811115320ea47b37ca7412237875bd1521845357be185cdb0cf6bf37753cbe7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9d013ca1d6a77650624844739b7adbe3efbde52a7dfb06ebd9d58b3f683f3a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e25eeddb6f1c5352c7240d74de5be6bf86bc173c9317bff2c764ce25f21e110
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb0bc627d262c90f1b3c9bfff115d249ac1e1906fa1661b6170a8964a5c827ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c61f6e0b96c26578b69d05f9f297922e3eb92055810048b92f8bed2a645e16e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fad8dd62b469a432fac34a53659e878c8f1c3c3299f6c5a9af5fa4513a8e2d85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ddca14d3b2ea257d9b8987c687620c11e6b594dad14048bd989abaee18796a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 160bd932614ff0c96cc5ff5c6ceb12626351f098da71a41c3b1d24cb6cd3c28b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dfa3775694c8ea002589a81466a7e166634aedbbc8104109b5afb5501c95eb9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd1acaa11f065383b385661790b181fc120cba48986a7504341580c080c38134
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b301dbd62b0948a07cf5a0fe58123f210f74b5372a367c3dd32e669994661f22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a44729e52ca53eccaf9fd98e64cb588742874c420c66b93eda134e91633b316d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b1d337263866d5bd7c9645c996af68bd986428ece4e8ad47cec9575c76ca2cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d807bfefd8ca48f9ddee1cc02e203fe6c8cf0fcca89b7dfb6abd797e14a88270
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aee328f7f632e6de82b530556b36794c39896f6be6966ae4cf5d90628d5e386b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fda5a707fbbbe80780cb17bc133d4c633fd98d58dd42976115e656d7a912a4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 454a8552f5a77e01701b256032a5ddf20d45e5f3aaf45dc56ebfc1562b67a8fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97376507eceae2b8f2e871b69d27ca1bf477a76cb91b8232a0b1cf9645c5d879
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94e96f20bc7cc929dcbf166a9c8bc9b7f5fba08bf6fc50a00dbe16eca4a8a6c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef62c18c7cdbef94b2ed04deee5c1a181d088bc0eec2f00113d187ede01dbc0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c395cbe66db8b424df2db956b707aa0eb10ef4774922baeda515a4ccfbd59c4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 864e6f105ef9d993f666c66360477c0e00d94b0ffde7cef67330928ec17bb9ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84628b63eef5b0513149af390fc72ee9a46b90e593c564c1c91f552eacff0685
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3e14d9f91b64027f59bce32e3805b4413fd6c24c9835d0a53f985484f8e66bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79453746af8aa27356507325e017ca7df138c1d13d338c3514f45c08063a8edb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef3beba3e9d42c2a4e2a82c0ad58695df8be922f506f9570065c66a1a01f8a05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65f75c28f9b5c9e1d57dbe04b8619aebc41225836a73afc0e3668f803fddf1b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf0261554e8f497d5c9c98082d9243861672a0838e2bdac69f97468d89258823
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e28bae02e1dd2c80ce297660b8058f5dcc73812fa5a3d72e31a4ef71b6e48c11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a699b78df2f137a6585f3dedcbe455124f794e3b0f0aa44eaf7a164290ae8c17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c19c193ac052f96b935a13b6d465ee5dfa733f4d776fd5e4437c1b2a97743c5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b230b067df961126c8d88645c8b1e6062a18353071823ae125ba0357d031320
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e6e761f6e7fcb3fdc15965a9306ed396f3d0574e10364e5ea45bd8463e3cfa7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 210afc7588d67100c770932578386b07dc1857ada033fe211d9e34ac7c219f94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3ed829d50505e41d08f1cde8c3a4a50ecf3bbcd010bd97aff16f96761122770
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 608732defce2f0a96548480cfea0224c6361056871dbbcf5b14e20b5d6acf348
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1cea38e28d268356f6a06ddd3e4c45d193405edd00356820c6cd7854b2646ece
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 043b540669b3fa4fd843b261849c0ea11b617528b245a38431ad8ef48f9f20f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 579f4a5b3e32e7ac1d0bda8471e166f868899edb5aca8cf746c80d482f36cd87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1d89b4da0ae9d5034c754dee6ed689a1c87eac48643188a01396dd225410273
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53d3c81aed7fd5b8893b954388cca091d635898599579cf22c7e34616986d97e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a95159b2290d4c696c88b66be6ab63cd83c068900071e815f6b3e7f05f2a4244
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6aa4dbe4db9a2ca3b97d4b402716901ca1827bf312673c5d4b3ef3a3e220dd99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8eae590e7fcca7d73b18a7142db8e3bd0bbf71c941973fe48220aa7173f2623b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe7d455eec8522ff5dfb1d29051c49d00d554634a568c5bbac671b7273b6c6ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4bf7bf87e5b5b9910805cf6fd9e9f53c1cc005e4b4cabad463cbd601b011365
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f4079d917785d1c5ed912135cb4fb9f6ffddeeaec6030b258e84c81cd6613a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1adf63bdcc51d8140606079014c6dbbcebf794948e6f56f7b9fa8f1f28d37914
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d862ea34abef2ad973bec75ceb0ba6a8925a8ad606214e9af5732069360f0fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f5dd754e95c3ab84952e0a9677c40f90477cb99792d98a79726f16870919676
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af52363c3ac033a8c176f1b9e2c547c49dd9fb68e47dc6a4c6fc588632bc3ca0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3bb60b72461c342c1b98f9739f5e41d175ea860d99833c7562e6a80117970b29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffa3af7840b77323283626bd7b1098979e73ad440e977f4fc6b842c6cae512ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dedc3ca6ee299b73e769c3ade0f3255b0066df223d3bb1022f085644699185a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f4c2cfb72b6df6a9473e2ec8c6f04c016dd9c93b63fceb31950f7f61a72e040
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c449e6d9fd21d7779dad41b98a6b3e753c3349572c085392b0b5f005ec41ea0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33bc9fa722392a90e51691a4cc7714ce6e919e54a24fde549792798337c751de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5301b5970dc0a490bde2cf7b2003f0911d5e76c21cf273c8df5615d3f9f1f511
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3975a9966a8569b34ce58d3e4c6ca3e6e970d943cf41f930b80080e0cf39e805
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 753c3dbbb97c997a255379ed23547fc5e5734a6c209b38d5c17be00629d59082
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fbc809b16b7c0ad0d02bc1975cc08afbf6b673c8ce1923ae2040ac9ba012938
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42fbdfa5ad0434500819b4e18994e558ad519e73b45184632494f0df25c5c1bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6a52ced53c94250758b90b6da4a90fc0cded51c9045db718c4b3c3018c9b6e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 402a5359ece204e5f35b65363349ac640b43b47368f3bca44f5130b73dfc8e59
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4ca881b428ea978550e86445f4f1bc8c0f4bea5411062cd5829f07fb3d55916
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 014ddd98e7d84ebe3a91379c702f890f588df1cee874d1f7b8a201685b8ef706
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e29efef867e37c082959d95dfc291bdcc8571bc1906a7764796d1453cf6d5b58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25d0b63ec76b196af67c1b8021145f58aac26c5fb91aace9fb0395cd97ddc4e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ba17da189ff0580f49c7ff58cba3b174d65c5b531cc65e115f13a4a5533a888
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7bb1dca3783fb3c2b7ca59617b57aaa2b5b7334d33f195ad80ebb0bf316abfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4af0a124db76ece62c0d3d04eaa40be2ab665c2be8d469beb3e249b70c39be78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fef4943dbf08f3a0a46a9873dc6111d6c2e1569c6f6257d439a39d29d8606ffe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 422ec02185ef93d3aded7943635b48bc112366655366c405469883e69dab2918
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46ae532de927df013966d42d404b67bb50556e461bb3709bb544d0b74cd6df7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bdadf3ed888a5d0d1199777a7284d9c166998183e80f0ee92897eb7295310bfc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bfb0e0e86948b7ac3bf10d4135923baa2e82bd6747eeb4da66d07f781e82459
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d19fad3656457214086997299d36847d05b49c19bf8caafcd739195ee91adcf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d9e1d3cc49af19ab46320de61414a5e2755eb4e92ed4e6237145e633d27f2f5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa0b05e30ccfa0e450b5d7724278d72abc61d91ecd00596bc02a5984eb2a15b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79194fd25b77d1f49b2695a3278b8c265541168df5e312b14350142f8ebc09cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 294e3349e850fe8adb749f27067a48be1c3299b55a6e9b67fa678b11646728ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79f0704118a4c737f0b672bd189f9624017f96a697bdc115e470974e22c0f361
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1467626cab6f583ba7065295134084afb3e1778105f026ce9ba3a6e2f50088c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8260017dcbd11ae88810fc783ce5fcfeaca171a6371d84f6e987071a24575ffb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 001f54298e3367b0ff5035b4d048612a23cdb5b1b21dd40a2757d83c6d180850
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ab69a1ce760beccdf6f7dceee1052b5f3276c1864128ca70a22dad94a44de9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0e5132b79f2f0bd959856486c4522a45e8fe1e6ceb15a6a46779d93fb8bba6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9c883114aea40378171fad59bedc6dd77541257c20ff7e3b687390fe0339c7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71bd560a15f26dcf5044f9158d6f84eb4a95907d0ccf5b75110e9a4264ab37d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8874d68304cba9ddc2cdfec8049e3856c81ea3ec04b5e31a5d3fcef34b350d7c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c85a745dc9342704c2bb1539b6a42d1b1a2e58bed34c63abbbb4c9e72638dfc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cff78b8f92de45be3264c656b44cb8ea783443b27228c6d74978fa7f9972bcb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fcda7937c649b3904d101adc595aafb7a32dd14442d6ba7346d308e313517cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ad713dbae0757ca65bdbfecbe1ec3614373871908736e7697dfe609a50c1d87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d2b1b6cfedfa81aeef1a25f58a916baf2d1b8ebf8baa008c496413551ed247c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0091025eb242ce5416d8c4a88c0353661149a62bfb9e7b1b24d70b9c6ba1b9d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d5e1809026c15145b2509f723988ffa1cdc06806445fdee8d5b8f6fa9a59806
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3833b83f7e0028da083976e71bf00775bedd5c9cd6dea7e9b16ec479b9efecc9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1288d5a11a28d93089d995a978a32d46fc300543ac8ad64685addadce9d30d31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46b82f2519ffeccc8bfb89ed187b5301786e0a4f41e0f32b398c39dcfd806f57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8ad3210e17f7bbeefb0718bb3b73931edc1156489f72f5ae7d5f012c26650a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d999d3c421ddd92836a32c2f0396fe688a1a13f6a312a8cf1f89ad897877df2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3cc675e2bf28a6eb37de9f9f07d5bc43e27cc7611d69e607b8f8764073f99db5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8621304aaa720fa1c3db67a3c0a620fae4f75ade3304bbb79eaacfb601024a4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a9a7fabe6da2daa11c6cfae4b17a8b8dd8f432e951757f01c4f8dcb10669c63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0063ebc970dc0829f4bb47f883214ec305d83163d4ce95c28853c35ee909b903
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3684d5d03f08f515dc97dd34af36a15f70fe89a363d39098eb5d3646bf640935
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 792c0d057e7430ae25c29fd95336a83ed9feb1a1fa5b9ddb705c1732785e6c10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf90afb5e49353934c61430fc4a5872ba75f469e885b8720b108bfb8f4be2c47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90d4d765ccfcab0533dfd762758c7f134f1c8c70a0190118db2357c48bf88038
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 363d16234bdaf379eff916beb5368db0eba46c0b3a5401753ad1609d1c7fe76d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43ee345ac759e0935be05908ceb1e7997f1aa78e676930b6a8dd91cbec7fd890
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42145069af44aac0f662aa76950dc54c033f86a71cb4d9b29405ecad4fa50250
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84510c4381673400066090f014c9239cd0e4ba46bf73d0c0c8bc233101689d66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db143f0ceb331bef00c2d34fbb12df31b84120d84ba5808a4f8aa9570838b68b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4545ca7461828937e06f02271fbbc0b62ec735e4d1856a958d67b952e660864
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0b9634f8a05fa3256350330c06509c0e766b11db02cb6be3931315165710172
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bcd9a9731d4950b66b4307f0e19f7c8034139cbb1af613f3d7c34c748532ad6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3356bcfd05761088e9518f4f92046e4a71ab7a1d34f02953ead4cce3062fc0f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f250aff14e8fe417ddd809ed8d09f5defc485ce6111c6ec02afb4b1a14be579
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d244a4d70df72fa43ba9b9e5406d9c1fa9a942ee026e007316760374ada7e850
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60569670441b878cff770810986690207a39efdc822d7ebee4768e120e908882
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7e12b0d6f3a929475a1fc7b2cc2485f46c7910a48b10fd338d064fd6b543a24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f05d194bb865508ce0774fdbf576f1881de17286ccfe7111ac16d3434d8131b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db2ce435b704b9a2b4cb325932ab251e144b8bc08f176d31a3bc506d430a70d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48949ef43dd928749d0986ab4f5f59d496391726cbdb5619859aeb5f1fc35656
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3c553639de9e634fd7954b2379b1b958ce8521fff73618c1f4bdae002072153
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cad056ca4c3affd5479f0adc46c711acbc846ce90beb7f250da92954fd946671
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 398KB
            • SHA256 2495bfd25cc7816eda11e8f551d6521c4f919c38ca625362dbb4f36acb03140a
            • MD5 SHA1 SHA512 SSDEEP

            memory/2464-10-0x0000000000400000-0x000000000046B000-memory.dmp

            memory/4172-20-0x00000000005D0000-0x00000000005D1000-memory.dmp

            memory/4172-1395-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4172-19-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/4172-82-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4732-3-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/4732-5-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/4732-18-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4732-0-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/4732-6-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/4732-11-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/4732-9-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/4732-7-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/4732-1-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/4732-14-0x0000000024010000-0x0000000024072000-memory.dmp