Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/07/2024, 03:58

General

  • Target
    6e0906c35340cffd5134d0bfb1ba026e_JaffaCakes118.exe
  • Size 277KB
  • Sample240725-ejg4psxdjl
  • SHA256 acc04b3b3df54d366125ed58b5686485e752f1f3b47e8b7ca94ec6962dd08165
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • sameerhacker.no-ip.biz:288

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e0906c35340cffd5134d0bfb1ba026e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6e0906c35340cffd5134d0bfb1ba026e_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:3216
      • C:\Users\Admin\AppData\Local\Temp\6e0906c35340cffd5134d0bfb1ba026e_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\6e0906c35340cffd5134d0bfb1ba026e_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:1572
        • C:\Windows\SysWOW64\install\server.exe
          "C:\Windows\system32\install\server.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4740
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 572
            4⤵
            • Program crash
            PID:2012
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4740 -ip 4740
      1⤵
        PID:3056

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 b3f5699476a672a445922d45f567f9cf84907604aff0c29cc1e2f76b0a223dc4
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 230KB
            • SHA256 dedbc0e82e33815886449d0d08c24dba92c70506c90a1306c0919cdfd6723960
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31acc147b18538d71c0885c4ec04914995aaf8a3c7beedecd961f706be01cdbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1778177ad270602ea02a654c0352821a82a285081a0677b9028d32be786f1d42
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e2a2947007dd9e0836da5fd72e1e7319fbdecdf349a0a342f26ca4425b1e0e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5ef6d74920f3f2de4863456f6b5fee2a2d43bba1011058b541ff10ddf953c43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0632b84c6d2a12eb0c9c2ad883193320e282953289d770e95ebcfbd7f685d13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b0645473316eceec4b3d8e0830b4d3855e68df15fb4b5b2749f00e76dd6d701
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7fd6bbe52b6469d1dcff381742e62835d23522300cd529a1c6d3a04ab6770a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0c8542f6824b9e3f21c3bd1c2e0d554f53e9238d2a074fb7228fd7a7b5784cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddcb42ad32619fea81ffa9878c9005b3593ac9f8666f6bfab9537767cfb7eecc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 681b80e1dde475c12599422a46bd943c04cf1592bca2e18a62ad1a9695dcfb78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d11e6b797ad0bd92f457fbe1a23a56a6b4d47bddb30711aca6cfcbd7a73bda4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d83645671d59119d9035a677a48a45106bdca2f436ffb0ff5414b054bc2fa5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f8f58daeeb14c25d5e5b55758156bcc9f661a78c2d0610f2a1f80cf363afef9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8e067a36ef98a4b1006b331dd8b4f6a3aa8751ddda0acf4ca9b1b117cf76385
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4bbf9a966d5d93a2aadd988a80d0362518fbf0b7fa3cdf1b363c269f752d5a14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34b43772d554f57c36d644e023dd2d7461b8cd0d3efed23087354442fb8227fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e637a0bf0963a6d01875e3e9de2efa951ff3f4ac6ad26fdf245b82aa1082f27e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70026a56017df396beaa51a3828d7f404a02841219894da28ed73e9b06c085ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3ea60af2160475c43d02d73a45675e5bea06ecd15d19979ef2cdd0b39983d6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51f378d82dd87a649949f4853ce4a46077549105d0967aff0fb326d0346dccdd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af62eae6a9f2205714ddea92d9e8b7d913601faef02eead39be990f943336faa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37f1945a74e86fa3bce0e83acda7a351c2dc6dd2567fe625f05508c7a2f01319
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d35b66417ad21ff2437e8800bd62a9a7a8791707e83072e080e2514e95012aa9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a76928a1bbd1750bec751eac3b9538185a4bf807c8169f2ee9502508dbebfd28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10e918e3f2e01251ebc8a9e21ae8d146fddd7f4010b6280c276daef5767c48d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4808dd1fa25fd90907cfc816b8a3de6b57cf4d4fa62e09edb7b637bc4728ce1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf8fe89e487f5e3ac01a2f53c953c79f92563d4aaddaa1bd4670fc366a445a5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 815bfb177e24073ce7395d588d4eee9cfcd0114c15f760706dbc7adf93cfe348
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1a5b64b2c593d98e3e9d8f78c7f478f630bf415d27cdde9ea6fc77e4411462f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8407b35e57a1b50aee1636763140f38c867ff5af1070c978e2393b0d343c3ea5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2697a8f260525b394e11c21fc0e8a7aded7371fdbd987ca5191fa41d4b88de4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2005aeb2b55f8f75dfcc15e593fd5e6b58716d7f6765561e0e38618a1f204af7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14edc7b0995f19edfeca0e65a7bf453f174858bde8beaad9f3bfab7adf63c58f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af619d628887d10bf982ea14554a2bd553b087899558b789dc8a0827a9da5dd6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90ed4a8d4abaa5c5758ae703997c07b5473e6990edb6a2959cec6a11879eafa3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b2feccae1f674c27dd3bda7c2cd20a3ca87d3e05db99e51ecef7f1e47616b11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 432059e7fde77bf4e57b42ef015ebbbc2a1de30e990355da6728cd325a35ae74
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78943ffe267b2dbb43222db3e07a8e86fe1c82f4ca4ca7f1be5516896d555585
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70f8396b42caafe543b2b4186e26b52cc24b801005b83e04cd6a6f1867abe4b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e3d5768d98ee7081e6bf0545bff91b99e587f92439af094ba435dc1328e5620
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cbaacf8f870aa5f2057ed95f96e936f8df28bc85b4ccb0ae72007b537de7fa3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c34d3f710205849a6eea4f8b1473e73bbb663d8fd55fd91782d190e26c42e078
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79336548b46b43c91ef1d99c129d7fa04fe23d3e252380724e336a3ab3a9d49d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e76c7b3d33348a3e861538d959ecb1c26b2b62f50086cf6544f23f662558ff1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68fb7dcb6739702ae62cf1ed37ee83edcca8591db281bcf81139652d4c0cbfc2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e64c1f401a68ebcfb37d1879d0c777fb6fdd4064356343b86c9c78f41090ea79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c24a057269ab2f323beaad41ea930bd603161d3431f46cb5a0fa3589a87a6d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f71ff891c432fe31d7592a4a9db4c6a77af1aaba2feb478dd736979d7697f600
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39506c68c3e672d0bb17693b19b2f6ad6356d1f462bab4532c279641ce8ad238
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0c730a06402ebc28f23d7d60e5616267add78aefe6cbf054f54825ebc5d9b4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72432b0ca753350873fa1a58ad82cc89423954d62b8601f53b7f8bfe466ca9e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c588860774a0be6617d0fe20ae188523db0d5008f7bb354d090f8abac2da914
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5096b7905fb30fcc73bd07b5cb29870bda9f8213204a59f41a7543feb0f95ac0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83c6c63a56cb9eb29e3d5ddc0cf893d62e1f9b65c9f3f60cbee2af21ac94edb1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0228442438e8a40ed3690c17ce6ff56335fd64a8b302fb47f23804845c56728
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd43f03bee3a5cc9b976e351eb54881c0e7bae8eae8f211b7408a630c87c55a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f006c799fbbfdeedbe360a0aa12e54b1f3c1411cf5820916fefe15807d46af2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48e8f7f7a2756f8e442a4f0193e4b7945ca22aa66b84f9e8ca9c196f32a58238
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0869aac96d0aa71e703fcc37534fb7ff67447c448db485450e5a5c1ad5da531c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57f2cdb0bc5b7d2e5ceb8198bc23e5563b96b9d1efff8e4cf98e0325579cb7d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b95e483b44e67aaf4c31b2c5565b82ce6797fdf7d3265dd5c9d5d50b5c7b671
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe68491f410c2848a074bf97dae7e255c99bcafce0d0e86bfd88b9991850c21e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d1ef349761d20805e0b13bec06feaf025a3dca8cad18e9807ef5d30c6219343
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a157f9de559c88f415116a6be66288d966e5c979d7084b392cc297dd9f1a845e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c15a43cf7b2366c6af3c722bff677b23307c5f08848e8ae6d5fa422238b1bc86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc52a60917c595be5a961aae04f274c9896db2821feff17434d285df7e77e7b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4cab3f3ac5e8e3114904d726e77e4126c38ade0be932be5a98526466aaacf2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa5c5e7b8a0b06c966b78f2b30e3675c363208e7da339c387e00d4875f222782
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b4c2fc09f707ab8253bb3ecd365efa6f35f5fca59790988e25e9e8ea17a0323
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46024f814112dac46451af5a2170c356a5fc95d0d87d066d2f993ac68f45c5bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 155205b1e00631f60bbee65907cc33b5b001b65556d430fbacc9f59708ebdb33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d65729ea60defc4b7516a7cec39d7dd89f6627f3b2b978a499df0575787b93b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec04059251f36d53705049fa406b02e374dfd51213409845789b1fead75752a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01840a5f72235d823e1445f53b38d3640577a0d80589e845366c14051065f2c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fec39d0c901c428516b78bba4b0a787cab8b808fa0276d8aafe45abe792e452a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a98505a1d81bdd79466aca9872760fcf3998eb8c88aeb141e1c3c24feb5d4e1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 296bfaeecaa9818c4febc31a0156931cf3755634a105209f4053d003b67878e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e384eec1544f58c3dbfffbec7ab4e7418b36ea387958460ab36229066d4332e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0fce85efd4bd210a1214fcb6703e00b88dce5734f5a05002261ee27dcdd2863
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72944d7724d52142813e5f70aa533f029b82d692a3484407577b796c2bedd54c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e002918241f93b2abd6b84a2198b5b2e89ea29829d29062751c4ff1826b89fa3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a16323faebe4b3f51efe46e4cb8ea9937da9e64e6021fa47f4c6301de2855946
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c4008b9e716390aef9309522630e61f40d51ffeb7467ef1e2cad96ed32cd217
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fea10d5349f77aab875b1e760a71d40686843dc6524eef0dc3dc46c150ec51b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b678b49dd34a51dfcec811cbbef5b5ab6aaf9c6c6400f046e127c8c97f2a170c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49ea921b5677a9be6d3ee9d49609c5be4d16f0e97fcca093b1ddaaee89275df4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43ae0770441e58139334307c309a0c3a851f94bed5ca97113fa4da107f4707c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fca89dfe401a05c503186da3779cc3c2438568e245cdef177da8d693cf5c698
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11137f80e1becb42e7f4af44c70cf4a6b31c5acebe68a9c56e0042ac74cac7da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9c3c97a955518c64cc01a22212c7bb37f9fc8d6515bbd922add83e46adc8af8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 545cd0562e8b6d6d49eea007f7af4f4c192ba2689d6663b6fbabf268985abb98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de45a447edcf3c620bcf1f5fdc30eab3ead699e6c8c8a739720259b75a305c90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb5e67cf37e854ee75a4e867f3ba999730bfc3f2b6ec4211687a201a2e0a8a11
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ba13588aa9986ee8d76b770bbcc5592178d5eaa1876c6b2f9aa1e0c950d8e94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a405c802d5265e84341c202d9379510a29059fc8d67faaf850d8a044b4235385
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0adf0273a7902a3e280acb2983acb8970f5802d97c2e15b1517d5be093553c4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 194f4ea7fbfe42b24a0395e39c3c8f9d95d6c9ad763cd63e9f27c1ff7e3123de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 003f4b476cf8fb608f3f71e71c53faab7c009464afe3e073326ea8b9128b6eeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e641ffa03625b3361ecdf934d363e5632aba25febb345fe5c9f1c42de3117c92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3307ad49a92ae107c3fbd814804b8ce0471ffb51d2b32dc4912eb6e223b9376b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 087c02856dc28f300be9ccc497c2f97a1f9f36779f1211c5f723eb4bc6893399
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1496da6e2bed815c004677d8a0b5aeed07d781cd5488d72dd0fab5e22ca1e7c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc914031c373796b114f22cdbd022f678606e12046c2787a0d6fb5fe3080731f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84a900957991e777e0848136ffbaf58a63b8cb8de81135807c20ecd0c405f1a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e744d37a67faef78cd2135e45f14c536449c01c12b3091ba6d6c0a307317130e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b25ff212239c94e00233e2fe8fbeed10b4d72fb2bbfcb8b29a267652f3730c3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9868955666ddfe693cac83d83ac44b9f820e51a8054d582b6fe967a6ad3e943c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 267bdcf074d64ec8a459ff292c1a00e1e58881d50f923a846867b3319aea4b05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bac224c732407dcd1887cf7cc8896c13b06708745b3307658401281537a4f48e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9f25195233299d585ef77d57e6c26d7d2f844d54cefce2807570f54b584dd56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd8f3a70eeb5b8bd9bd91bc85d664e4577ae55b06a5643e7731349f49bf79893
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6593ddaccaa8cf082b02051e69ff49d039781f123841b57d69c4260b582f72e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d2ad8332f3bafe3ea064b9215a766ff23368aebc43cedda805dbaa20ca50a9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b57a3f20f5917a2761a33c469ec60a3b87c64e981a070be0c66a927bab19a0ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57faabf2085cdde9defdcc0b45aa80787cff4ffe9ac91acd45eddfced5faa4b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 858a235df109696ee3626084c047c5bcc888b84236232016362928a0536cac78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce9ae44624ca4f0455c66b5e39fd595ff87e1b9d5facfc2441b8916989778aaf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27cf66d2cb4008ff3a0ff6ed92e404c1b5daff0e49be5e7bd739018e70d16be6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9e14376879e42aa488e08391684c673d62aba1b495426e8cd3d3e1de660d546
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd81ce022d985cb2beee985b5d808630e53936d48db6b1e4ff0b4156887f559a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4516bfd390a09acb386912b7aafd9cf0e43cf5cba6cc107df6f50dab70e00b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b09f84477fc22761f83fc123244efa3bc3187366ce0e37a770a805bf951dab70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bcf522a1ac2ae6d4e7b6cfb7328f0f34b7d48fe6a00df6f6e8b6676df52d0d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b9534f2321742100f47d3813fbcd5f4eff369afa4e255c8648793e99986f8a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16623d350409f78f95f34eec394de3038b2ba108b21b96093523463703b3549a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 becffafddec8826f9e72481c71a7ee3db09858dfcdcbeb9c471a48a692d6e260
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bef066df6e1a0e4c56f757b302d712a84faf4c58725bfb57655752cda9d758c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aee6dca807f8b53739f91435da7d3b853d2ed819b6a31a85436fe71dee3bc20f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3ea075ff67273c0821dbedf120da1ae6013b65770df29d79f23a1b88c0d0180
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73ae99ecbf46bbe77893e5421c94a43b305ed051a040605e3a304740de3dc289
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b8c674192d5d8243631aaaa41d1571eae0e9cc322e4eabd4c5e49447ce0eba2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccb155c5e6f2ba332fe41110910e88b3b67c28ee6d40c295ae69fd8cd704df89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80139e520d9109a72cb68ac98ec04119d61ef4d1119cbfc5e878fe25c45d9fcc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1f80f6bdc68ff3c5d0237a90d08eca1e6a639ac2dd91f71033eca9e93b1a58a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a8fe366f87e077e52cf95a8a806b95d73957d5ecf786a4318ef8dee0c96da27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75c1f79f81b67f3b2be00c633809d152b7d128e52b6010ea9e506eaecc5e1b6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 691b7c1195b0c4d3bc2eafd4f03229dd12b488bd01022acf2d335e981fb74715
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b93f96b56c0d4dc2455265cf49518e3eae72b0af3b3fbf8c8dc5bc64bdc4e4a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed2dd4fdc1e34be517ccf0d3804d5f334d022615577fc9533cfc936b4c6331da
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 277KB
            • SHA256 acc04b3b3df54d366125ed58b5686485e752f1f3b47e8b7ca94ec6962dd08165
            • MD5 SHA1 SHA512 SSDEEP

            memory/1572-290-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/1572-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/1572-9-0x00000000005C0000-0x00000000005C1000-memory.dmp

            memory/1572-1198-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1572-67-0x0000000003CB0000-0x0000000003CB1000-memory.dmp

            memory/1572-71-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4160-70-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/4160-64-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4160-3-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4160-4-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4160-0-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/4160-7-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4740-96-0x0000000000400000-0x0000000000458000-memory.dmp