cybergate | 8b40487ac881820860f1e2c80f4f461d3738ec5311e5631a32a6e59ca74b4b9f

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
Size 416KB
Sample240727-whd44a1fkn
SHA256 8b40487ac881820860f1e2c80f4f461d3738ec5311e5631a32a6e59ca74b4b9f
MD5 790a6a2be744ecdf2eed44cf92c5d066
SHA1 7175a53e9816541d2caf240a79dfe3f47bbf39d0
SHA512 635cfee3ec8f489b9a5387528d0bb328c5f85ef7ac8498473d62b1914d7d274112515ad9ff19943daa50b06a9a9e2cbdeecd624ade59c1dce69c82eca1bb17d4
SSDEEP 12288:cHvnlBWWD9OJXXxPkR9mJC3ujJxU/cf08Zi:cPnlfD9GXxcRUJC0XUUDZi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cybergate vítima discovery persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

Botnet

vítima

127.0.0.1:81

Mutex

***MUTEX***

Attributes

enable_keylogger
true
enable_message_box
true
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
server.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
texto da mensagem
message_box_title
título da mensagem
password
abcd1234
regkey_hkcu
HKCU
regkey_hklm
HKLM

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\install\\server.exe"	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D300B1DO-8180-7Y12-B48I-Y731N67B85H0}\StubPath = "C:\\Windows\\system32\\install\\server.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{D300B1DO-8180-7Y12-B48I-Y731N67B85H0}	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D300B1DO-8180-7Y12-B48I-Y731N67B85H0}\StubPath = "C:\\Windows\\system32\\install\\server.exe Restart"	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{D300B1DO-8180-7Y12-B48I-Y731N67B85H0}	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
1080	server.exe
4532	server.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4608-3-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4608-6-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4608-8-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4608-7-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/4608-12-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/4608-13-0x0000000024010000-0x0000000024072000-memory.dmp	upx
behavioral2/memory/4608-16-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/2284-78-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/4608-147-0x0000000000400000-0x0000000000457000-memory.dmp	upx
behavioral2/memory/1088-148-0x0000000024160000-0x00000000241C2000-memory.dmp	upx
behavioral2/memory/2284-1000-0x0000000024080000-0x00000000240E2000-memory.dmp	upx
behavioral2/memory/1088-1454-0x0000000024160000-0x00000000241C2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\install\\server.exe"	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\install\\server.exe"	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\install\server.exe	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\install\server.exe	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\install\	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1080 set thread context of 4608	1080	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	86
PID 1080 set thread context of 4532	1080	server.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4016	4532	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1088	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
Token: SeDebugPrivilege	1088	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
Token: SeDebugPrivilege	1088	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
Token: SeDebugPrivilege	1080	server.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 4608	1080	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	86
PID 1080 wrote to memory of 4608	1080	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	86
PID 1080 wrote to memory of 4608	1080	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	86
PID 1080 wrote to memory of 4608	1080	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	86
PID 1080 wrote to memory of 4608	1080	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	86
PID 1080 wrote to memory of 4608	1080	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	86
PID 1080 wrote to memory of 4608	1080	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	86
PID 1080 wrote to memory of 4608	1080	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	86
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56
PID 4608 wrote to memory of 3452	4608	790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3452
- C:\Users\Admin\AppData\Local\Temp\790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Users\Admin\AppData\Local\Temp\790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe"
    3⤵
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      System Location Discovery: System Language Discovery
      PID:2284
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\790a6a2be744ecdf2eed44cf92c5d066_JaffaCakes118.exe"
      4⤵
      Checks computer location settings
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:1088
    - - C:\Windows\SysWOW64\install\server.exe
        
        "C:\Windows\system32\install\server.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1080
      - C:\Windows\SysWOW64\install\server.exe
        
        "C:\Windows\SysWOW64\install\server.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 572
        7⤵
        Program crash
        
        PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4532 -ip 4532
1⤵
PID:3684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XX--XX--XX.txt

Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Size 229KB
SHA256 8e0bb23072f14bbf76451993f8e3385f7f51ee4a47600b16693acf1ad6cee224
MD5 6d8bda5b755d47e004f099249a96dddf
SHA1 2c50439a57544641939993a2f5c69184d9220845
SHA512 ffc7d27890390861ecd6bcc9d256187620b28e3c77df4b482fbdfbbd3e5772e8f2221487d24585750355d60d775e4d5560a44e8b33de70e67e99c04066e668da
SSDEEP 3072:odP5JuXLFG3Oa95BrKUqEQ94jhc3PQuPe2D2ue3NXR0jW/UCFnp7HBIJJyCwFiCT:U5JGmrpQsK3RD2u270jupCJsCxCT
MD5 SHA1 SHA512 SSDEEP

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 c923c18e23ddeadd74d243da85948c2964302be06752c3d71406f9af77f21de4
MD5 e9bc2d071eb2474bb4e21b4d5e76e835
SHA1 2994247d9856b4dbf11aa65c7bdda92f84e60b56
SHA512 0eeb13399c2dd2c2bea506186745931b4f1769b6056d8576bb840bf7a73855510035dd6d61e85ba8d12e29b284fe70815cb019ec2488bc922808df0a67750948
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 7a335a4f79346d11a368405d9bfa8764edb985809dc7da9e4b38ea13b06b4378
MD5 b4baae0c1d353e6871982820ca27c279
SHA1 6deb949f7348a62acdb7d7ee9c0077ed76dc99b8
SHA512 49c6e224dce16a274af22ce4e1c2552a4f1ec085e4d810fd21b1f33b63604887a598a524e2fc429d473e39007f3a191652aaf6e862307606061801e56d513ba2
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 8f7441e631a70c0cb21ee1414c37eb44a34b8d7f588e3f0eb9cbad125a5cf4fa
MD5 1fead23e1532ba37aa704de922308ac8
SHA1 d4c87d20ec5236dfa7d04e821081c73a9ab4ca80
SHA512 d3f3a3e06bdd2d206b12a342b0f28fec466136abaf1b0a9f1cefa45339296b64db48997efffd07ca898a7f2a694a758014f24ab035484a70540ca0ea79bd1070
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 cc0bc2ad23ea258ad26210aef2839cdc0ec48b5e8a528705d2f221a6106ee32c
MD5 663c18dd41205f0026faff954be2e431
SHA1 e01a9e16070fa1486dee2c0c667e4ffae765bd37
SHA512 90e45ba86eb2a201ad5b17d0bd864e1382b6733a695481b9ba219a6e5401b61fbd9e00f538f45ddff624ed3ec8154eb61679bb4bc1a76ab796f61a6ed7cbf142
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 6f916a73fbc777561efb9b359c1d5d66c9e478c3af802d5c685ec034c430c6fc
MD5 70c6f14d72dc46c55bfe55ebe767082e
SHA1 69ee7ffacf18b1506f4d7873dfe7772cf21dd41c
SHA512 795282334fa8c1cdce4111fc826942db9eda2ca60047143537379a4c2e264ecc50e2ccda8d953fa583315035d65a6c0f5a21c11410ff720a90f2146c8bb09aa8
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 2ca517f4a8da1fd7f2aacc263e13c9e81ae5fcd9db23f09672494b016b01aa66
MD5 a7a531de8d6679ffb55174d8c1c05e7a
SHA1 af93eb157b407990c34d09519f18042dcbc992da
SHA512 a0236d2129862490cd8d1b4207a76a1598c3faba34b79f91d93fecbda104b5a80912b54679f9a35547c059f3bfa3d93dbf8c1c2d1bd3e54990376db2a0478117
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 9e0e7f5cb1cf626967817e9fb0a48b6ad484db4d9b498f81d90fd31321fd3264
MD5 bcdc7eead888fdd0fb8501377542e0fe
SHA1 60804962c2d19f4b74dcb180ac9ac9a2caf93802
SHA512 290b6125eeab2f555eaa16a79bb0ddbdc23d4971bb714d207223550d540676e5150e2a28be9f5089fbe546259ac865ebd2994100bf97bc9d091b0a91e9660856
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 2de1391ea1b54c2c9772993b44b01e8d26e07c0691a232af53951b2d55977e1c
MD5 51ea6886b3f35038f01b954cd0eb6ca1
SHA1 eace97b279aa0047df40f94b5f23fc5ca22163d8
SHA512 2ee9219a03b53ff58d619dd8e481ef64cd5167b4aa167b4958a11886c1e34e5017cfadc7ad3baf1b2f0a17ab000d06db5886dbe91a488df2a3d0d3dac20eb494
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 99bc03d232c0e83c864bd32074d2bfe8b03f077a38f46b75d5154995b776b8f4
MD5 9fdf5e97660b8fc9694cc8ee55e29854
SHA1 e3db7307c0b8e3f05719610b423d4883f689fdd6
SHA512 704407653e0640130121acc3e856591ed5cbfcfb1d792aabae8c3ba1e2873d9126959be6f8ae13ab3ac823791a9cd0c6ede56a2d332ace42d6f05879059cd744
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 e06bb86fd0df9220f01287516c1a7c042eaab4705032f06d49ae41adc74ddbc9
MD5 46ddfdab8674cafded54625936660df6
SHA1 dbfb907de704cfd3b88cfd2eb2cca17e1d74c6d6
SHA512 9b72df4bfe77a45316f6f03b7e94b078678539a1a6f4380a621939a81fb36dce8db9ba122c8617c7fbcd9f137d44503fc17aa485978ea3134670d5f9f1403b92
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 942f6c2cf38fc0f8019e97424440b9c7ab0a12f5d867369b278a6b7029b7b1d4
MD5 5edb823217aa500f315c660c88c7d9db
SHA1 e19c6aab18ebbedb95a536b5080304f074a5f4f3
SHA512 e4d2b0820eeb7d7ddd22328f362ac0f46b5b95ba2a10fce5dad07b9ef56dce5eec6366c1a7a517c48299d7f19b21444d23d6edd07b0c6eee5654733e04e251e5
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 93ecebb92ca82b4294662b8c8188475e8d5303510a21ac07425dcfe73670c114
MD5 e4929139559ac28a23e683abb1f17c42
SHA1 6c0b9b779740cd2e614f44b0a880a40c77e86784
SHA512 1a351cf1dd24aea99f4c92e17dd638e629eb087e649fcea99fe08e5dc05020a632dff4e292e6e3f0f8766d41ae532acf397bbc8b783fb99e70aafd6622adfd33
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 0a18c23c08ecb19643e36613220c77c223b7ca26bcb77a4d83073558d932eed9
MD5 80d4c293da53b5524d24bf3efda416f3
SHA1 c56909047f0ddb9893f5decbbdaffc9a15235132
SHA512 05c44345bea4026c9fa3d0ffe94224b7990b466a740529151c0c56b850d80a4d68e4e15e4613b8fbbe22823f42f70cbd20129a2efd54bf3aa36dc98ec406f673
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 42249746d5751388c0df44115c15d65504756944ca29840192193e0b8084d166
MD5 daaecb570421a25b7fecc06bbf1743ee
SHA1 9843ef84bef52b77cc3a6142423f41e3ccfd07c0
SHA512 ca33298fd6414a97e23c92cbb0562941dfd647ebb80139d9c80ff84c576126ee65920e04c7f66132fc4b9994d4f85e809bcc7d367187001a3322bca3b50f653a
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 c897e53eee19764203ce8761bd21f43235461815d51317524e8f5cfa5cc645e7
MD5 a72409c0d10ee89db1d1d7ce60462b30
SHA1 7a5a1119a69d14d22d18781d27d01e3e6cdda0d3
SHA512 228e6ef84ce15eca65ec760b7819ecbbc15b41d0e951f6e4fab01ae4efe146af1d60c16377823b27d4b218ddc95cc160baec690688eaa38f302f836df54725f9
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 34963f0f839af548903f9f4bd589362b14f8b5dfe256fefd638d23b8e31b5e86
MD5 7eac9ef03ea7dd08c213eb5ad496b2c0
SHA1 756e636002d5437f865c4e54c7e690a03c31a90f
SHA512 44e9294f7d9fb79c265f1afce695f11ee1c8fe8590ebe8675c391557a786bb46bf2dbc75c04ae4e7cf69349150407b6bceca4b0b6574ce7d1babb6f5de638e6d
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 52324d543bd29538ffbe4ad2aeb4c1e5faefd4f75c74892ab443432680607328
MD5 8da04a0d8d4dae4170e0d1127193f645
SHA1 7e5a4d232d108187b23c1c17ca36081c942e155b
SHA512 c26548a6b9ba383049b77291f2b060ecb8f6fa48967e8a162b7d6910f86901a6d85355ead2d0b3bb2985e28e206b55302b15b24eb60df848e447c65dcb2e68b5
MD5 SHA1 SHA512

Submit Download

XxX.xXx

Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
Size 8B
SHA256 a8a08abe8296960a306829abec9aa635c2b27ef7495b36b68cde68a979f91ceb
MD5 3d667410fe5575b7c3599ac62a7fb2f4
SHA1 f930325c4316cd6643c976b8c13b89fe3e742b85
SHA512 1555dad074b0865980d0fda15b411064789ee7b1f497bdd61588b549cebebed2675fd118fe2a4583db7d4246e87735bdb0e5d66e06b42368a57251b9ea91abe4
MD5 SHA1 SHA512

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\logs.dat
Size 15B
SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
MD5 e21bd9604efe8ee9b59dc7605b927a2a
SHA1 3240ecc5ee459214344a1baac5c2a74046491104
SHA512 42052ad5744ad76494bfa71d78578e545a3b39bfed4c4232592987bd28064b6366a423084f1193d137493c9b13d9ae1faac4cf9cc75eb715542fa56e13ca1493
MD5 SHA1 SHA512

Submit Download

server.exe

Path C:\Windows\SysWOW64\install\server.exe
Size 416KB
SHA256 8b40487ac881820860f1e2c80f4f461d3738ec5311e5631a32a6e59ca74b4b9f
MD5 790a6a2be744ecdf2eed44cf92c5d066
SHA1 7175a53e9816541d2caf240a79dfe3f47bbf39d0
SHA512 635cfee3ec8f489b9a5387528d0bb328c5f85ef7ac8498473d62b1914d7d274112515ad9ff19943daa50b06a9a9e2cbdeecd624ade59c1dce69c82eca1bb17d4
SSDEEP 12288:cHvnlBWWD9OJXXxPkR9mJC3ujJxU/cf08Zi:cPnlfD9GXxcRUJC0XUUDZi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1080-9-0x0000000074910000-0x0000000074EC1000-memory.dmp

Download

memory/1080-1-0x0000000074910000-0x0000000074EC1000-memory.dmp

Download

memory/1080-2-0x0000000074910000-0x0000000074EC1000-memory.dmp

Download

memory/1080-0-0x0000000074912000-0x0000000074913000-memory.dmp

Download

memory/1088-148-0x0000000024160000-0x00000000241C2000-memory.dmp

Download

memory/1088-1454-0x0000000024160000-0x00000000241C2000-memory.dmp

Download

memory/2284-78-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/2284-17-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Download

memory/2284-18-0x0000000000D90000-0x0000000000D91000-memory.dmp

Download

memory/2284-1000-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/4608-13-0x0000000024010000-0x0000000024072000-memory.dmp

Download

memory/4608-7-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4608-8-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4608-12-0x0000000024010000-0x0000000024072000-memory.dmp

Download

memory/4608-6-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4608-3-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4608-16-0x0000000024080000-0x00000000240E2000-memory.dmp

Download

memory/4608-147-0x0000000000400000-0x0000000000457000-memory.dmp

Download