Analysis

  • max time kernel
    150s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/08/2024, 22:50

General

  • Target
    820a9c8942ef165ab07626bac6fb0c67_JaffaCakes118.exe
  • Size 662KB
  • Sample240801-2sh4pavepc
  • SHA256 b943799a6c67cda95f009fc8a00458f4e2355fdca9f856e7b31da0503876a6aa
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    1111

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NTFS ADS 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\820a9c8942ef165ab07626bac6fb0c67_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\820a9c8942ef165ab07626bac6fb0c67_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4056
    • C:\Users\Admin\AppData\Local\Temp\820a9c8942ef165ab07626bac6fb0c67_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1004
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:4100
        • C:\Users\Admin\AppData\Local\Temp\820a9c8942ef165ab07626bac6fb0c67_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\820a9c8942ef165ab07626bac6fb0c67_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:940
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • NTFS ADS
            • Suspicious use of SetWindowsHookEx
            PID:2604
            • C:\dir\install\install\server.exe
              5⤵
              • Executes dropped EXE
              PID:4812
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 528
                6⤵
                • Program crash
                PID:2428
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4812 -ip 4812
      1⤵
        PID:3656

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BFP8GTV1HBABGTVL64MF9MC9TJMJFSVF7VBCVPJGV

            • Path C:\ProgramData\DYA_PPHDTFHSLSSKOHJCD\1.0.0:$SS_DESCRIPTOR_SBXNV9VVGV1BFP8GTV1HBABGTVL64MF9MC9TJMJFSVF7VBCVPJGV
            • Size 971B
            • SHA256 2121be360f7c646a551647602c6de0c39750ae423a9f54a4a6d8ea1d2a41ebae
            • MD5 SHA1 SHA512

            app.dat

            • Path C:\ProgramData\DYA_PPHDTFHSLSSKOHJCD\1.0.0\Data\app.dat
            • Size 971B
            • SHA256 8feaf1060b4b2ab6fca1455f4968f2bc220c0ac86bafeefa257eba1ca4b8af04
            • MD5 SHA1 SHA512

            app.dat

            • Path C:\ProgramData\DYA_PPHDTFHSLSSKOHJCD\1.0.0\Data\app.dat
            • Size 971B
            • SHA256 1faafa2110991dc9f083b064dd22a431ff4f606780ded14ac3c49e0f45261ff0
            • MD5 SHA1 SHA512

            updates.dat

            • Path C:\ProgramData\DYA_PPHDTFHSLSSKOHJCD\1.0.0\Data\updates.dat
            • Size 971B
            • SHA256 6ca355b0baa4dacff373136eea5102a4fcfad695f3bebefcce513a0d954fe82b
            • MD5 SHA1 SHA512

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 70146eeb6cfa42a977390c0433fc0a9e5480fb4b6e7430939b1af1a97421ba80
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 5573171fab1a2114c6812fffb47782c35660b8d222137b3817151dd0363bf4cb
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1923238a785a5eae6b1bf190daa46b456094a263eb1bf77815e46521547ab0a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44b75132742814963254918987fc597664b1e551aadbbe1c2b74f7a97fd0c275
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d197c2acad765b19a4d535be3021474d5cee5837e35547a66db66ca605b176c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05e483a20d80c85c7e3d2836f6f4853fea77079a50105947a31fe7ae5828694c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e6b8803fefd625cc2fa641ad52340d98ae588ff904a4597058a58b952667eb1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb73a030d909a891ddc290f5724d0532b5f916e0c85488e8f2bead516431a0e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 150c013387e9982cf77fd8e58f8fc963e9601356844697acd3aa0896c215b94f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a71004a2edc08b478f6b711e12b2de8b3d3a1f5232234d0656bc17f02cf0e0b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e71a4b1d4a3724226f810166c610e5ddef25763f00e073afc842e42b6d6ad2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e5ccec7da200b1d8ae65f20b48dd2b70609a93d4007d142c6d7172d41376e28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f31453c7a82aaa5e573b8d1741742909382cad580504cc58fc4ee4fa106a1a29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7701f3b29176c3d186a79840cbe83b3df593c6e814ae966b901f9c131f995af1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b06f29d28798b0cfb5012cb4369fbfa24231eb16ca3e8098eb3592eb7e6baa21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d39fcd755e0414e18873f93397ad0bbe8448771de31640d76b7062f3475cf130
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bf745882348c3495bc61dcd13e3993a00feb7281e40eefebe31456d2d755f2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65619ff0dca39635e92e22fa8ee8da0e09d5bdba1a3a3f26593a7d45b6e4afe8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96b5b632af555a7752e6ad717b4a419ac293ad023c1b0cbd9421ad36bba877b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60e9467fab08466ffcc9048e81cb2b2ee37fedf63cca26f9e03d517ec9736ef9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66ef455de2496bff69a121c97ce34843f9a7387bb3b59066816bf844160c4425
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c19ae9fc08c133e8fd6063874d9fa7dfa2edae5aac70c0084d7c267a99413f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f98ce8076b72b214091fbe77055d3d843103911cca60d274427fa90d458a164
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1568a26fdda4c270e6ee72f821bcf2e5960bf470e1305e5ac34c319ec334ea36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34a54b86a34d570bea50ca4e299685c94a9a56f5bf38d6b122204f7b4d77c839
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fc2419fb0220529bcb998a5f4e7656696c751c4b41419d3d78d05c839c62785
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b4c99fdd0e9a572c5266a25fd435027de0172124d363ee99b5f378eb0b93077
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c4e0169134323e3fb618167bbc915d8777fc3e9371dd16b8a26af194f6b8d26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80081afc4acda6895a7d7b9642ebae1b0d39f7d742eff82f5db36580bcacd2b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91b06b14f9600c82f7c059b2fc40965a174ffe75e2024443d535f7555aa96152
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 118df57964f946cdc79ee449778782d2c95d8084b03db788821e3ec6846524c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b04fa657fcb20d2927d443528672682aefeccaf411dc2d7fd7ca5b85bf9626f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b08e4bf7e7ca41eacfb8e4e3d88f9cab724007df0f806a60b7a7899ff08772bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34bd4ff467832625f4a829e2ab4da8f3440f0a4ffa918718a40dc345017fee48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccd8013a22161fc6a6b264e63d1526a35479ee1bf2fc9c53b84385ed4b3be711
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c64018920341805c39a784b568ec5527cf1dc9564bf67ddfbb1faf412782201
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d36c8dce525edf5122a68926e046e7579f958bedbf9817eb8f41d7b32febaafe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f882f20687b670b0d594d0d69d75328c23e0e3fd547183307fa3227efc77165
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4ba3b69c4cd81119c6aab60a1cb4ef8d29af78c54da44e975f0864605997125
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 205196ea1b861e972183803cba255cc1868c9004bb938cf9c04f61b2288f6564
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e318eb6efdfb13a8b251a7b97706782e00c0cbdae3c7f8cdb23e745a3bf9c3c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bb4c931d2bafc0e0006663193322512cda3ed39ab51b45055863534f31740da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 486a6bc9c13b515478485876c231f40c99a9014ebd6dc4269b2454f03c068e92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0144c3229c48844fc578a672c1a92f8ccd55f16917f83720a9230d02897db07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 388b7e6178a7654217d75fe98ef6b2ac69beaa93c4978accc9082e7396d2b6cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b323b67e8570966d5f6aefd327d056a15acbb0192ab252fa61e69ca32b5764b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e3ad5a765c5bf1f895b1cfe03147b111f67d893b4bcb5d12347efcb214ef6e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c59c5124ad29c3504459dd012aa3558c8529d1dc7973c7b7d575f622a0d4b4a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f4927617c915d76d269cd377e772fff448c44a64458a180d5a4ff152ad06820
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85ffbc51923e84a138d60da84066f0242b3c1b1ea4807216ae6b23a025200fe2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f04bffe8930d5b9ef8f5b04e976a09418438042c45cfdf054b36d18319afa9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f91b28da4004dcbe7d86248dece7d943c74f735cd23c069e19cf8f5638c923c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 686525eccc27560ade246e30a0a9e8bf86e02fc2585d170690447901b75652d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c5f3473421a904cec74a4d029544ab206f41631e6a3e03201a711171f23895d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8226abff25fbcaa1596c1221e3e01022fda96ec913539b2c87817ca5c4417d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62b7b2198daa9359f1dcf0dfdca568e0d286c315cc6dc8f3680bef06a9a76670
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5f97b998261e5aa6ffc874434909f8220482adbf62737c58b13e6e617d380b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abb23142d0e07e529352ead93073d6a9cb8b2c7d26453a6c4091e5c1aceef8d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 555c93cb417269c5b9a87e767f0e638c028cbef9f62127661250db02e3cef40c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 171009a6dc85becaeb0713ac4e707b5263dba7035678f25d84a1c8061e2d7142
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 131cb947dcae25be57873e98e1cd8d25ab4ac8ad55aea82b4e9e9c6f48669558
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0bdf295347820c5cb1d02fadec66e070729c1c9f1972ffa99ab43943843d9b98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b085fe5a311ece9beef6274632767676d6890322db0b975a4f65ac1fec18bc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71151f777196717c2517d927ca91ed885b57c2572f12024e188a205ac573ca2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f587f8ddfc38563d97f4ecef9d366b1aa966b529fd79b9a2c3635ff0fde4a787
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 154539a985c9c5e1447d75b8a148e37531bbf62f55bb8eefb0502b411fc06352
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bac89e33ceb4cb5f0017167aa68055d4f61fda4775a2a738b48add2b7079eb7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d74b43f604217634bf2ed70af6dc453ae6a19275ef8cbbb56b9d2a4527f0b0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5332b0f4d2ce17250e7cda594351b717c2bd8118ba89d8fb006d755ccdc91bda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0be9f33bf5db856b92aa519c5dc7d8d8743e276f2c446129bc45c4f3a3f833fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2336b0ea73c600551c88788acc8e003623851b3f189ebffbc25ba1737aef400c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adb3b60e7750d610dfcdcd6171753c5fe046c5cf9b871bced6340c93432c1c5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fca145b4fba923cce726b50a51fa7122dbd8b62a5570bb7301a8d875f79072c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f27a6ebedf14020e1e236eadaad7e8e792685c28496f3e05d900cbc2b328369
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc59654546b7aa6e961b4cc9463cafb2eab0c5da12be635389a017696a596b43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a87f291c48d4122ca77e94293e109a55fa96baf6b004ceb6cf794f2622a0f62
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c8981f603f2a3b2e5c78fbdf10cce47214ecd3c4afc75017c3d72e60ec0f22f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4cf2636b33baf82d6e875dae2d491abae8b596a47933b2828b65dda966cd743
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3fd98280fb5423742ad7da083441bdd88da11d3bb22a36c9cf5710a0b5387ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dbc12850fda2cc118ec04f39b9ccf106a925d88530e9a8849729a13359b2b6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 646dff92d8680480042f84171bf574328e8e4142309e460b2ad5ed8a5af34973
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4022314cfc79afd13ee9bf9afbd1740a13391b75bd821796034b35467fe6ad86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab5bebf31920beba7b2124428f2fe3daba32b737012d4e36b08a31db9ca7f2b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c6e5eabc325f30efd82a0e2f96d03d10cab6903621eda7a5547805ad94fa1d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f51304471e7828239fb3bdcd26146483717fc3ab251218ffe69b7125d865c6c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f735b7d948205f1e75b5d453854f893a3de256c65376df9a10083ad4f0336369
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da7854adbebb0799680d81b43376d9e15272a63128666379b9155eab785d5748
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68466de060e04ff64649eb75e4d60a148de0aa56d41261911f6de6188993ff00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c586f37f32af86b4679c55bcd08eec4b335cd23e31c6caac9d03d97d66aecad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d37308b37d24b8ef494676c05cfeec67d04d301ce93772708dbce3cd624f2b18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aee6737f6b2eff2d5c7550b21ef140f1e81ef8e6d44adfc0b77609b03f36496c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c3d41545d1eb763c59cb1e5a53c53bb8f8c85cfd8ee07c24d85998a46d9429a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11e1574c86b857b1e0349513083a4cdf1b39b143f352c72cd6530a0ab9f54811
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3237f8a80e07195f75b310ad2bf92b1bf556920fa1206faa16c6b10918749716
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 159d7054352ae2bf5fdea94fc89c410e2e7194ffb3ae48d0e394858c40e12e5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b087abc03045801daf8a6f26e19f1b044e5c8ebb2750d5ace42e497c7785dd5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a95055f6e8e51fb62f746f9ac93c46e0d87adf88d993c72af6a8a25197c88b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f13cf798f2ebc921eb4a7dee0627c3c30aab2034e46948151a8780a1d5edd16c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b530c1e8c82d7f454ec6640de92fce4daf10f01db08943b038ba7862742bb8ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bea596d2015140a38f6f2a914e0e28ba37be05e7b128555368ba4b6ae336089f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b81d8dca28333c1fab79a93650c621c2c3766e8506b276c439f229487c07cd3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8896dfa29f8a01e7a678cf68ac66374d8044d57ad3f81573ea5eb783a0653069
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 709dd8a1c92aafe2ef60e87ef15801b9e1a94ab64203d1c277c04543bfdbcb5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca4550441ff1fa5d0fae20929bf7fbf6a6b26ffad929b0c63dd4e85f2ae825a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 907c7bc0239f699abfe5d16e9bc357ce4a5a30a03986b966a97c2b6dae4eaa8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4224b3234d3786d7482ed82e039ff535588a04cbeb9ae59f7c794fedb274dd4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 363c21c4dccaa7d2027f9fa58512b3ac21db385e16fe7807875e96b648ffe5dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fe33f7f044b4e17f3172542f2822051fa93eb784f1d550b8428fdf684aa52fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3786953ae7390d86e252c1fcbb3c887fb873f7852c783ae91f8513f3c3efae55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7434840425041247c692e7792f9ffec3932b28032ec51c6b31fb653481c8910
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8b038a1df5a13baa632ff8cb491e988c5368cc07a1c3a3a24f2e1375f5e69a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db0a096d48ea0be7ed96565faee4ca7937c4d08ecfd9fc2a55d3b685cbc27f0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f30851b79b7f610f2055cffcf557754641d9ef238d9c63774615b6c3c2e7ccf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb8f7bb84fbb3a1e8dade0ff2e10ae09813e6f7de4e92109452c9d410d9bec93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 270e7668eb46931e1adb78129cad14af27398bc4adf887b58155f7ffb6178649
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 043d19a225475899fcf8cf5dd0fd7aafe6b6b5d7d818a9064d010e093b954be7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f75c4bc92d611e35809204c61a1053c1bf2ba7ad5aa4f3ee0f885b65d94f184d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60148bcc3ba4f98f828f4d5f6d93a620d1137e5415e10e2ef5d7f5a724d09d2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55dee12c4dc46e65d02ec0d456a0eed1fd1bccf6ba87382ba308c155cda6ca24
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0c00daf2b031ac686d5dd08f8fc398b9b9809ddbfeab3fe91d74ccf8fb6da30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 441185cd04f44a4198a38bad94673fdf53e3c3341534a6ec6f8b036027ecd5a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79e1ca4e525feae9a164fd19151c7cd6de51b4343e6b2545507e4453b2c33733
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc63f253999c5da8bb949b09e951f107194d0b14dabd5c24ba6efc579223f0fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f713c449199c7c4f14d5727b23f4590077c2891412fd2ac021131ed9912993e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0599dacb40f526353f8c6fcf23abaf9e30dca14b130f60982cc4d7b4ec9af20a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56981802e93ab29bd1068f35b0ee5db0ca76a24d06c7e86eee95ecee6166ec17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a42db58f8cedec91626b8d025eb7680cda5f014456c9f8738beac69407324f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba815b548bc65a83f36d5960bd16c81c805cc69e58fdc0fcf6726f712f1ddc9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9270136e2ca8b14ab8f0e91efdc07fd9f80e4bf69b1151cf92e5e03f26dfb42b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f26b97b14197502b15da4774ce6622a3c64f3d8fe72547fbfc9a6c3a903b305c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1509bbd04c3ae0da7336175a26ac85a7ade30411301606ce0d495bb68b7ac257
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53754fd2fe80f3fca258d0d7d47332606d4cf58cbc9a41907f77322b620faf16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e729c084a7628751cf6f90fe996c743399a77bf7a03cb0a8f4e0d8bc1b33019
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e53720592efef96a4b8c66766f57a17036375973c12efe81896088ebf3eb84b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91617d8f9e4624a563405808b8f394aec9ce4ab9302fc3cea04b5bbdf697513d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca504010bc9625474cf3b70af6f228346e45d16675abd21c782f71257a3ca613
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43372adbaae2cf084216233617cd52a8b28d349316b7c3adb16ff717768d5820
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5bc1b734df1f512def63a2801bdd227940afa4da349a31f16b5c889bacd8635
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45400b37d7d4583aecdd8fa08557bff187d6a9ba967821b221959af58aab9332
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea0723945507c98b31fe3a5ed03d38b7bf054fa6a959f8085d4ea002c89ca873
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f9e7ef750dc7fdca6da3f92d6600a0bd57858cc5f9b701186bf9824943b05f4
            • MD5 SHA1 SHA512

            dya.dat

            • Path C:\Users\Admin\AppData\Roaming\DYA_PPHDTFHSLSSKOHJCD\1.0.0\Data\dya.dat
            • Size 971B
            • SHA256 c904d60760fc838098ec7075b925b8907bd543bdbc1c440342189469251a2892
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 662KB
            • SHA256 b943799a6c67cda95f009fc8a00458f4e2355fdca9f856e7b31da0503876a6aa
            • MD5 SHA1 SHA512 SSDEEP

            memory/940-80-0x0000000000400000-0x00000000004A8BF4-memory.dmp

            memory/940-65-0x0000000000610000-0x0000000000611000-memory.dmp

            memory/940-64-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/1004-60-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1004-128-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1004-63-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1004-56-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1004-59-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1004-48-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1004-51-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1004-52-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2604-186-0x0000000000400000-0x00000000004A8BF4-memory.dmp

            memory/2604-153-0x0000000000400000-0x00000000004A8BF4-memory.dmp

            memory/2604-152-0x0000000000400000-0x00000000004A8BF4-memory.dmp

            memory/4056-55-0x0000000000407000-0x00000000004A4000-memory.dmp

            memory/4056-44-0x0000000000400000-0x00000000004A8BF4-memory.dmp

            memory/4056-43-0x0000000000400000-0x00000000004A8BF4-memory.dmp

            memory/4056-1-0x0000000000407000-0x00000000004A4000-memory.dmp

            memory/4056-0-0x0000000000400000-0x00000000004A8BF4-memory.dmp

            memory/4056-45-0x0000000000400000-0x00000000004A8BF4-memory.dmp

            memory/4056-50-0x0000000000400000-0x00000000004A8BF4-memory.dmp

            memory/4056-54-0x0000000000400000-0x00000000004A8BF4-memory.dmp

            memory/4812-187-0x0000000000400000-0x0000000000457000-memory.dmp