Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2024, 06:27

General

  • Target
    835b926378c79dd95a5cba6c8774665f_JaffaCakes118.exe
  • Size 561KB
  • Sample240802-g72jcsvhke
  • SHA256 c4a279bdfe68b50fde65691e7ad83263fd2ed8b0a184b605b6229bcddeb02c90
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • amghor.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\835b926378c79dd95a5cba6c8774665f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\835b926378c79dd95a5cba6c8774665f_JaffaCakes118.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Users\Admin\AppData\Local\Temp\835b926378c79dd95a5cba6c8774665f_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\835b926378c79dd95a5cba6c8774665f_JaffaCakes118.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3936
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:3160
        • C:\Users\Admin\AppData\Local\Temp\835b926378c79dd95a5cba6c8774665f_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\835b926378c79dd95a5cba6c8774665f_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:908
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2688
            • C:\dir\install\install\server.exe
              "C:\dir\install\install\server.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:2708

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          UuU.uUu

          • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
          • Size 8B
          • SHA256 0d5298dcb9643da610daad1e0cb2ff141638cd4790b4e02f1382297da77b81e2
          • MD5 SHA1 SHA512

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 229KB
          • SHA256 fdf0b7b34f85f35b0cdc5a9285b69b80a2db7a5097bce4210e86613496b975c1
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 74586b7bf957f27fd1ad7f15a49ce71bea7d6dbd35f89e3fe044d5d672e2061b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 49a6c3e3b4acf7933563e21b8c4f9f6f40e6bec2ed961fcb5761d7a51873d199
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4317174c1b8b00607958bb1723b84e19c68435f75a40514bee75e5132cafb2a4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 646e5c6046af4ebf581d49fa3c9cff85da6e8ce4d0652b333e6e1c498fbee9d0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 22c432c70a8139601596a5cf9320e8272edff625666508acea8761f6a7cdabde
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4d67c42a4941ee58c0536c9acf807324a966c5a0b54a07c277b09729c63e592f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e89b1b0f9abaa807051712d85c4c78f3672daaf6432c6d068dd616fa938a9b97
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 36f908034f0d28b399c96f8f76a0c2a19eb5795c9077cd3d381aa8a0dc628fa4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7932680c4bc849cda2d689b3d702228784a4d2bc7b6289d36accedb202f9019b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1f998eca926169a765c880180775fe630a53fac9b84e1a9979e0f00281a3f2fb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b55dc2e8c6031ea757e084484e1d91101dceb875f5e7a9fc85370a717e0a83b2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 329367bd6bde2e83b90e571940921ca95ce72a11a566768ef174bc78c9b9125c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5ef0b8e744efe747b18c12e5647ed4e25a09c854eba82fbc46e66883db48b358
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d4cdf9a40abdeaeaca8c2e47dd1036afbad7b477ea2091256a323141fa1a05d7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d3e3793081b4a65dc342cf861a16d7212a61936718ea1a1bdec6e2d77236d70e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6dabf31f1376486bd1927d103c8356d61afa0d43c095007cfdbbdd0e0a2c476e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6bfd35b7dde5b73349bfea820c3d5b3255a1b302f500d17546710a39c20cd201
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3ad485d569721a5f3fa4d07a42269894185b0e07417a9e151689a828fd3ac765
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f06766dfbc7b6623c54ee3e270024100a791c682f877c3d47f72ee31450992fe
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8b46528860e73208ab1a9ccd902ed70b9d0f2efa4b8d43ed09d859226e1b22b4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 05e929f7ef4ee4cd734b56e0a8463241b70d13e31fec060a3901b0ee5de97a77
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d5e25101600c6d3c47f4900dba48d12378e3f4425620ed52eff33d0f99de4aec
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6e5998c3c17ca07951d0ee13b3cf0f02d85478d4953a7a2deba6c2f1653f2370
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7df36eb8468dd3a55652ca09f5d5c17085bb0bb4c90b681df17637f616fe909d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 837a8ee4e2a748fb4f890990bd5d3de3fa9cdfc26f8f621864330de769d8f8ca
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2f1510fdf09fdbfa2271f1039405919d066ed272fc097024206b9c4613a9ff37
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2bbaf1385c5ea9f0fac967b5f3644d3bcccbadf08ffe81e2c48e9ab310f23906
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dc98aebe12195d527012071f9f24f535048000967b8d54556190feb627c158f4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 83de0ccc9d085a414a6e852431dffd850f8e9725d92175ff12ede39672c9662d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 99605bad528a69c176fa904f8ac946f34e7c04303d2e73e59c04d01ab2ad4641
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3ecd17b788b1cf0b16d1a294a733d854ccc6bfb677f59ef814e4a67a973b07b6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9940955dba990664f70e69f1b5a5a9745ec001a8f9ac8b85cba57187d6dea162
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9ac2b5d6d6b0bcdb09603fbbacdd3b470ad1ff1ab244bf518b13aff7a7c0b479
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b6e7badb3f15f3723294f6ae17ee865c311c871e3f9e0782e338009ad2226396
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6cb395d6d1f718427ce91168d7c75f25a0ecceaebe1073d6c3ff8338911534a9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3a727262a6d616b8905d8cc99790acf1539056d28d135d05a1305008a0c864e8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0f40c0ddfc00322ee7362691040a3322c4e9e9567ffd8828e10b5f63bef4ada4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 466369d1f8bfc10f3e7cbf24e99a128798548d5c7c096b79f5f3595dcf82db03
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 382fddf6ad11631f9161c78fd14118793cd4f0835f7667c7e0ed660c20779084
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a55910b4938637e024814489278f5e17f67191c9f616128e8bd6021a0920232e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 200ae5a45759b179373676eaefefb88aacf3b4a0f529771f930b9b4f6d2a55c8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6a6ff4f7cbbb9e6dad7ad31e412fa35bbf475868e39f235d78209374845c9dd5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c823c32725f3abfe9d7f30533618d4c77e5691b3374d01e8baa391c4d5e0d4fa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0c643bcf61e4f9dddbad160ead403bef1c90317cc8102c5c0e3e66d8141030b8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c271873e9cb08913bb22e75f1a0b9eff540a07b3e25016682a862e6b0fb3814a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 10df6d68637fbfdb6e4075e891fb4817e92d129fa05e6b48029fc7db417ccd04
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9f6736ea690981ed35e72b695ac7d0f6249306baf233bbe40e7f4ce7f7ead418
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 53c420ac9f39c8b25b5a190099ce3475234741e03f8485954394e85dee5e120e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b4a2d5b18036a2c71c7fe13fe15d79b8096b8a87186329ad3eba7232d79d0858
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 11bc03875997d7d30f9c7d2ca9aa089d905ffca813b392803d2dbac8933837d2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0602384bbd06e6a8b48c0ddd6c07c8699103bc98e4ada4c7672318f27b8879b3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2890d5a398732289f51069ddb50f320099f1b5c2bf65f1cb67c5fcebfa828a76
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9e7d0cd0052ca6b4f9525b2f14dd447bb8ea92ad2617624817f49e4f67485661
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7ec5096fd3f17db305c97ff1abcc2c3c01eeefaad8fb42f84c39a93ad2e707c3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1997299124a8e5cf2f00c088ad1c3d1a4b133b80e9457fcb6fb47b69baa89e81
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bc71013776552f6cda57b13691c17129e07ae092d6f7381b28ead7e659135271
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e0d2b5e67801f8930fe974a821829324c2644c418fbf96d0a91a55bd8c45b2ff
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ec8c04143a83b9a6878650b7efa55727c2b46e563a5662427ec9fcdca2a09828
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 66671314e538cf26c1b9d14a93116ccb8e6f961bc0e87a99f80141ba739095a5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dc8b79613e1ad29a6bab74468b4574fa9f65a3f33d8688b5cf960447892c5677
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1b258ad95008c5a0307e79a9d7264f740df3441b773913eeb5b423d25c63c0d8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e679f38b78464a7d0140b256a85c70b5deabbdd19618741aff6de63eb368cd07
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 031014a3e2faf8eedce555f3e93ec27cc2d76265bf6de36feb57c4f614101d3c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 33293e9f143e8296fde03088f57d79e11b9ba1c8d64c2c19b3f2962cf86b7863
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e9184bbcb02eaf595a9398748d49068809ef0fe76eadccecf94718aa2c4f91a0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 051e7b7223b229f389c234ea20a9fb5666336cffdc0f5ef235323edb4e6594b1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c7a7166c85d6a4ca660781143097b6ca60c7bbe7e052ddc43c6a90050d0e8607
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f098a8e5fea46e4605cff9612e90f988a9b1c34ca35aa6fbf4dad1ac12952f00
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 73348f329483d42882c497c824b248d696f25e849a810d51d73c40563df004a4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 689014b0a070fcd7e203fce30fd0d871aa157dc4b5af8353abf4c8498444b4c8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 775f97489a7f95a0daf3302416f7da343cff8ad310545bacdb7cb12f073a3b5a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5e0b2351c809e5daaa62a1c39543babfa100eb47629bc9f6f4808247f9ac9eef
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9348af45cd0301aaadd3ba2db1458a3ebc9e4f2b8745efc8c2a96eb8ffc41dd6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1d141dd8912d1ea99dd201bf5fcc34228a1e1cf9520efdd4be45ee883837706d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 63f86b3acf56cddc3c64a5ec2b38cb27781e3b0e2ef7c58fbb452a0c1def7d07
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 feafd6ae8996291a006a66728c9d0cad4e16d33ad43620903cf3d27008bfae27
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0c1303919170399d40ef10649c79ed2a8d098a168fdf2c4ddc39ce70419714f9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1ccd64b9ac5b69e8332944dce68a5aad34b905d13a3ace727eb12e5a55711b3e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 83c6e2da4e119b7e2275368dd049d78f1532ae026d95c6524d6fe4c24c40411c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b239d0819878596f63c6a0c9303b79653cb6d66fece48c2448c3305bc85816dd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 58f63a4c75885014006f454dc73be56449759032fb9731336868a53e160d700d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 eb97fba37efe3bf10b39fafbba072bce92b850702de5365faceab9b27eef7a8e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0f9e5ecebb7f2c0ab384194e03592cba89a755056b323722287315e80a658f27
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4ecea1df39891070dc2177d6eb4fb754280a2c46f048cba94d30f8fd7209250a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1c54ec682336d2be49582571da9a585f0776e2f14ae16d4c5fa33c1925f27f36
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 000ccb172002c19cf1ffa759630a5682214ebcefb8eaedfd7d2086f8a62075a2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cf3ab78d3ace0e7544dd8da53c6eec0a9d5872341f73e1b66aca11da8cd2730f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e6f39787836abe46bb835a3eaf32e90b1caecb4b7ae950d09d266aa40205c10c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 db4afb1b5d0d5c6d538f01702289e8b95129aa67f9941c5d0994c5d93ea9e6c9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9a6c4c4daf9f142394ee04d9d24d5c6fa699212e439d4184620ff52c40574239
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c11eff93f943f30355fd699853d94ee4def896011cb6df25cefe5682980fc14c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c9692f396314b95eed4c8eb7b1dca7e27aad446f5dc1ffcf75fb8956db94e63b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5410d29e7c3715d6338247eb104346e496ecd4c410a94d45084ffe10cfb6c0b1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 66ddb2e531322fa15e4a44e8f91b445eb6ab1c29a7bbbac12d3f10af8afdb047
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2b49b041dde353dfdbdfc52e27ed5206a0e68ef5c3f46eef7d682512397889a0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5e96bf2a1eafb45115124a80c4356452ce9d6a4fd7648e6163b65aa80fe43b48
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b253c3f7e2938f5b462e196a9168bee15acca4b955173ef9c9cba8a1f576b453
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a333e6a2029239f5895ea1bf4c258313c086e9efbc1a56b30b393a66be0434f7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 06d266c8d8898169f9dadcfee482ad7bd8be8cc313aadc1e6283c09e0beeff2c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fb32e2dfb8a4cb8fa439112685a24b039260374af1e4f597126294e22366db8f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4f0c47a29b31679d3b5c3ac679e62d51272370b750a50b929741070f9ad8d431
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1292bbb8f2d8ebc47189c79c78e12ae6f2f421591218189713ee99940d217893
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fb814929b0d280ed46689fe0afeea6333447e930a2a740ec8740532fadbf39f9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 869851eee81151a43b5900b602115674be9a4e3201ff001f0d5f93bfb846bbd7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b01ec75827e0c238a88d00207c1d9f80ea7c649180daeece344f8f0cd3981e5c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0a8488c96fd672ceadda01078ec81e56baf2d554a6bf853947a0cc67f9b6b185
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c439c2dacaccc6ae46f871da29ef7f5479c0b2c7d1c64f96136ebc216866fe58
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b6117bfcd31dfe97589e74f4568d35fa177340b62f699893a96cbb439b077186
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b40cfefd8d3f2c20781613e25f252c38d159c6fec9124deb17df6fbd24538330
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 74c3d2f3c7c17549b3cf412d5a1e3b38efc198385b34b0b38a4e23aad2089036
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 aade111e6b88a802b5800f75ccb41e2e53fff21c0029335ed1abb0c16cf4016c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1df10dd02f56d1f8678418fa5ce37ad15e5320544c1d06bc04c4dcfc3da380f1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1e44c7abfb7a40399c162fbea80f70c7f5591a2a5a965a5c8c40cb193455931c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 eef961563c6a2616bde29d0a610ddc61cbcb33ea5f471356a12cbc0ced5dddcf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3aef2392f065750fc91a565ec0409e63cbd98b81f2968e154090b7a14dce9c2f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5f90125bf536e124911727457ae0f5af4643e0c9f15e723934664ff39827626a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ddc18cf83136f4c37df04e59ee50d625339eb88bba0f3d928facf63fcfc79c43
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 73124764be534189cc532219de45f64ff1ce111a82cd380162a67b24707b10dc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 211dba2a584cea2e431eb7a2741eb6b281554d3de2e2719d31a4c6403ea53af1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a6fe2efacd7cd60460a88a26f6d08fcdf7bfff6f3124f62431906f13f145f627
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 00583173706a70b333c238a30889566ea40ce40af5cc7e337e9dfe2ee4bf9312
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c0ffd11b47a0549af61afaa63c0780d29f755039c11746cd189a6da94d049ad0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f41f5deb1ab9e4d30bd397ecdc8ca9ce87929bff5574af21113e80248c5066d6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 195c9bfdfeb8a72a342b9ddcf910d020583e2679262722ac63237823b10f2300
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 caf3cfdcd466a980ab65f820f596c58b75fb2677a0d17d7b7bc2249b451cde09
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fb618b5efe07d9660675cc159924056d5e1fac9610518d5763bc09adf97f369b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4db49b27cde356476d26de7d16e8dde69a246988c2120dd037f45eb62fd289d2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f42b72f7adfc369d0d89df0a674204b3b2c9522a8090a15032cf9d7d5c888e51
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ec5e393bdbbfe38f4241dfaa133898688843dad32f8ae67a90f4600811fbc2d7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 07f2738701d98443ca9c73bca981b4ab036c337e28f0d0b9e1e8e3d0ea6602e8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9fe63e4ed1e1695efb71bc19ca0b53abaa8d5e410ae414aa57d477118b75b9ee
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 82f1aceea5b0adb8137550fff8f6af7d802f64d1d2d896c482be5acf85682ee5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ff5d5ee3e83ac6099ec98bfde7fef96eeb4db1c3aec8790106acbb5dcec433ec
          • MD5 SHA1 SHA512

          logs.dat

          • Path C:\Users\Admin\AppData\Roaming\logs.dat
          • Size 15B
          • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
          • MD5 SHA1 SHA512

          server.exe

          • Path C:\dir\install\install\server.exe
          • Size 561KB
          • SHA256 c4a279bdfe68b50fde65691e7ad83263fd2ed8b0a184b605b6229bcddeb02c90
          • MD5 SHA1 SHA512 SSDEEP

          memory/908-80-0x0000000024080000-0x00000000240E2000-memory.dmp

          memory/908-19-0x0000000000560000-0x0000000000561000-memory.dmp

          memory/908-1208-0x0000000024080000-0x00000000240E2000-memory.dmp

          memory/908-18-0x00000000001E0000-0x00000000001E1000-memory.dmp

          memory/1072-1-0x00000000754D0000-0x0000000075A81000-memory.dmp

          memory/1072-10-0x00000000754D0000-0x0000000075A81000-memory.dmp

          memory/1072-0-0x00000000754D2000-0x00000000754D3000-memory.dmp

          memory/2688-104-0x0000000000AA0000-0x0000000000AB0000-memory.dmp

          memory/3936-8-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/3936-17-0x0000000024080000-0x00000000240E2000-memory.dmp

          memory/3936-13-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/3936-9-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/3936-79-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/3936-7-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/3936-4-0x0000000000400000-0x0000000000457000-memory.dmp