Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/08/2024, 09:06

General

  • Target
    89c89286a795b438b7424962312f8ebc_JaffaCakes118.exe
  • Size 1.2MB
  • Sample240811-k22tqatamn
  • SHA256 eccfcafc1fe70b35ae9ed1e5a1e31febc0c53b5d833f071777849a91011f4714
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

  • borcanos.no-ip.biz:82

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89c89286a795b438b7424962312f8ebc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\89c89286a795b438b7424962312f8ebc_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Users\Admin\AppData\Local\Temp\89c89286a795b438b7424962312f8ebc_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\89c89286a795b438b7424962312f8ebc_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1912
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1940
        • C:\Users\Admin\AppData\Local\Temp\89c89286a795b438b7424962312f8ebc_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\89c89286a795b438b7424962312f8ebc_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2396
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1992
            • C:\dir\install\install\server.exe
              C:\dir\install\install\server.exe
              5⤵
              • Executes dropped EXE
              PID:4560
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 528
                6⤵
                • Program crash
                PID:4460
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4560 -ip 4560
      1⤵
        PID:4912

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 937bd7107fe71ca4697f054dcd3c6a9be9c1c6339ac44eb9b5c7f7a1f39fef2f
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 cc01ea594a7cf71fecafe7388966846831180df43978d645e647aed58332ec75
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28959a9468408368961aebccfa40372b17894c3cf64dd279b48e5c8c0fa52c3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cd17b461f07983be6627f18bbd36057e5ef5f3c815c95cc7df6ddbda8c02ba9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3804e4cd8c04b3aea5082e5e4c2f1b49a80d8ccc1290a379d0a8c85a6b6236d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7959074ac778a2a159f4b02386cf69fd2c5a82fd1214c34004680c8a128f621e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20b7cb48176a7ef5b764cc8fa7b8d594cebb86422afbd0aca69726f046a92631
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88738035fbcebf390702f5114b99c04d5f6368b54e8fab78c0cc3beec95097d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11c97b7ea539cc0e94cbb9b22e5f05c11a5b69371ecc7bd5febd2d9680b5b23d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 167b7c4be3b896894db8119382ced80d2ec51c96ab64c0129169998681fe175e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98dd71b9979c5bab75e290dea031e177b91229a2ce676e91bd80e0cdf0660003
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 177fbdb83ce169326bf4733b163e0100508fe2c6995b1ae3293081958747039e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63d4e737a5bfc8470ad3f8bc5edcc79716af63aecd62095432ee5161c8da030c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8d8bfd78d68a0f4105814eeb062a950e975b1516e1cad0d540bb37ffb5ec11e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ad35d388728b65656046ef73d8215049bc70da9183b7621cc9a0e3e0f435c31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d87fc89b61ef3231f5f508cb618fd0f1d54e90aacc6cee45a8f9533d5c924943
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a58688b47d9747d38f7ba5a7cf73b12dc47629caa5ae35061b5c2a48c79fc19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5d731c06d6693a0020e6504e98b81d1e0906092a2a222c0c73b7ceb80390b88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0bb2cdb2f899975ee030cf34606ed0b965d25f8df02e247d1e8492009991add
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f1325bf11473b8e6fefadeb651103be360b507fe2f67d137137a8674cdce5a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f382a97fa274f0a190f8a35ee945f24e7c6790ca2b203231e373c417c166e50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fdf4da369a6bf33a720f64c9d1c46efb173759d694d001f2d4f1d54f16cb24c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c42f2fb015832e400496635cf8899981911ab8746b474785f0b7baac101be3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8682b80631f81dc985717e5aa5253bc9a515c07f2d8e9ff0f54cd9e62e11aac2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bf3379c4a8dbce6614a4e3479371c8216b5249ba0338921e51213bee751b0c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 614539e0757b1769526299974b68ec7443aab0e3512ae543a584c88f8bddb755
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45a519741c927e27cd4285e97a7591eab3be70b4754f6c4667498302be7d460d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9cd073ba445802c4baa2cf5a3909e755de30c617d5791088cf9f5a52025ec84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb4d47d76370905fb9fa675b447502b5b8900020a13022355f48f0b3bce71607
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5a9a122e88a489dfa1e7771ef92f8b4e598ff41fe6c4340be8a96ff1e388c0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd997191efeed301f29771be2de045646536b8fecb1facace0f29e0a8f2f1611
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b40e9585fa52f8c5b17f91c4c6a5659fe1208e939fe3d81f313200db8af281a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 916c586030dc54d0836c31303b5d07799eef5169148d6c63aecb2731a6c76ea9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5242f919e69018391ed48c9ffb96ef79d9a76874544d63859c1c8f1e427a112f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fec0049f8d0b610f6bcfe8e9e9e9b1bb13f78fce525995e511b4681022fca474
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a91aababe4bf732b8aab6a2a60d90b594a082b67e8d81d5321b70357255f81e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da495c3dda935516baa9e5f2243e3eaa338574ad62f255ab6d68ee0acf4d9530
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c39e26b583b953ed7d6e412fece7f865efdc65948afa133e0b1a8ffb15de8b5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a059dc813914c11ecb2badec4899f3ce1064d82cc62c56e1423b1db051c4c66f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a486944fe576e0e775a8a4aa4dc709d49a21fab9aa7dfa14429bd2e39ab1f65e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb4dd76b620c1eea6aa59a737cddc7312dda6ef4c114cc78c31bb1229a432d66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2171daf99d79d7a8fc91df960d29913cb009262473247500bc2815b56ff97dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9d4bc8b34f5d7b14c477560105a99a9a0d8aa5683c7c3f70e6b49c3eb33add9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ee367bce7dd1dbffbb7de5ebc2272def6b82a2632323dfa5464144259fc7a0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb8d02eb6b4d891155b35081106f7397403073660f4235a9fb531d66e2c0b2bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4880d38543c7e7a767d12b717d0c79e0f70ee7f5883eb2c487b2ca93a47ab3a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0492947bde8058f4db26580956c1031c926e390c765faacfa5db554f1c7ebaa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b14e6920000f97367f72bd9ea722b2b547c6fc4e9ab4e52b6407cc11397b9229
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15b2b01baabacd98730f2436a507ac69a4cd1bc04c48e0cfab62a964f0dcc47c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d86420d1d6e5d5a7121ba642da37ee3511fc4b292fa07fbea3cfb5a74cc037c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b847ee07a6db2d8e55993061469edb7f8fab21489abb5a9b559393715bef7cf2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d917efdb1c496a0a3494a322103d76f56d2fb3d74160c7d5d4638d97c96ca84d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 687d6977366c97bc2e6052c3aa85f759313d4919f3a3cb902a52ea86720569da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d23907d657fd06f5c9332a26e19d3902444e6cc2daf5807c8de21d31579c244
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00380e9af13a65e8b7d298212a4241e74770fda9ace84c3c5704433019ffed0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2041563725bc8cd81e855887e1803c83ada5c703c88a7755e784f6488a2df14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e564775151bccd673d862c6fc196e4f272b9b5110590aac6e286b1abb392d281
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67d4dd5b3b1730df652f3989ede18aa8aeb8aa82fac7eebf32e9d32b7c61c022
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d2f9429ac410c7ae620664569cea017ff7dfc4b38a6ddd89d66a50a66c41f29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c37a9c1edb85ad51096a894495aa2cf0353f0dd0afd42318cadc02fba96e93f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 613ee512ca17d4f336b9738f1d2a464451e9bb6b4604bc3a3b31b15dc6ab8eea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 550472a3732284bdd7cb54d122e22ab4e83cec2a43b8642ac8526569e2a67ca9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3e9f98111bbfa75822ea5d8dbae8930f3334b47d75924fe4753c17a777451ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f56f88d6f009f56bf27fa254e5897b177e6c16c731d2c91d7e7788527951572c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f99beedbb279704c1ef82f089b30a5a3b6bc4b6b0f63700dc0db087cd7e99d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cde7c71599252ccfa051dd92361d8404a7434130e2c0dd7dbcc4904c9e7b2aa1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e497f5092140b8a42f17896c67e862d9a2baaeb91b384ea3781b0cbaf1c46702
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80835ba2c82144650a5982bd3c67141f2e59b6981cdaaa42c9937281376d1044
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6506329473309639e1ab1be7207ba0cb7e1be9d46390a9404b027453aadb2f58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b37867a087ad8d5de1477295b538163323e1f314b95273f9c992a42356948cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e61ae1684e94d97ceecad1dac2534b7f1cb951d9da6c1ab8e33167b5762be2f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c62a875db204e24d800457e1a4db1a48797c0f7c9168cb32c4e1dd1f75478ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 005acacda8ebf48ff6b9fda1d31bb49fe0447fa1bebea64089dabd6db0c0f996
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51ac831ff0246bd5ea2c9894dc2752c55bff382abba9ec6de6152a61d5c7aa65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0de6a9a3cd89b6a39255964021adafa46cdb1eaf264063d55a48210e1c4e682
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7758998eba582e8c9f3c061f7a57a1cc45f0b63ad433da656baef3d4e7b08bf1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97a7cda0eafd5153f238e5f8b658774afc8458c0a036e697c818a75f6573b6ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43bde4782b4cd136a6c6a30c119575e89eac02fc486a58988e93b9946ebd0913
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14db697bb840460ccebd85be84d5233ef209ce805bff1e0672f0c4b58704636b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f6eb5320db489a340b3bec5ad7031ef975fb1914c64798ffa9b33a8e0023f73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c1a8a58db4e8a1f40599c597168b6bb8b6c7f3fa8b62e5d253b78bc1616d3eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef12fa24570489762d80a8a5d8c70ed1c3c17a065813d06219ba8056be65628f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6435a27ca2efe33872f70323983b9c1d8465f65f7a6e313e97515408e4cb1c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 943503fc393316e6a64f003752c3ce3c21ca1f8a91d87272fe271e6991cb4877
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0728736059c9dd8b30559c4e49a3d1c143433e5e265cb9c9dc94fd02cb3fffbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4548c975ef0f384610ee888f69476de1efb71fde832f6e820b96956debfbeec2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba3054b2e0d9ed801c47d61c81f086b74e8eebbcc4d1fb11e26a1d5f9804d4a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d522677552a2801a73479fcc5ef260badde0394665a426d2593ecff88c217b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 974ec1140642fd29cbe4a5500a843e7591ca9dbb51b412f6cb01357de3b9775d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fd2cfccdf867499aab62a6b0572a521dd6c99a6f04167c970255e168bc884c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da3825d8ed8071afd43e5688148cb8576322f78a87a4f0d5ca5b2d1f561bf547
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84abbe1b007776ef75487fd201d4dd773cc217c2706156f8b8dfbb10cce9630c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9edee3e139db390b11132e83d849ca45d3a09c141d1185dd12a8dd439bb0fa35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a2b6bf1ec7e960b60cf7471869202249f7e8ba1e0c43aa93d6517ae41c69b4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d659e40fac9d16e3e87e052e0655b8d809eeaf27460185cab0ff843738ce9d0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fa1217dce8271dc850c70ca6542adffd77eb10e634c618b2bc39a6c9f757569
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbeb47a76d7bdcf6e02194eebac4ffdd89ed3b7678dfeaedf7cdc13a81aec918
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab798d8febf4a63ccb21413eb0b478e60239c8b6618375ddd734a70c49813859
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eaff06275653214ade914fba936c5caed9378903f1334fb7b8b2fd15d1444ef7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f68b4fdfb18331f649b73e174ee19a00706aead3bc35ab5135c42cfe1b10018b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac40b35e3c11e220797aef218f514cc2c89c658b855c348c697a775b6ad6dbc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 801f81a9b4aaf93a8eb5c3297b6de3caa49d5e0fe8e2215cfd690d34d3a3d427
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82ed488d78fc7ef7f4dbf7b304203fb6e378ba028dc089e13456cd0f3d628ff3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45b3c9a57ac51eb1b98215da8022c924b4fbea812e5205b63a5204c632e5844a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbfa5314158a28a1d3ede14ad12e105a99b3623c09a9d0f41915ff844c8faf86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c48743f3cbe6ab262ef6d13372ab6efba6983d32faeb5ac4e451c62c7a694b1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c6c04cb08bffe108208a2e589d982a83d953626093977ae84a8d3569a4b0492
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b4057f5f2afba2b72c1b0a94d9bee5cbf7d33fb683c23431691b2f49ae44aa6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d32d0d6c0d261021926b4c029cf86bfaf94f9226426fd3d126a96419e9c3070
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ff6609ecd7485ba9319feb5d01cde99275b25a17b9b5e92fd93266c3b7429da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 facd72f6806843152cc04cf46d197a3efc9c777f8eb44d6698337b3b875e394e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c92c47d289d466fe2197b4ec2650c51b8b769f77f62d7b2bf3b396ab4f5a1be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4844b9457038e9573f02cbe14c21be3a3e24de788230d3ec7ecaa3b7a50c9507
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92642f7c643594f2155fddae7e8a032131165622484249d740ac1bd8a7bb0422
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9726a89ba7b839ed1d5118364b942384b9403d0f274077e9c3700cac4f8d3993
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2cd3dc7ec67981a5dd42e91bd8919c4ff08551d894979c678fd8f749a2d1003
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95f21670f1fbbd589be716a1b39dfe418ddcbb5fc383fcabbcaa9c1d533bc23a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bde1b2e4cbebcf872db2f197ddc8953726f03ea01bf86da5c28b0fd7b95720b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1136ac7ff9f0c2afeaba1981e79c502e01a1adf11836644f895d83207dca35d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2f802c9448e35530fb28d6a1822bb8f2989ef5642f02a4f0021f99f774ca478
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e54e40c25bb9933cc0d4a5a0dc23fcb9c80cac0edd846f5f87aa78461a1c0ce3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dfbb8317e0faadf6fc4770a06b5d6b417ca95b1df3be038425e5c50c060ee582
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0db7a9eb8c437b83ff4d40ae9fb7dd8490bf3adfc0ecbb8993c7011f6a9ab789
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c75cf625a9ad9087fda18bc25a6a081c304889d0f42daccc223e4aef29a3cbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb66e8727ccdc881ea635b287854f05e7295e4a269499bbb7a68f2900547e618
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 598384787c43aec4fdbb72fc945553a8e039c9b643eae1c0234cb3dfe661116c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e56b96c3dfa4847fb0e1b343bce975c02043b72f45ee6036bf5478e32149e7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e31d525fd2888530fb877a778fb9e61afba66a3096a054ef8a35a989599d200
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d02d2fb1a5e1e78d7250b4260c4c20ec26b162c32fedc2f84a0f108b555319f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2661c29550002d3efa33f8bafc03bb5197915ee3aeb6b25a041b65371df0701f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64bde3bd1bac9dd550f230cc98d9e6eb73c7e0ec09ea4a29fe3f8872a74b4c3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70ca6a008dc3094068cd88e191be1db3b7a3434c73bfabd3b11611bcddde73da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 027216166d4f27d366104ecfeb993156ac3a4701fb76c83a4ebc89ec311ca851
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d1da0ad594e7e75a4e50d5cf7af8c701341475470f2f246dded5f6676725b75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71a6f4e421f49403283cbd6283fcd86f474fc85d595a279aa2e10e39cf74139d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44d545e13493f7c5e302f60f13d9d7dc2c649589fdf5dbc7a16e74aaeac75c8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 231bd1056934697d1c098a3950f349dfc7431e301b3a042f2cad41b119fbd16d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71c8c3db1bdc6e0e1af596e4db6e9532420776d18c66aa2ee772229783f53074
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2447b25df2d53f50b64fe76d8ec00f63651a31e37e6802294e0bfd6d86d77d57
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b51ad81f97743374922c38c550dd377820dc45f68cfd21fa5c7cc14daa65a1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7dc0e54fb6f83ada39b9e685529343dc425b3eee984ba76c0cea92dad2219115
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 1.2MB
            • SHA256 eccfcafc1fe70b35ae9ed1e5a1e31febc0c53b5d833f071777849a91011f4714
            • MD5 SHA1 SHA512 SSDEEP

            memory/1912-13-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1912-4-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1912-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1912-2-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1912-78-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1912-6-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1912-10-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2396-14-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/2396-15-0x00000000006A0000-0x00000000006A1000-memory.dmp

            memory/2396-30-0x0000000000400000-0x000000000053B000-memory.dmp

            memory/4560-112-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/4560-109-0x0000000000400000-0x0000000000457000-memory.dmp