Analysis

  • max time kernel
    150s
  • max time network
    21s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 11:17

General

  • Target
    8a280b6cf6c8f2da0eec17fd01bfb1bc_JaffaCakes118.exe
  • Size 277KB
  • Sample240811-nd22cs1fla
  • SHA256 001180408508f2de9c438c87859a24571733c2c1c202a3c7bd010c0b0b0d04b5
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • whysoserious.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a280b6cf6c8f2da0eec17fd01bfb1bc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8a280b6cf6c8f2da0eec17fd01bfb1bc_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:2028
      • C:\Users\Admin\AppData\Local\Temp\8a280b6cf6c8f2da0eec17fd01bfb1bc_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\8a280b6cf6c8f2da0eec17fd01bfb1bc_JaffaCakes118.exe"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:2788
        • C:\Windows\SysWOW64\install\server.exe
          "C:\Windows\system32\install\server.exe"
          3⤵
          • Executes dropped EXE
          PID:1512

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 230KB
          • SHA256 3ac2d338938d53d0002ed4f4354ece0cd4e8b433143ee1a1f3e14eb0e8da0874
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d43423642cdf450ec828a55159191dce9e961a209f25a67aaf86b18399219632
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0229ff851378bc539937b203de63e912ed46071ce882ac59f51d9f4ee8f95c2b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c01c4067b7707c159ea9eea5f3e2693e92d18b3d21e946a1b442272516353636
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5094da5a859530fbdec55288666995f30d4bde31d169c5d01fe57bb192f484c8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a33f2a8e7e56fce8f874eb7170e0d49fd64a1a95d169a162fee82f244576b317
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dc26c8af7d06bddf08d88aee267d8d1d84a6121bcf44eae9fd37ca3dbe57c6ef
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d4d1ff78952f73dd2c1c5e51b06b3db37da0b96965e4e77cedaa8ad2f0133a6f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 070923ed9efab09570683d50cf4177cda4f87bba69bc03803e7d1da3ff6dcc76
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8b461bab6732d15267b3d0ac2b4f5001d73520cbd217a1b4b1725a84ce923bd1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 451309f8b0bf7464bbc78ed55eab305ed91cefad2ea303fbe5c3f8446cce0a00
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e1d06c13baaf1f5bae15526498abc2d1962e9bbdd92c56ba7565cc56dd50ab90
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2cce71d002aecd64672845ffa7674319f116a3203331444194b9909632a27c24
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a23ac2f12cedb41bbb7a9f5ed6f14a7b4efa4a10ac84b6c8620c9d2d258cacc2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 65adc6c74b14c63004f483f53a951cf19794b3db6e9407e98a8c14422241908c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 02c4e7d0317a39b42c14f4f9d5cd390f5abbe2d3a7b80da36d114063a6154c1b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b4d0934d5ef30baea2ea817d1c7879813f01b53c98060512923c0c6afc2769dd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8ef651894b75cc5b9775550d563d6446cdd28575ad1e57ab3e24ad40b5e825f2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5ce4825fd16974ac3de9f8bfac11f77c0930ff25863b1b272ee496e4639e6c1e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fd91b33d65e622c5ee0c77d4f8ce42f1f6e623e34e8add11fb3eba62d741a05e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d039ade81cba3334fafdb47351458095ba33e83b38851fb5f1c79cb00d706d01
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2967df83e67145aa262908f7ace0adb60db63667a8c05a5d77b02bb1069a93f2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 db226a2744b79cad30f25c3d629fa8dd08074208b98ece7d6cf0c99590693df9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7896533318be6320974e66e5987575879b463690264e95700da9360b27d1ce0d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 001de748094d840830c4b9c4bbc7e69e67244e255d76144a87c49dcb2747b240
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9fdda49a90470d0105c543f32bd8e292525e98b1d3ff630814512ce502ac86a1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b06a63bebae2ee0e13c19dc2a481d7b8dac66a883f4a2751c9152e8ef07500f0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 23dd638db0327c3ae876d41e3a2b049b46744b87ec9be6d1690801ccd327fc71
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9e5ed1120b7627d00910b15532ebeed23400074bf9f73a4d045f268892f70735
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e5c33d960d6cb869852f56d5cea64ed42f3c44244cf02f38a0360ea1b9cfe9fc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f9dc0605553142d2264a7e42fdcaffe13e48e2d96b967a6bd60178fd7dc44990
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 052bf68381ca31a797f2c0dbe8fdd67b6bd7a3e81215bb0adbb3e9ddcb28c94f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6a1bde0bfcc7efe2ed1ada3b6c3723298a21574d79f4050275ef403803831a4b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a585900bfc09cf089f4d8752ff2ac3397011004b1f832f5fb22558e779890147
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 071c7a0ca8408d7f4330196b9a66899e27856abbd46b30e1e021d6430cc24554
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 36a8477ce218b2f850924a5df10a8ad17f9a506e9447f26e69dc513d885d6aa5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ae760d0fde4583cb4de03f269a4f13ea42fc4ad97270d315823f1765ff1a356a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ccdf3a17cf95ee7ad91f415fcb1a061e5096b5c20f435efc486fca383f02ab97
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1e5b51ef1056f36416e0d9347cd881b6f93e398c10e5d987582e00f30ccd267f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6d6ed0ce65021453c6a5b5e953c1183777cce5fe8660b3ac478d238683bc0406
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1559c596b37b02d28d7d7c6239cb754f721f37c83838da34fb4d9ce65e4392fd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 26bb380754242e9f91425a9066af233b3ce23c14541f23179dedefd99e385cf0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fe8b4c421b5e02b99deef410cda9dfc01589cc3e663b541917c114279ceddf44
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d6b0f1cbed2488f8986afaebe39249221ff3c5d1fe433ca78a0e52bd8622c963
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 90c6b28401a3bcff1fa807b8cff42fa09820cb525f52a1f1f62640e11be57340
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 119d2c9f34da3e766f8c990725d29e3bdf3562088dace6c4463844b648ca0ce6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f383d9da61224467b2075f55248ef3b67a99bb8e716d9fbf7b6e256c827f88b7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f4693f7d24af668b5db88ee859ecd9c284c2fd14eb29626b3da84a44c2a5190f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 13b274488a87d5de852f19160b7bc371283d39f4ec6fdc36a3d98d2935d9cacb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cbbf5a6178787e5913927bc73f061fa10970c3818ff406beebe656eabb3ec0b9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b4ebff40e07517e98a5e998dadc8663e6d4a5fe6c3a0af2309d4326ceae15ca8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6a20fbe95c1d9b35034a5b08fc49a25a5a6d53fff1da5c23e67fc542aaef4b6b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e1b44885df89186e9f20b545077ca617d244dd619f0517e01823ea1fbeb334bc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1026a3d05128d786b093d7490dead60ee8a1ff926dfadf6c2e1b4249eb630ba7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ecd92e1d8524b6324042215183c79b7e56a7c939fd6d49147bbacbcd089bb1b0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f07f5c0c0680781cbe8b5a28cbfe4d4ff31c7dbe730d4799e819a4a9b1ebc84c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7105a2762c000238f296935ddea80be6d582f02ed13cf7df17877447fe2e6345
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e558fb72a1e464b318dd7f5e71892a7b52ab2c54c589ea6eae4744927c2c0c47
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 63275c2da2977afccab08928d93b0991d638ae38fbd700b67f7f73b512a9fc31
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 35b3f1f386565fc4721a5bf3bcc06881c9bf6f136e7f4867103f8515b88209ee
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 703ab99055bf060e1cf59b39af590fe7039ec6d35abadda4080115ea82382d37
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 027116b9362a75f1725ca6af81d05c44b7e326020f5a5d87c4eb1de0378def93
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 534dcec2eb5b4f53185a2b786c3b20bc4eae01b13058a3b9f0a9026da13b0a9a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 73c50910ec7a505c7be92ccc2923472cfb321f44e08befaca23a078292670ac2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c246e28471b73ba3aec31ffa1d421e7e9e51b235301b4f86b43f90cf68221237
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6096f38edbf27233638f8e8d4a8f044e57f65f0f9b732cf6b36c2884b0ca496c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f19f5ff3054a324b68e8839f460329aadfc1e441c489dbb4d9a34b584a870733
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 beaadcd1a0c0356ac5f5f34599ccc63ecfb5bf8db92da1d92db58f28918cd585
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 05fc4ba5e980eafe7acaca4b4da3d4d507235566f7ee5bac097acd01297f118d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4347c8dfc9f18905b0a0ff3d5ac03d23e1f6d76b1d6926080197a52e4023c7dc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c4aa6d8bd1c4f01f70023b72ad82adb1568de81a9deea5fcd8bd763ab70ed68c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8bcba5498ff8ad9cea7ff2d9a8cab16b724ef430cb5156e751c662e89a576068
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d9a8d08979667a29c9a0f41e73abb94fcc5494246f64902c4e4327baca0c6043
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c7f2f088a36167fd2d5966c4d48e789f32455c4b03a361efb6bf2503f1c1f65a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c9f7a20ff713a4bb5c2bca8b840d9990046d9b3589f87120c112a247b0e9e00f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3285dd7fbbbf723e807784bd52962666273077a38b6fb57165c30296c0f3eaf1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d2d1b621c87f1d3d7e5d24e0afc169176288dea0fae60081936a660e687aa757
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 45997959246756358a05397117569f1d923c909ef849dde95007511792652c78
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1ea5798964f07d6bc2ef826f88f086288f3169acbeb50cfe2b2a922d1cbae938
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bc4795f974a3917500d756f6b520e5ca41e6ce41adb02a2d9ab462c9d090e283
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1dd6c01ca03a1c787e0e0df8fc59182cb7036500fabfc23711c2bd5a4a1d62de
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3d305a789b3c38d93164d575df610edd23d54a4edb60908b58b74c284474fd0d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 de89a6b23bf827d97f8d37058f0efd9bc561ac5893df43b149bb50e0e733911f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 80a96eff9983e2f4cde5cc892a057f2d2981af73f11984eaf8ae1ebe2d4d9db0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dcee6b7a974e5044a71c78165cd1212bad56355766264a2e4d7b4b9f860a775d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c378f9164a24e318decda4258057320b29a5e33fd0297694d26a2e2dadaafbf6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ce33e53fe3dd8adc95352ff5a2d4c8dac282ae88cacb62aa81050502b36067b9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5a6f844b284edd3706578044c5ba7341c4a6c9e8378dae8f93cec0419ac631f7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a0372f1664e01707880d035f09ad80502d17a36f2dee3bc557ffc0411e17340b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 49637b1ea8bf2fd5638be8b10e0dccf5df6b3778ad629c42079b2e10f1e23289
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d63abf34cc634d50101ca4210a2d666faf6145dff1cfcf84c13dbbfd4cc63307
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bca89483bc1bbb6843314886ba86f5bac62e671355e812fa515aff40273ef1c2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4ac7a64f551a9db6819f71e7191600a33fa7dbbf611603fad0065cef81ed35b5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d8211d7972a79ba243e9ab899342c1882212b50a4cf968a4b39cac6f2ee4a06d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a5be36874e61dc34a306fe1d8ac7a88f0891b8b1c13a2a9bca7714ef99b85141
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 48447a74267574e66a286c84c90a8aa8b911d8f04488b8e66e4ef54989a54a87
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3bdf40c3f73c0fa4c8fa677282d184f59eb4fd4686c37e3f3d55ab064853b30d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 254d19dd58c6340936e681b83fc5bd3d7f55c00ce4f9ca05d577cc2a99b1d17d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8cd23e82d5809948b331794ab85fcdc1a14b2ffa69e04a4313b4d28dd573d218
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8f2bb144e42c1224a64782ff75a447456285cb8322a8f159982951d7b1b1b79e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 137c8533611259e7cbe5d9cffaa6aea7e849f11e0e32fa0717c2c622bd3d6624
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 54947418f474ba7d21ad6f6bb3e3f6cacc789ba6d9bb3aa939dbc71a9722c58b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bb39a62100ae539ad365c943acd0493f386d87562db6dfdac5b62889cb34ddbe
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e36fc7e59ffea951535d167146f0f88669110393e39ec24147238844372336c0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 066637aa4a9894ab043562cd6320074395277585cdb159bf613da35f97c8a6fb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1830252451395e0dc6791fe03f2434d6f7568a7d1a6f6e2c2b9e91343317a8c8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4c67ef39222232d75a3d1435444d047c05585333354392db0db3ecbbfda633a1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b5ed8aa87b2c59db2f6877139b47395b31e33ffecfc13a9103e673043d542dde
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 baeb0b375bfaed765674645d821b6c797970629e52951a087b8ae418bc60bf2f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3c631859efcd9c00bdafcc7ff7e7f8929ca90e5065a56c24254736014f3f12fc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 383345af99b77f15debeb4f92faa32fb246d24c38d53453e8cb4120f86b59b24
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 04df30b344bda3a8d62b865aa1dc0b7d2fed863635c225e55e667f8fad10953a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d4153764f14c02fa2eaefe930bc2a758ff0e92984b42968ae76bf59b3d2066a9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7a91f790f4bc4cc4153b31097b1b704430c02bf5ba7b8fe6606acdcc0c5f5e3d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fe142163b1171081719e358329b344a89c7ebc209f098c752ad24da372d45b45
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9ddad5212c8647df90569053208bc5537bcced3bfecea899afa2fb9ba33579a5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1f9b9a8d007498367eeb44e1f27db71effe0ca353932be38182374c6af0441a3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5fb7183b4012562a15e18ec6631d28f91f4c809d3216868698116bffa57bfc55
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 64bc477b34c972dfff943717eed5e277dcb4da14c30ce3a146324b3296f14cd2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5ec598abc94287f660bb770f2df93617daddc754251195071abaf6277df05004
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 733ae7a62abd7d9cc302d7fed75fb6d41d225da5a54faceb70e5bfa860ec45a3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2a6a7339df3571c69fee473631590e6bfde322dd16a8802726c7f157ad5b94ce
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e10699f4cd595256d748abf36a4d1143a78a0b3d1d583f52ff4c873cc47d51d8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 034c07fddb417b21b0f9238dfb49a020c1dcf3c5a8f6b894742d6f48cab8e7a1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 27948b0d70722f1143f70e82b6af42d4e16d03d6950ffa4d4722d0a77a732596
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 250464c5f6097598a21763d6050459cf5552cc201c24d4e977a8776fa53d9428
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0854a0d73d41a525d65539b70d86460a98a25bc972d1b9a347201ee0c41876da
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 21ddf5a3fdb6d77c65e44dd3571dae926455193e580ad829fcc326b2ae8d7832
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3256ca59efc0f3c8fd6cc068828efb591924448ef1eadd31015c837b17607146
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 61f50cfb48fe08a8e43207660e174adb13a25b1963e5337f5cb79b6629db9201
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 30b27a88d91a7c340393f43f94a8c785d0447b89e295607757b9a883853e937b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2ff8b6e2689e27197330ca56eb348e63a43755c1abea82736544a6d4fc01af9e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 044f310e7d73bf4dc26965a58c1fdacbc53de4330a40646234875faa613f5eb8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 75e7abc1ef689f9c0e73bace53e907aca4cfad19a9ad36868fde621901b723e8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8948666b9207029d0fbb7c0bbf01b6d54ff2f6a7fd9787a2f3c100a4ec162f88
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d65e5a4ddce40254149f66dec741eb1b2def5bf76c64532a6fab290ddc42768a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d5bce4b7d0dad040aaaca471e25ee913deca84da37993ffcd1f3ac8ccb9ed045
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 864d6ad40873e114201a1dfbcbb28303e8d1ec852bfb6d8bc0f659263b4ac9f6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 30bedcb9562e503a6c2862959ba3aba525e72b1ba196c50369ae6265e8352898
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f7e01f75b0e6a3e36e8246747e5e28acd322422a8ae21af70e1f61c6211ea0dc
          • MD5 SHA1 SHA512

          logs.dat

          • Path C:\Users\Admin\AppData\Roaming\logs.dat
          • Size 15B
          • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
          • MD5 SHA1 SHA512

          server.exe

          • Path C:\Windows\SysWOW64\install\server.exe
          • Size 277KB
          • SHA256 001180408508f2de9c438c87859a24571733c2c1c202a3c7bd010c0b0b0d04b5
          • MD5 SHA1 SHA512 SSDEEP

          memory/1512-335-0x0000000000400000-0x0000000000458000-memory.dmp

          memory/2780-0-0x0000000000400000-0x0000000000458000-memory.dmp

          memory/2780-3-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/2780-307-0x0000000000400000-0x0000000000458000-memory.dmp

          memory/2780-21-0x0000000000220000-0x0000000000278000-memory.dmp

          memory/2780-7-0x0000000024080000-0x00000000240E2000-memory.dmp

          memory/2788-14-0x00000000001D0000-0x00000000001D1000-memory.dmp

          memory/2788-20-0x0000000000350000-0x0000000000351000-memory.dmp

          memory/2788-22-0x0000000000400000-0x0000000000458000-memory.dmp

          memory/2788-8-0x00000000001B0000-0x00000000001B1000-memory.dmp

          memory/2788-1449-0x0000000004AB0000-0x0000000004B08000-memory.dmp

          memory/2788-333-0x0000000004AB0000-0x0000000004B08000-memory.dmp

          memory/2788-36-0x0000000000400000-0x0000000000458000-memory.dmp