Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/08/2024, 22:34

General

  • Target
    9503615bcaf6a0ab5ccea18be3fd600a_JaffaCakes118.exe
  • Size 674KB
  • Sample240813-2hjmgazdnf
  • SHA256 f87079fc5059cdd2eddf93d896e4178ada6f5fb33d2348a38c5da7315a3daa85
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 192.168.0.114:2000

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9503615bcaf6a0ab5ccea18be3fd600a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9503615bcaf6a0ab5ccea18be3fd600a_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Users\Admin\AppData\Local\Temp\9503615bcaf6a0ab5ccea18be3fd600a_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\9503615bcaf6a0ab5ccea18be3fd600a_JaffaCakes118.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:5016
        • C:\Users\Admin\AppData\Local\Temp\9503615bcaf6a0ab5ccea18be3fd600a_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\9503615bcaf6a0ab5ccea18be3fd600a_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:3020
          • C:\Windows\SysWOW64\install\server.exe
            "C:\Windows\system32\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:2084
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\SysWOW64\install\server.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2616
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 564
                6⤵
                • Program crash
                PID:384
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2616 -ip 2616
      1⤵
        PID:1932

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 e610ae4e11873cc497e875507fc33f28d52486e2c6263cf833a53ba26a7a25a1
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d73de60f77a9ccd7693aa0af073dea0a2b4a9ec873787389b3583cd1442a11d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 321b65d2020c43b99d2b26c445076f4a72ae82105b1659bc117e12b5b2a4da85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afb4c1c822698f12599c304570b46f36ec977f077a188d7bcc6fdcc635732f52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34963dcce571c6280f56b7baa69188cd25828b62261c15189d25b3ea78688f3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a33ec438e8b4eb3b68c6310d331cfaa95ba4fc6c39b4f9fb869f32309d9182d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93b771de2eb1af30ed8d098e56a5fc544f3433bb18dc0d481cc41dfaba1c9b8b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab39469d74fbafb83121035b21d12920759656055865476d34df4e7cfd7a18c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ccacbcad40526dd2daafe553a5a4438343ae97300f85cce493804df542501d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7ad6c8946baa45447801674d8d442966ba9b25eae5a5600151029e7e959e095
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3991c67e833882f4266b4967f45da5a08ea32487a6eaa8148dca33e27955cbc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4524084f549d2444fd903f5e419b998b69c0ae21cd64222d67ea5c3c0325691
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2039f6891e49c919242b7ecf4fed7f964563b5f424563b036f58481ec4cc7225
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85fbdc2284a335e8dc3b591e140b1b478af32c8de93adbd16da3dadfd9899798
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 611f656fa1ce1fb512bac9dc7533bc76ae2e68637bce7ca4c6c7489acf2fe803
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39a5d2ec56c311c3113bc222f29230ebb3b3e06804da204c4239222d91ead7d4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 933bd6ee79061c4bc8f0a4c89896396b69c6cb3f551e3d4fc3ab511995acca8e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0d57538c32e3c9aa12601a92eeb2a6d8363a56ee4f3e20a537c894f65f2468d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34d7fb71016bf1699f53cab75f2b96ea06f00f7fd4a3024c1edaa88fac6d5546
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9ca14a6d7185d7e11cc44e5d7f61f266892d20b9f71185b5715b2d5f60b94f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 596dea74dfd9445c21a24ee25a7512080859931c95fe1f9abc1e14fab1108a63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbb06eac153c786966deffde12e212f8e5f2e17b94612696ef1a5603cdcd3cc7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ded5af6d730abea7031793aabb564e48e4ea2c2a161f6aa353aef63327aed51c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df16c7cf8a28945674916f50a58a853c8435f919475243298e3b76da78056c6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bed9f95556d789b9156277560cdf3762113eb492bbbb1faad7ae91cb797f753
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b36d355ad37c5bdd7a8e9d3722e1ef29bf2970bdf9d42bb349e9402e91de1e9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 926b4574db2c44cb6143f07c54d7696a2d0b4f3133111d2e82a0e2d0567c601c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9bc0b7598a067645639c950db58a50b86fd9742d5950131881a802798df8ce97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c7f1aeef03d46a01f349fa2fdca1b7348d9d3cbf5b4ea94ebf7625b764ea61c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecaa481ee34a7b7aa05ea01fc8784d6a478f1d0f6297ace115f91e03bd35b301
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ddcc6209bb91aa9d2c9fdbacbaeda34065eb455e8de894dcc4ae2cbe7f8c075
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 efef6d6bbf694369d837217aac6294a03ce8e52e0afb9d57babf8d4a605af51d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ead4400c1b04377208a5de5afd10d286f63f1fd3130daa05398e4c33dfc9d2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3590c69ac5d83b86d61040b963717fc3bed4f86f39f2426009f15193981dae29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9026527776ecfc96569d2db346e514c80080115005addf357543b210132c0cc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84c02c21e505997aae69c65d87aa29c4b8261bb258ac6b2aa4f6411747902b49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8500b881ce5cfd90037df90dcc97a78dd3fdcab7ecf1a1a3ab9cab771a2351dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e30f0d1bcad3150960879bc7c5c092f134b7ebea4d6ffe2927b6785138bf1a3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b20152c1bd21ddddcdef3c610cbefcb4d863bf18ff60a97df4e154c9318f1838
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a84686ec88e9357f7c314292995e4f00a26641a72cac8467ac99afb4ce7900e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08a6b3ead3389012250ddcf58b7ea47b3e7cdc7d56064d5ce0a6dc1c9d2dac20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38386555081a76ee9739596f87703e1b2c2cb752c244ec77ffdc6edeba642832
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82e58b987ff35b881bcd62b776e201a9454db6aab481c78076d7e663001e7212
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7cf08f606ab65a3fa5591decf5c500618e4d6914018e50fae7985653b83b9e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6750cd98ac52428d0f09806f72307599515696501fd06ce218e191f16d05bb1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c5971efa7d68ad75b36fa674308ef9e6b07a8a85a12b80e4a7fe58e9bd5a4d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc4170b2c3c4a1c5b1f4077831fd5b2f93fe24fcf1c7ef860cf122634171fedf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d1dbc394dd0b94b642c30b7049a5a450dff7b26a9c8c2a5aca463e3e5819f40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97088b750e5de08140ac6ea9321e8895ee7eed723d03110bdb778b46a0095821
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd6bb264ef4831099349dea645f3f88eb246080608ea9905e7c6c28949595d31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05cec0c720f872f966c77864f9f8418c7528719322cfccf528cf18742c5f0764
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eba887d9027664d0b4a01442f515158569f753f26ce12f44e2a784cef9c5e10e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20002dbed77b10c6744ad7db433b9f3a7e15cf95d2f5cf4654a51ef783b6716b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 839c7e581a33cb0bf93bad5652fd984ac989d9cd633f4641f080a1b702068ca8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c20fe2bc2755980133369a2d102194d3a58cf9a07b23cd04e699aec74d8bd618
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2bfae185a8bd5c6ef8c1cc4710d9f2bf62a73ca41c7e0c32a20e75de2b90166
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b4f4483ebd571916f6647d084c9f89ea3c2ba6d1c32597e77f62c98b00eb48c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04241e0fb4ef214636c86982fad8942342a986b057ef066afd11f56df2f60133
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c517f6403c9252a6d140b43506673def17a4060d32dd192ce488032c9106e38e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1640c49724ca9127e77a30048bb754c23963d3b4bb57f06fb543c327d4a9ee35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10f0ac04522957fd3b5ababf686e21a99c7984f48f2aa26a768ecc2f496b16b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e11f4acea047b1d11eb219b1805a8d35a7f304351d1c8b5910dc12a1bc2a1152
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed79d18c8bff40e4406782b066ca61ffa2e6fe475e964be56e143dc82db1b740
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8190304e2c5d4914e69c53a0dfc6bf61091030ce6d92716b34f782f9cf4c5f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ac5b390b6a6c746c9731c8024876b330580ff6159b0054b4209954b2f1c98be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0ea3c526837959e27f63fe4937873b69eb2f6f3b7d1e5d8dcd9ef407029085a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42cd6ee1083fc9d52bcca105d9e50cb7c6daa730eac4af82afb36d5f8994acf2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0828139c0ac7f5ebbd028b2864a8d2c43893fc0cf2eacdddec712fcc412c70a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 186f421730f1e0a8a9b9dc9c053f0fec3c96ec6820148052e5b9587cf266546a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfd5217b295e683d447a29174f86be2fcd00af90099438b9e526fa00ff4cd3e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 980bcc0ce44173fdf16ea99f704e1b79bb866bc282e023a8c710dee72d7ddcb9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3742b334dd28539353d0e759b3f0858fd9780edca6783687b26e51849d62bca9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8d5b247ccff41e6effa092802e6554f9793887d62d58d9aa560ca50ef17bbfb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84fb6949b90e0f2e1b461e6c71e54ceb4ba83cc8998cecb5ea750bce4c9c72ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aceb7eb91f636922105518df3438c04a1e2e49b126b9e6d17e73289ebb3724a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 69e10dee15af4e9428af350af6ebbe4b200500de22bc4991acb630106ee96714
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d80af31db4f246979122cefb3a44b3bcc1777d0256f7bf3d776ae0527b4a66d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddc16ed4d1db392df6b891d331397fca9354f85f8f28936b9711326b72488d61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bb8824ef4261cef83eddabe402010843a98668ccad5686d6e760449a00be594
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64872d2f636d75e6166981ffb9502be3ee3a048195d2db66a2be72e7a0d59b5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9589d8ae1f441cda177ec9af408b0183489dedae5ed6cb268c4d5076b5603c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22bd77c154b87f624ee348886e594c0d65b33666d5e9f7d59711173787e287e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8c8b8d8c2f9ebecaa1a50eaab92dce261a01ae29ee1023724364fb6d6c72cb7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2abb3f4c8f281d2e5dd27ac4234e101bf96ac4fd8cf9151c7342a117ff21656a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f66ab383a9fe243ee971825435d3830572ded295bf41cac54df3767e77c2d0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d16251bbfd7fa98dbfda48cf0cce584891b8d102b1522b6aa2ab2e0830d342eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fc9831acdfb62eacc04890f250556afb82147f4c8facf0208798b6695431558
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9700b14529b6502701510c063c45b291ea1b5ab7e5f7d8c796bd2421ac6fde7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e2e9a3e4daba76ad059fad21b212af601ea1a6eef081ccd608203d0d7e6055b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a0995421d54e8d158c246b5a3acedfb4f19d4a099f425b8e1359879edbb3e86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ba0868c0c4b8b9920bbca5268e951bd792a892a5a1c57949f0d8754fc1ac314
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a023d3b40890a7fb56f0533c9019fe611ba33df86064d9185947505abc94b26f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42b48ea9753e00eb4bf8de71b8a7e4c7278ce7ceae7f448c62619c1ef83615b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c98818c7a2da932d886c7e97d6c7d36af9c55e851a808d30b99ced49e1cdabf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1d756a70f22bc8ff4d1214759ec780306e8aa6a933d4c2ea7e854c846e6f8c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75e84c127a738b3d9e6289d1474b4ade73c99af0b3d6802953c3a702ac69449e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aaad097635ae9488423b38d98b58c0ac93c2e89ed460d54b4a748ad8de5024fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22c228f5a61ac8c4f6d840e38bc851b31299c09b5ebb41be14828d604a95d817
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d60e2a71a16a214e71c869cc53e3ac9d39145c1e34088a424aeaf1fa0bd4011
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc335784eeab18fe180f66d794cb5506ef449f04ab6ed79f371a56034c5738b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b4de49c5329de755049d16fbbb81f5486d00c92f47f4e809efb527f8f8fdcea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87302de65b91f96ed1920b4c714e3c171faf023995d59c4af0ab1d9519329a79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d658afb4efc3983eaca12398bd7de91e0f80594d74e1de3e7e611e1ee00e1db5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 937cf7ae1db368ba27c45b23b8e2fead174b29f36dbc095cc394347e4ec21c0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86653ba64535d531b604d5f629900fb83bbb5f681486bb4395411c08b93f12db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be9d4e946f48dd5c88ba8f04cfd8a8213236e7b621b2f9cb445ef4e51dec1de6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd54091efd9a621d1d970713e6a3133cb9696982f32a7ec509040f2aadcee0d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 088ba51d51d6cc7eda0614658765f6535683144c49680137e594da500ff95884
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53194e557530b253650fa221f3970c5e85d9e5bbd08c02a0e9ddea14e1755b90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59fe36b3b70255ac05a2218e6f012c6abae4cf36f334525f52ca6665a70d1108
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43ab37e6fec2d56dd8e0e91d077fa4e1489f2ef3ee6e3340918aa9803c9cb920
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed4babb0a3130cc3aa389b9a53ad06b26a678e24cf23a16d2eb0169a16a3b9b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d488aa4d1e0e87c2e4e40ae917784e94b2f395dde9985bf385ef3cddc91deca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ad6792d933bfc838d28618bd5f6433802f908fe9f9b23472ca7ce2a66c5d878
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffcf80c0333dd0b1e8a9fa1ba3287b0bc5efc6929e5cf5e46abb4a22aef9c85f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6bc0b36f7db329bc3033ab9e8c99ecc3a2f6a4d5b334c73303780daddc98f07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2268fae5a3a8ea04cc4e2338079780602c44c8ee872eb95bb12da1d861f2a550
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf87162670f9d839b92f0020be6d4d1d655c1b195cbe3faef50b7e177f2219ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 603ccd63f37da2317f71889c85925af777d2b71f2c536434ce224bf2d4a13ed1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c206fb52e2f50194b0952de29e9d77d9ccbd014e85abdc2eb3f8c274a09e558
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41c2baa1c5b729a7997866ff2028af3a6aaac8f9dc709733408f8ac21efe1ae8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d1f960d9ed7d86c24be4fa0081e356e693cce750fa7f51da641683200fd7180
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b689040dae93bd529c821a7dbb4a782c4d627f275ede2aaf8943ad1113d82965
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa4aa29b409f4366c6c0b2877cf03dce62bd3b70260e469ba06e36c4d375f389
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2779450550ff25219705a742a002438e3b0eb1bf8c1017624eea6d77f5802c92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cd2621c3a147f7eaf7f92b74942782637deb6712cd79e3d8cfa2fbdeb50422d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d1a8c11ece4bb949a3804068e42944e9a5a9a25b1fb9fd659af4b74408c4b63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 700dfb1b6504ea54601a5de6b61df7f62d0e77a659b3d1c00bc085d317ace96d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c682854c6bc5428a85911b5dd1bb06fd8553802cab1dd00ba0875b89ddecb6d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61dec653da2f9084f5fc7c810f53e6c98a2cae547f36f2d40b9d712f7a2ce5a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cc6406c15102f78054e3a7ac66ef18f20c49219e51def02160630077b5b4caf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d296839d2d099a650cbc41e7c1e692d40c63ecac409c6ab0445d5d26814d110
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a2c5ec83f8f66095c3ae14bff6b276958a282514493cb28733bdd08a87175ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f481fd1303dae74fa52382b5c5e82b2fb0a9fa0dffe9b85a8001e8016452a19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6137ad4954f18274268b8269cff2e0823af921496bf67903468bf640d685c6e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ed813066bb4b607850ef3c93ee71911fcd45f518581c802bdbc4dac82201142
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4791f6763e3befecb8105894df7f7c8601fd766463b0f4ecca7aeb0d045f7b17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c556bfc6f3203e2a2c5a34d3f59564a1032c7265dd84895eb901dfbca61ed1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0821ab3b7f852e69b88201f9134312d7bcb9816bca93140ef3ebf20cbd7559b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f01efaf6376d1df56ce2bbebef5c8fd583c25062cf71f10a4fe988fcbb27e2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 515f217a87565cfdff50ac6b5b890807097ab670fb8da10ce3dd2e52a5e08fc5
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 674KB
            • SHA256 f87079fc5059cdd2eddf93d896e4178ada6f5fb33d2348a38c5da7315a3daa85
            • MD5 SHA1 SHA512 SSDEEP

            memory/2084-104-0x0000000000400000-0x00000000004E6000-memory.dmp

            memory/2724-2-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2724-76-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2724-4-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2724-1-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2724-7-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2724-11-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2856-3-0x0000000000400000-0x00000000004E6000-memory.dmp

            memory/2856-0-0x0000000000400000-0x00000000004E6000-memory.dmp

            memory/3020-34-0x0000000000400000-0x00000000004E6000-memory.dmp

            memory/3020-13-0x0000000000170000-0x0000000000171000-memory.dmp

            memory/3020-12-0x00000000000F0000-0x00000000000F1000-memory.dmp