Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/08/2024, 05:00

General

  • Target
    91b7dbfe78fc06e6ece9b1d8657c46e2_JaffaCakes118.exe
  • Size 344KB
  • Sample240813-fnfbcavhla
  • SHA256 8a86cf64c4c34fb397a3a723f38210b0bb4a38e380a90e11ece3db3c74871bcc
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • Pesadilla

C2
  • humbertofox.zapto.org:8080

  • 190.60.57.69:8080

Mutex
  • ***Infeted***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    12345

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Extracted

Family
  • latentbot

C2
  • humbertofox.zapto.org

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3440
      • C:\Users\Admin\AppData\Local\Temp\91b7dbfe78fc06e6ece9b1d8657c46e2_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\91b7dbfe78fc06e6ece9b1d8657c46e2_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1492
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:1572
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:2828
          • C:\Users\Admin\AppData\Local\Temp\91b7dbfe78fc06e6ece9b1d8657c46e2_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\91b7dbfe78fc06e6ece9b1d8657c46e2_JaffaCakes118.exe"
            3⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:5036
            • C:\dir\install\install\server.exe
              "C:\dir\install\install\server.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2288
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 556
                5⤵
                • Program crash
                PID:4736
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2288 -ip 2288
        1⤵
          PID:2344

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 6c213a2a55aeb12b2719c3d9f14fc69a9bd4b40b6aef4195e915dca04aabf871
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8ad4b42c8a5df6601e19062074d54823275a67a6400f9730a1183fcd0394018
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66caa7a9b4a01e3edb189534741f2340c8440e2d572d51eeadcc8bc2a65311f9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eba85a70b5ad7bd24958db8def22e9adeaf36f21f1786144714500a39bb0d8b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da80170884e247a9b1de988b9fdfa235ee3947ff346f16b01e6f65b6efc52d4e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8fd06ae384d354b2bb54384632894acc031b95d988694c46419bd23346462d80
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 92ddffb0e046fde2c37c924cad42c1a7c97fff5b3567e6d62624da3242744608
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e337424bcec56220495d17f9a742cdf15f1cb0fbb2c8b061b9c0992f0b60806
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4874e06c6ad5d1046fc86c7437b230abdbf0010256d92b0a39184d6c0c0c832
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b74b88ceda73568f1b2a20ee56131ee357f9f32d5bac757b57ce3098b3af2e20
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 572357b920d85d550d05c29e96e9b54a47ec9d10edfc65bab49ee1091b206bf1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6d1a2211e19e5585ec16ce0ed646198921defabfa06727e0b4e10aa752ecd77
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c479f2a884eb5975f4939b46840fecc30f8cf06abff2c0c63f36b0641ffc7459
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e04de6d00d48e4fdc384bbab68fddd786f372049e33e19ed87418f6c6f491e7b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 55af98210e2818c22df477d551f5205b975f69f638761c73cfdf7ed2037ce05d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 411ed5fcdd1ce3b9965a2795a5e2cc9ab9a7336019030a2da7a432d32043e997
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22dd8305925c997ffec5c3887411cce0b24e29fac73694de48ae47c9b1b31f6f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1b11cea65a114f085a76bec129f4a8ac4765623ee1103a7e934cbba308b494b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c767c8070add252ed78299e70594d4e36a90864f40e625fa2a8d65e5bb3782d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 654cdb714af416f9a751eefbd0d396ec391214872a453e7c0a443b32a1dc59bc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 39683c95a2c5d905d2257a1fb587bd333526e3f33616cfa125884602093681c8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 07fe7577bdbdc1f4ff0848b461d8719f77b295aed13226a62f79e1e0abe2ca7a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9b3da1de8aa360d30540c91bf78c0fcc28573ac03ad033609ebf8a3976c56705
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 743e2be62c0b184c32c478843563ab5536cd6af42cc461e4084c5d522a80cced
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e6e71e94253b2598faa09a9e8375298610cd70b417582285dc3cf098a35d627
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60c627adf43bfcf9dd9a5bb6ca7a6a883b8917416ba4daf0bebfde7ae8fc216d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 57b22816893f951c524e080896dd9fd3b9d657270dcc4c5c89bcc913fa7dff4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b66b49565bcea6345cd3450c6da808f8a1010c1d364614123e6b27861b495de5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13a27379df95e783d822e86b6dd6ef44fc1fb70a5a667b7bdc84d82f1c76b169
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2132a005a8a905cd9d547b111111f8eb1a02e6f06c61e4adace1b0c1b76727f4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe277030ab3253cfb53bb458025d67d634a77bd3c36f85299d8015f943b7bc41
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5976d2b19fcc419b35c98e2a801afedbfba6dc4fe928f3d08171bc61fb2e91af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24277a6c68dc9f5ba22262a7395f6d162933f8aaa8a390b731427de04d8f4c75
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad3427f5202af47905cf821ecf0a6a14a8c2b6dd7c756078b1dd2e50919c9fbb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2e43a421eadedf6a3c1544efdccb61242b56efe55b7d63c7966fabad371d11e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d8a18b605c8b78514f5b17bdd7bc7c5c5b07e9b90d4d6735f55c5dac7055e7fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6534815edf27eaefa5f76c9c340a35297056294b0f11aac95b4d5e838b2ef6b2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 096242027c37b3e3f6ec92863accd0c938d1acca25428356ba61c528d34e09f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d01eb469530348803052f8344060a1ea0caad72296add5004edd1d8b24141e74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 807af9e088524033f492eb64f20590fa4557cb9ada8958c872099946a253e33c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b18ef1c63d2df47c1433f45cac51a7a84524e8f991714b1437aeee61e9f81911
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 24ffec1d3665e369bd25c99b9de16c60933b93040fcc740d57be4fbdb7bfd4b5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4adfd5136781d79b32c6897057e060a20443e0781fdb8c59dac214f5b70dc3f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db3a3f982f8dd39dc0ce9ed0d68843da610e573c44f64e3bf835f40ce44a4170
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 247f597c7bd3537bb3bda0438dc4a518ead2d11bda5249a8b0d4e52753f86d63
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0330f3f14a20361d03395f314efe48a81d28417b1ac119186db67a436987c76a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a3c98305fd0efff92b1976efcd51ac29517903b6435e7efaf6ddb424d99c59b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb19b90e61144c3b4d8cd4a4acd1943f65ddf6a9429d85349d034e55f011a8ca
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c4a9132f69183c918b644f2998342d59d303eb577aca9f5ce667a943ea7ae97
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3da83acc750b349f046c8e56119cc4c9f738a141e92a1c5253c8736d9be1f594
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd01be82e2799bf45cb5f62c9dbd2980f723f4b79542b7fd404f3d3fa694c5e2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7f22df7b677259daa60a88e007d6b09fff1b62b9f872fcb365a3e4ba8c3f1d0f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5ab053701e87f5f15a7c20e521c9b2a14a52b503e14cc684bb332aa0fb17855
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f56d05d5267849284d3f9ad15c33d654a4ed40adf2f19f58b0fed5cfad01bdc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 79e9e033717999a57da92295b645a5ee702a3e6c04b642adc3fb79a11233d4ed
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab60df2c1740bad52bce29c37cdfe3e38fd6ecf0c38bd5ab3973075a6af3d5f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d13e84d90a693d64653cdcfb3eefc0fd70de7ca25a0d7d8104caa03db5dcb1af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3f6f021ae641aad0a402cced37dae54b85369713d89e1a355d9e0e374fb961b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d610253fdbeaba847db7bb10822f8eca78c73b65c393defdeb2790b193bebe1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e8b1a685746224c44af43b1abb36c7743020f0793e4b2a017032c69ea0ee3261
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9973b641562b283cd36180dea711bedfb45aff073618a5e0b2b6364579f22e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0fbb1d15ddb6375ca7dcb03b67504a5cc7d53d0f2eb598c785b30961f4fa83c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1a1737825e93c0aef32272d7c13678f8762497e06798178c23e66cf940ed8b1f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 abd84ff048dd09ecffa97ffabd9c8f1561ba41067f1bdfb5797d9386a26289c0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 01a9f33254dbc00e83fa9b7c130558d9419e383b15aeb8a7be2a26328c54f7b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42a5499ee892935bb3c7cd61b34baae2189053cc3518b8371844627f3356d362
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48548d400c5458aabcb703eb33fc6dd13595112332d05879a9b1bc020e4b8fb1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bed812f94957f741d6ff25145dbabf038d5a7cc5c1426c28eebd5bb2f8ff2a96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb519fea6e0863dc3e42018e8d841a0b710f4f711c88ecf751e97e3297135257
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6cfbfcb72dfbea692d230fd9fbe31e78851ada2da1935bb543c8c693a2ea20df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11c534dff1d86023c70d2985f56e251d67711c6a96e7610a323b84335c8562d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8099a50813a1e4e08c5fdffdcbb8f942e31d6297e7fbc075274c064232e38584
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 13928669fe05b3201b26954e90b896475d34b6fde79286f8931806c2955780b4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3063d03993392314bfb8aab9ab3646bce7ce3070274b7a3a5f485f81c16ee24
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34355e937180ec58964ceacdc1b43de261532f54f8da03e62c51c1cdd47f0545
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9a9f957571292c831c3c12118585d93143f023c9eae18fb4d7e4ba993092fed7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2d22937a3c9537451900d5ea5388907509fcb5d11836fe46b745d5815fa7ce8e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb3d9265b15d601b1554b5516469f492e540ed381180459a5dc36cf790a767e4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 be308a549d3dfe22f4c19e7bc8857f22d55e41a15fff432f0d2b6ca8b73b6cec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 037e649892a3d8bd021464976872a9acb5d5198defc80743a64bf013f67c8d64
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d80fe90da81616c507da2e2b5a8e59e2b1bc22c852678aed92c9481f5ecc60c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3bf38e33d7d9365e6f3b4313abe2b49754959cec8fae4ef1246c6dfb2fbf2e57
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d748eb60e99f1a9d84f0fd690e5bf1d6dac1b364ac8fe0d00859ec98ce72dd3b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53f208c15f05d93b4cc842076626f9fad9f207702819f48d644e4c0cbf00f6a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 05027a3d81d24ce6abfac1724de57d667263e01599528141683e5b2edf77a12e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 984d06d6a6009b87ace09651d9ecc3591091369a58711a11cef02f061aa289e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2dcda3eecc03a617eb54766857355b4edca42e3a5d0e9c1af64eca6ebd6e1daa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 97ca298117d6d70e13cc16a324e767c603eb0968452842c6023554dadd64c4ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e30f04739c97916d169a77237192cbc57b4e66d74090ab92e101b38e2f750000
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 23e9cf29291addd5cdc3687380b4d534d851b5acf4ba9bd730f3f806b66f9a29
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d6cade695c31cf2a3cf76389ce88fa413ad9ae5a30c5d63cfbce9b385e427174
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7247ae61e03549dd5b76ae3eeba4add92a9977ef93ace750d925a97488a451c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 38d3628f4e476c7519d4915733cff8f3a25e691ce92347eba5e18a50e76bc803
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 61d5af0525663ba3d7593b1884de06a3cdf46612cb70b572459121442438105d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7122dbc720478d181ad5a0ba3f504d0c431221f88cca4aab8c35cf19d70c3920
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9c5620064d6a85c1ba33ea478dd19b93db4e2d7e4739ec0e52d0a93304b980ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acc0675db20bcac6c223f0cd2024f5624a76f5ca04e00703c1c6137a7be5b110
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa117cacd8c6a1cbbd44fb3c153066f232cb93ba2c71f3be7064c5ee39a4cfc0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 112c1a80bf699062dac3dafc8ff676565391f548228c42b36e7a6708deb50ce5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 745fcc781cf11c0af9c4341018d61223587d84b48ce097c401518312495404bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2642411ba5b895b4b6123c5b604e4d7cfcccb3a8dba291874e9d18b429287f0c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53c1cdb2ec1ee2c2a1fa01a24d039e6bf965eeb51bab685242fdd88964e5fc9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f90d35139bb93df6dd9a095544f18e1054eeb403673b1d9e8a791eaecad8d753
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0073e321275a47eeb689454b3ffba28bd657014f7ce3c92fa247c92e0418d028
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d0e89448fa2c83d6f3a36e9ba653c9315e694402e47bb134e45de62ca4e7f08b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 72f62b5b3d020048913f055108c85c3e7508b387c7f0125f01ff1a7165d28f10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 21bf0078d95b2dad2441cb6655ee568367bc378b250d1c5dea6ff2d1643ddaab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c0fa2c4b08526a484b30813c142fc12958b499eee32a1a3ab1ed4a0a1370f3d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f85a371fef6308c144b759a8cad889dd4636879414760b2ad2fd873e4fc5319
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa16d9a4600b10d8730592c789c61784e64257651c0a9ae041dd237a90fd17bd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a4ecf9f0894698555c521b816b5614389bf1fb169ac53f1586db619d9d17ab5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7d79a1d1fc2948c876c010e58ac2e526956e0219daf8f0be8882889d87599808
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 386d5f8fede9388385639b596d8df7446c75d57d1a24516ec5e50077c7302f9e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ef6ab9a3f33742d3d73db96ec0107e0e2b45b5f9da1008aabf890c24aeb41449
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 229bd00e88f4c081dfbadaca4fab4304e5dd76d824e428e8953a603094b12f99
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d28039f5ae98d3ca7c99fa34322fbed4a596d84fbd91ba3648bd90f4eb471754
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4519bbaa15bad33d9a020b0eba68b441838c5bbcee61dd1d1d0602252f042e27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f41a1472b0940595a4c2fa6f360e847f3aa53ca6d4154d8655ec37043c7164e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 374580609e799a2a738cb5616103220ff0efea042bef5e901cf3da81053f6414
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8553898c44ec06b1fdd6de349d9d14eaa0b7e0d3e0f5a4e3b9a1c802d9960692
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5aa23fcd9a002408430dd93fa9ab81362fb250dfb3889ad42b5c0b882afb0766
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d035997cd0dd1e7e7474936e991191c91a275a5fa7857791707a49b5b1ccd8cc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44ef3f16ade002e096aaed25becd975b581e9cd78c5e6740a7b5cb90d9a51664
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d7eb519163dd6bb1538b9e731e3c6a7eec0cc4e513a13cf65feaf5bf7875ed5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71102727781089e6c6d5b27da9a15f1f20fe6fccb4202444b5cb4fb93353589d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6407fe2637329f61e6c8e4eb8ffa988aa69c03147152e5f6d96a8d407c4d30f2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30d0f29494925d290d4c38edbe82d0b4a48aea150d213a2c5d150c27615c5206
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 30ab37541ce55bc965e9c4c72c10d2d1e36a13d9c9dc3794ec3e04d26067d5ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f1e8e1ea89605882763d976f3bb5b44fb28966c4d01330c8a774d4ea7b45a01d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc934ec490fb5169304079abac9bbcde07aa513c26535c47688f3b2550aaea13
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 36c5d13e30df652526228a528f797025158dcdd9b8613732a55659c37d2ff78b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2144dcad660be920edc09a71a05c9154f0ece9cadb9b4830640bfdcaf54fc13e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fe238b5ebb93c3d79b4e1bd6df100045d3c226de3376ac780be23408f6842d83
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3ff92a9ee5c449c99b8945881822952029761dc9342e1f42b64ea825af1bbe41
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a992142ac197ef30d90df83c112bef8b7aabb36aa5bb56691ea7ade9234b3e8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e00fe095c23037f40a72232c6e31bedd74e8923af20c91e5bef605044d81f24a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 022f7dc47319c5e9e8b76bc336d1fc520ab087bbd0ef38c3f6fb93c020da6ba5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3afa7b8b706b268c4b2d97b2d14e2d86b8df30f9a4c5c889ab71963d92b28f51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 15451271b4204d4f42dd4535011f5538d36e0ed59e9d935005eaf7e4e241f82f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f274a1b8543577083281cd460455c020ffacbb3c46678d5fb713dc9e2aeaf269
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2c3a108184e57fe2dc759050d93405d05df76732a6e2f75caeb0504ba7fcef7e
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path \??\c:\dir\install\install\server.exe
              • Size 344KB
              • SHA256 8a86cf64c4c34fb397a3a723f38210b0bb4a38e380a90e11ece3db3c74871bcc
              • MD5 SHA1 SHA512 SSDEEP

              memory/1492-139-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1492-4-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1492-3-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1492-7-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1492-64-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1492-0-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1572-69-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1572-347-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1572-9-0x0000000000780000-0x0000000000781000-memory.dmp

              memory/1572-8-0x00000000006C0000-0x00000000006C1000-memory.dmp

              memory/2288-162-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2288-163-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/5036-138-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/5036-1024-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/5036-573-0x0000000000400000-0x0000000000457000-memory.dmp