Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    13/08/2024, 15:27

General

  • Target
    93a9e046709f29362beb81e613fb52b2_JaffaCakes118.exe
  • Size 283KB
  • Sample240813-svsapswdlk
  • SHA256 eed525513fd9373a4ffab308f35448c68e98e6d8e10ef0e943b338e60fda5f59
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • daimoom3.zapto.org:288

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    ÎØÃ Ýí ÊÍãíá ÇáãáÝ

  • message_box_title

    windos

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1228
      • C:\Users\Admin\AppData\Local\Temp\93a9e046709f29362beb81e613fb52b2_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\93a9e046709f29362beb81e613fb52b2_JaffaCakes118.exe"
        2⤵
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2516
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3068
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
            PID:340
          • C:\Users\Admin\AppData\Local\Temp\93a9e046709f29362beb81e613fb52b2_JaffaCakes118.exe
            "C:\Users\Admin\AppData\Local\Temp\93a9e046709f29362beb81e613fb52b2_JaffaCakes118.exe"
            3⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:3000
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\system32\install\server.exe"
              4⤵
              • Executes dropped EXE
              PID:2256

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 05196c548861fe14a9764790ac0fc31e3da8bd67b5bdc2428265d88e1008d94f
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8722377c251a5f257d6e4f8d9c207d87eb6d2230955ca1304d6421d3d38decae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a2c531bef870efbf98ff4b2dbf0964034d9716993de5cd260a768ed4e51532f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 964f0fe07e75c9201e9a3da1793ae69fa3f9b2738993cbb594a8d4288d726c88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8779b023ff6ec15a2c72494379ed655dd488f4324356cb37c0d12cc2ba6543cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f91a2d45c073372abde430d007958a3b3125ae633aaf2c9369225b2aa2b0e07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4e5600134cdc784b416e89bf1f368d160592e99f9cac9c7362fd6cc112e20d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba54f70f8a1f60e0ed3fdf9293bc2696734b44e8278c1796bc3a3174d87cad98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b035d78eaa3f0bee1714977e348de2a78cbbfa0e47fc9f18a854a7ba5f2a1b1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41b600ece1fbd5746999ce4bc4f677053fd3cf56f62d32977c87f12245ebbf5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56610707681f0875e079b725192489872c52d554ddc3c14a394c0b431e62822e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af32dbecadc19198bcf32a70f9e0cae77068763a89b9555838437d8f72b41a73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9657cfe614bd9957ef846f7b723ee43857669450b3b9628fa9389500b1b0c925
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9d278e54a8a16638ff3216e68bc6c796504459522f79225095d2c254dfe84b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8f1e936f4629aac1584d179e1d3ee0980abff63a4a9a69cc157df3b141fa700
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5722014a672f677300ab31c3c029b31f5589f068e6b1c53d04d1098d80e96c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fc6933fc0d958e2efea4ebc4cf41da050736abd75156b3df0de8a65e02db49c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c86f4ccf8b884e72a2ece9a70e01b572f7e26a57c8a27b069aeb4afc4d74cf4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 520f14e6a193fcb04be6113ab3f4a5d4fdb0967c4299fc0e745b116e3d9f5469
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4021783c627635a90d993c8186826c26ab8bb098c057ad9988b654adbe9d3fc3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b42354c9a7b2dd3bb083b5e75029f9468e6f17b905a93ea39814da37a53aab40
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a41fb8f90fe82422d2d399f20d558551587c426cf3cae48e682968373a29b27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2107c2d7778421dbff2cf5e9c6c0621193b5ec3eb057f8ba4b6cf1e67a098ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f378c6346071642e3932ea0c20d273a1bcb5a5741e7273f64009fb13c9d4ff4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05274cfa4469289c3b579035433aa69d8b6735c7d83af0f53a17ce3694c9e370
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7357d63f04a7387ac7b72adfc415f9eff60b2dbd57ae785358011317b749ebab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9837cfeabbdec52562dc537acb6948bbe15c114752a4aa95cbc79b519f951a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d5b4b320513920af325ed175c87ac574413b53e2ce6df36a662194acb1895f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0cb69d9ab3d95afa5301632cc5943d1e8f943e887a9b94560a80bc767144ecce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15f161d01b9900a7afa92807d844174b4c2279315e52896114bb2946eacf9946
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 943e8c131b5d95f07b5d451afeec54760ecf27622cd312d79bf3c4510f60ba46
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d881c70fff53568ad8427866a2ed378207bb8640940cebba257c227b870718c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 507f2794fb0a3a6a2d2f992b6c0192d818e60c3d32e861c0cb3c02c02d147e84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 035363622c8425f5705d177c1623553c477ab30c0bc065cb4d96971fd5f96db9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01b604c5a74b9500c147843ed22e9c96ee4360243ac7197504673e2a98174c7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2830a084b20a6529ac7065588d0c340bf68984525979df2cf0065a6935fd16b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f71eea460d751eba2b15bca337cd9625d292e8e87de23a3813001f8875dccfed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f26399be4ac4a3ca436ffbac2e8435015dfcbb78aa2ce5abcf4e3c6c5fd3c857
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be68c7a2eb152ad3a8bf1a330ab79ddd43c7701cbd697c9573884b064e4a0f4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 726773301f73f1d5f079e1d4bb0dc7f0cd77cd9b385eabec07ad69eeeb4a764d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bdcb45c1f8cf9048eb0ca67f3ecbbfd81074e2a8d73ca14820b90edf392f203
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4694002db286929eb5959fec4acf17c7a169b1bf29f335abf1ff7bb115621ea5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3d61d8693f7789f6a5a98708e89eebcc4d561f49adc7caa15b572059282da64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cbddef039e903aba45048bf90655c7d82915556abf3ea190bf10b91558057e78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84ac86ae8483795146f16c8fb6aae881c785fcb686e6c87afa0147c36c6bb86d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ecb263c5cd90107cc492027b2ec779eeda63cbddccd9938f6aa930ba93535bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b92ab69750a3e51c34e007aea09ab1c4a15ae3a888eb37c26aec1645ee0e822b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95f2856210865c07b851940a5dd3dfe10fb32ccc643edc92efd24be502bf590d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f881cfafe4c750e6c972ba4350c6d7fcc1406b3218d90c0d1e3ee8486896ecea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89cfd78c7b36f5a08952a0f51fd2e337e06ee3a17bb0c76fc1173b6289ebe7ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fa74a62989e9ab4fe5cc7ff0950044cf22d6eadb9c58cfb2e38110b5d343385
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e7101ae56b12f1771007a92204f0acb0ff775ef058b3d526e06902f22089987
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99e2be8c873d5af9dc37c3cfc9c781465beb667f9d095f320928a80d17097c0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53ab5d50f27420e8f97eedc828d623a7b8a6ed985b8af561ca3a210b0d0c4c60
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f66257ca0ef5dbb46b1b14022f3e83502c238baf5b3d925db2886de675fc2096
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4655f9e0783ef6817d8bfc587f4674767e5dc9f2498e0b786d1b08b7c7cb97e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ae26972fc418650ab8cf9a3436c600e7a691e27164ea39ff9bd4a2169510323
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c40fa276c0553780dd3f0033dcf1f5e901ae1d2469c21f12a35f511c6479846
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23a1be0cba28a26d27354ae18634c58f3023224ee1321079538ba361b3f2f608
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9c0c47c4f10b720bf8050283654907636e116ed2c431e8b45dea16e881fc300
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 321a01648f632901e5735a8563663231443946ff344869cecdaaa9953b30d6cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d34ad982e1724b79bd04d4bf6bc88358e53c7753598e95cdc5457f382b6889e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26f43690467165bfcc052a3ebd28e102fac262c9dfcb731b12b6cb344c2a765f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2b04c5b3c36b7596552ce5fd7da3eb468d212417cb45a60b09f42ed35da7c95
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa303556e0db02573b06779024bc40ab3ea9c5135495c09d31b1f2181fb34be5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a81aab3370ca5e0ac053465a5e15c593e84dc42d626f0ca6524c0e38c5d84c19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cdd6ae1fb729b9fabfdbbb3bce4467f0166fa686109c302d482cb6e1b97c905c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21119d973b5047bf138e9a9686114945c4052ed2f3c580acdf49ab0ef0400b28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75e8e8b711b7b8dbaa8f7f5f736eda9513431b0d95f654230c28b82d68f9ead8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ada322215ffa8ec4742a7bd5eb7fb8db81fcf69499a81da1a93634582fcf78d1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05eb1542616203a2ca4fdbf25686d81875c7b9bace49de02e17f75b293af0501
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4025ed607ecde7d6a369a6c70dc0e563844975f4f5698b5604db0645586a1a25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73cd11f26afcbe626132f49504808f024494e52a0ac6acac95b7a5ee12d039b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 338a13ce9a2ea2567c9a4312bdb28b1eea30bf316a1a98143ac140ab1a7288a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1827f668a5017a67c78c504b504c7ed1b50d3657a4b4692ebd48a4597b15b9a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cadcb938a3ff8e37c76e1dc74e60c5e0c3b0138570ca644d841ca3ac0f38d47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb78e242f011030ba15f0d3123cde800b315b4dd3e76a135190bb47ae131d1d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c24507401100f976136210402911d1cccb2a53f9c9358b2a931ed2dc2512275
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4da2445ffa5ab71537e614c1cda73c1d579a048111c8d8b97a2872b96513f50f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 505830df76fe821b77c90d79b6f5536be1c662b53cb101b173c8018a177f9357
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99012c286808ea392f4388b2c0ba9b05e63d90c68bb4ffcc27f67c3b661b45ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e859df68ead46fd66d565e3af00b7f6d1506c86982c3753b5ae813169eb2ae8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a0fa4e6a6c3e5dba71444e448cef41cd39861c3a89a586a092f576cf0986453
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a66a5ad96d5cf4e06ef6950205da0bebe86539516c3fc1a4f33147063e30d8a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3483db4726497951eb3ed574e14d024832e5f2a3d3c1315211cfb10675e7f68
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ba911ce509212bd26fc31dc50afd847c33c374c1bd196fa7886e34049fc7864
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92fd2b899580a5570eddec5ae85c7bd3f21bd316941b35cb785e406ff26f1984
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7220e650b4334fea1c70c08b4d96f828bc69af17a6ba34da26ff63370f2160c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3da1c27277300a64ba415d66c47d91b936cecd747c48024e28577e636bc0443c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13d3cad7859de97740c0a89dcb3446396161e1bcbff632b1f9baf525613108ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00fc7d48150f88ef29e43111244c1027eeb371aff7bf7ec16f74a26554fde15f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a9c4ab094b9604ab7d4c41491ca22def4b9ca8c08f1594f5b0562d99f2e9e33f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9dfb117de6bdc979458528d9d19be25c41cfa4e080e26c2f5a4030d82aa12b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a1edf810dde018025b7b484c32c7927a8d5913ab4da7c66ca8671151e14b225
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9964b841773c4166cea0ef1a0966170f50918d76af086f9dc23c32c5aef8a874
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89088b2904ebb2adda9c6b4981052bdaef0e32675e762f9f0c7cdf36b2693e78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 632398269d646c94483d814acda1fc22bf5dcc359847aa5eae8ff9316c494e99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a2630d8ec7521ac1fb6cd8645ee7c804706d1f87c8ccf192926e0946e4ffe9f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d2fb4f6c42cdc8d8b78f1dce5c07e0a5deb0d05de21cabd81cfa9c65e8bdd97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b7511fd20158179c3ff750e74ddf20e1f2d41829d0ea08d1b983c05fcaa55ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e4e73034dbf2ac6b8d1b8e7eaf59efa62dd048aac9e2ad669af0df9f645dd14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cdf5cf8af1c15af466cc8abaac7600a12f6b5438dda6ebfecc8c2810f507020c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ee033e50de8c77e3d17792d7b9bdde9e73bc7d86e11894d5a2dc5cf4932af79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc5f7c55fcc08593aa8de523fbf7b4dbb99aad5dcf8f62069baa8ba48f8396c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bae2f85c034a8c555319e07d88c9574ea871183b23274452bf0c272699b3a924
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 174d535ae4baf29a19a9a4f3abfc44e92813afb91a045bdc22120d2ff16bb8ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2c9309df51e04fabce9826f6fe1efdde547a1e94fede48233e67f57f06351b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10895b8a2402a8c8fd7340fc6a84b7bfc2db4e24db44dc6aa7a75d8ca61a43f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ae692770514f41bcecb0bfb50d372ecf5e67cc544a6eb79155f62c26205736e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 437545608b5440db42ea609a3e9ea5d52d2b8646bdce5b8ed0bb4042421b85a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f85b7e3ffa5e37c94e5e00083b6081c5839547be0ad197415e581a24c0bf65a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecca6d799ad99aca1a85c808d4c646179684426e68b6e9de02ce4b553a4d5bb1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d83505d14339ba8a5b900cfb337c23a398637641dfad4d6d1430f3b14c6c9bb0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 952d5d6ba92a90782249e213dbf392398276068b434ec2a7c2eed34be732baff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8416e07582310cfd6fd69325e7e06a613953ca81e9691f1d81e6d1b41af8fdf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 641ec683b9765d5fd150515d6fe320ba987e768a41ca575caf3d01f759cae4ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad733ef91019aa3648d29b4ec90e75929bab8ae8b4be891cbeffc8920a37de4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eaa58db2d43eba39ae93a7a47b44d8e47690f5ad2ff347c2adeb93e15cd2c20f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1670510511ed4caf58ba6c28f9f5d26d357e309f3089c0181ff13cc6ccdc672e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9017821ac14ca6b1785bdbe0495dd988450bbd0d54cba55c664d82fbccd327a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 31e1b512d2a91840816a8e92929c20ecf28c5d5b6e4454926d03e6983a6e10af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6a0df7172d880323375be7ccc81041dd2c62f7491788100932694ac24d7a8f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72f35d3d4162d0a14bb24ffcf26341e15975fca3f0f4ce1ca7c3395e018ff3cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0a25bbee6998f718cb0c7ebf2931d58a71cf32f6a89171b04122b1032b926fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c0375227971722795bd2a394107f6ed1fa50d31d0d6dbe3e94667d382fc782f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4cd8626aad071ba977cae02d16f572b1527135cfffa5ac451ed021aaf3d41e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ef4225cb99f013c3d86f9a799d901c0496092bc21ddffc5e390906f738cc4e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25dd51dbbef939cfa610ae7a96243bc894fb841c620aa8422914d033aedaa57d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b113499750682647b02220beb403ba2eb164563d2da19ba8d2a1135cdd83ee36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a91ddd6bca874adfff9e525154d5c9b2cc37e73b31f29a7c00535a7fcfaac8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4beab8305211f0266ef644a12bd8261842098c157be8e0161c698cbb75ff049
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 473965990479b1f8ff52682f423c59c8be3c054611504cce448d237b786b88e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8abda15f0b163a501b116a0a6089bb5ea5f5fc7b0e066fb38aedc40605d19b64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ab66ab080ef0c0612f7651badac1ab1a40c3149d842c8bb4f3007891f7dc1fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b25e7a64e5471ddd1c3fb14ef9d062d4ba02f663e9cb2d13dd8c49c0aeb46bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c16fa6fac7e46b8c0e068a28d6c07c64e6fee924a4ecb277d3481cd52da12e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abddf3836e142481abc8d35bfbfcdba52a48bc2da6e44416fd8929be52fe0813
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d160299104823a7a1777f8782d07aa26cfc522cc5eb49e9e7d20520c803156c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2170319e2c47d62bb0e9e20ba1bcd874e0e7228661a5319b9073fa19ad1f7a08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d9fda3c27baed107978682536f91908e552a94a76453e677513c192c68758e5
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 283KB
            • SHA256 eed525513fd9373a4ffab308f35448c68e98e6d8e10ef0e943b338e60fda5f59
            • MD5 SHA1 SHA512 SSDEEP

            memory/1228-3-0x0000000002E20000-0x0000000002E21000-memory.dmp

            memory/2516-2-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3000-1797-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/3000-855-0x0000000024160000-0x00000000241C2000-memory.dmp

            memory/3068-1475-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3068-525-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3068-248-0x0000000000120000-0x0000000000121000-memory.dmp

            memory/3068-246-0x00000000000E0000-0x00000000000E1000-memory.dmp