Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/08/2024, 19:40

General

  • Target
    976796bde413bc28fc98313c464871a5_JaffaCakes118.exe
  • Size 276KB
  • Sample240814-ydpfdavgmk
  • SHA256 21bfcd1261892b480fd76ab8978a13ecc9d74a62756f4564be9f259efadee359
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

  • cihansux3.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3420
      • C:\Users\Admin\AppData\Local\Temp\976796bde413bc28fc98313c464871a5_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\976796bde413bc28fc98313c464871a5_JaffaCakes118.exe"
        2⤵
        • Adds policy Run key to start application
        • Boot or Logon Autostart Execution: Active Setup
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:5064
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • Boot or Logon Autostart Execution: Active Setup
          • System Location Discovery: System Language Discovery
          PID:1324
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1604
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:208
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 572
              5⤵
              • Program crash
              PID:3944
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 208 -ip 208
      1⤵
        PID:1464

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 9f08831df09cace94eeb5a904796c671a6b52ca5ca586dd87bf93e1ff25c99ef
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 e986a78307b41a0ee637d1e2569806f0668c0cd2a8679e76e00f9f5eb25592da
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 554aa998aaabad1087cd2fe2db93e4ecbfde782b1fcf58cfdd89ab4faf9caebc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4edae87d919c997c4addda252b8f9dc9214382c7fac3a1f9d1aced5559f2b85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f60efb6a94254142bbf67b375e7e98b59358fd61a928d984c90844039ca02b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de006deba2f00e866fcd9627dad611d615a42f602f2f8858d7c5523c59d5c64f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7fb008a6f5e15a1394b31142d71f9e5110e38c2f087f4adb63f1acdadf400da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1cf43c5833d897b2557d31baa91afc31c23feaf99abceae0e749e75a0672b204
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7cae3b835d867226963d9a2ae68dce3d78d1249fb0b680be9a65de0455be871
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edab68454acb2217e73493b22d88efd70413e9cf7249a0308cb03aacc6933ba5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d2ac7ab5cbec32b09382271ef501d3a12ee437104171b088e6ea4743002abbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b74f741e5d60a554adb91a0670e1be82ef1b03d02706f9887017a6a4b72ec18f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8dced1dd5cbe7892b3927ef1c4d1fd238741fec341b2835788a5c2540a6f166
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6015b5f5de62f495a42c99f7e6ae75ae7dc38570b165122890b899945bb1ea10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d47780a5aec38c9f9c81bed49f02930c3ba5726bc1b58045be2092693a0c68ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93fb20d883b9f095fef873805351030173839b08df29bd8aec5544c13c7a74ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 848218b55ebe1fc607164edb3227dc145a76815efb7ada47dea4fa94d02f969b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0a9b1709a6ba42bba32814fa01183f003996507da38d12eecec58d9a2fb53fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adc4d07f47c7f7305ae911ed94e9a2ab44657df00b574fa59a4f621c6a6b6d43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a40eda940826d7ae9f232b21445228fd77b52422f5fd73292c1641e4b0442ad0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0f9cb67ce555aef9dec9a2cab55c70ea7b87e2138bffbf23bdeea83cd0811c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89bffa2c63db076f3f54e02ae7be43dff0228eca85bac9929321856c44ca8827
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f953209ee169947736b47d57343db5bfacd52a708929cb890d594e2a77db55e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b794448e92ff38f26ff71621a485770294c4bfdf72d0c849743cc3116755057
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0c4c3eae199190c28f36a42838b3eb13e2d4fc9d63ac9976d9376fedadc37ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbd9e1c59bccb7106acc72672ecddd13076ecb248cca003b85bbc1c36feefa39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 757237c7f13b5d7d2d015f1de85d72ec8d1142d362d1ccef1f2841d789a149ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 903d273533d04ead12a2cbe9461e01933df73f6cac08a407e250b3f4abcfd560
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2d98b9f891e7c887b6c5f121a086a392609962ff33734f58ffd9a307ab01add
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f669ed178f8010e5f523f3d5310ae6c8e2cd6b05b884c5190d38aefa85717704
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78da2a1e3a83760a25ec6732e09886e8af1c4601b5c30bddfb5007624531228f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61d11061b9c6e63c073b5159ffcd456da9e94856a0ed0049de57047147fc72da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd0a2f6596afef3fa4095416d9b8bfd6214d75ff8315916b30c19ce903c785ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9f999f9c836e30de3cdc79762a0839c4e66ba766e88b88a2b580e8d185b3ef3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 722bd229c2933d887139f49431632ea8cc17a76dae749dec3bccf57f09079a30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e2e2dfa7c5ae1c4176d1e8ee9d0fc4718e089bd637c334b08304abb3d7630d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a122ac5c766f226f555adfa2ce0a2fc8ad35d8fab67ebaa4a5af00e3ef74fff2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0dc57339d345ab691f53883d0f2c3516131aec31eb04d6aeb843d8c01d7278b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f7c188600d16ac19e6a8b21bdc3663b8034f80f6bc2a4b0e978b9aa5421daf8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0686e284de557dd269ac205e747ac3b1d38c11680d45bae04e7fea43d4adfc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2270896f974a8ea51c4272d9eb1010e28d7b573f7f8de8d51aa0ffd29028ef0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27da7c2ccfdada51561afd69c8ccd09a3999891b35e5fdf9612ad0e0e046c8d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d31bf94014b1075e7ec3ef514cba84b07d91839b48585bb3f7eb95e0d1ae6eeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 148a2c746e1973a7c7241b16b572bd6935edb70141ab4d171f0613ebb2cd0a97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf09bc38ccac48c3205034a553dbda8fd793121c1c050b8753ff89afe3fa520d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8703831b9eb112cd2a555a88d701ac3660221142965b10ea6378435dc54866d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e1964402e5c38a2b032826fd2ec7b127f6bd933b9612b72e79e2e957eae3bd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4dc24ecacf9938b5623921088d12f8338abe43cedc022cad9be1bb7040f7f972
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c69a84978aad5a1dddd9c2008516bc74e1129b64e6ad7498539c83977904ef7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f338b6d811271f42c3f829f5f8165583f5b709fc982732188d8d79b5d51dc01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b34eabd5aabf1ac7a9c5832684ec03d90adf901a23a02cb31e73ae1abd2e202d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 495f3adbc789b98a1400bfeb4495ca6baf888c501d89aea3992d8d4a535ac9ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96292016384c3d2bccf450d7b669d5b7ede3c799ec2a3c558964bbff1eef5280
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed8c7293acff81b7e7564a7460c89d8b2435f062da995a3eedd49284d1c360e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff2e425706fbf11417bb8178e6f9742d26ce3c623114a4975d4175ade031c45b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5766d58b8ea1d8cb3e587f5a452a3b7f1f47f63b4c0f766df24754fa07b63a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a29d194393762b6ad1158953cb8dc6c063064eaeeb86e5b1c4ffc42cd71dbf15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cdd4a481116d00b11ba759dd8f889e6b6f9bc21c3f2ecf4706f1aa3118884bb4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76335bccd2def6912ceb4c965b8c0cc5ba43c6a5950867f9fccb806279d49582
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 92556049099d50d1636a626ce3d5d67ee7d0370453f0153967e97e057245cd1b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e476bc5a33ccbff1b00a705ba311b7c2084d8f6094815abec6797a5b80ba9f53
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5891633faf40548284e30c2e2aa86777a314dca9b57027438b7c9e76d4488161
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1ecf68b7e589751f6b42ffac1a3c72e51af25f209cb04606239e668273da226
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cf04ac5bf31cadb3e4ff7f2439b2875e010fbe6e75591e173a0ea1d70b61167
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0015a12169e6dbb13928e1164ad20de5185de675560c527e5ebf4b751cc648c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2941749f479a645332d7362a40e1120ddfea33e524b5a81e8887107f9c00342b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dacd0b32da908dc05fee6ae5cbc9e8cb9765131e3a50e67fa9bec5771a2e1080
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61777aceef31371271364af7ed4bacdb6377e7edc8b364fc03f7b55973b7f27f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8ee4305b64d07cc1b41270ef31f4d2c0083010025d619062ea195890bc02a55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c38acd67fc93f0fc26406f176558136d37a2a7caee68bbf0cb660451d8975fdc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6f6fb829a5f4650e96ca39b48577d2615b3a41bad5cbb294742e574fbce9a14
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99a5ed998c00b15f9165ec5f9e8a9df5ffe03cb0ff91d5a42f861d02de8a50fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6dc498aebd91f1a3f5dce7cc55b61597dae0a65b601c487d2d7fef8f67060ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f84e2fd93296bfa7711fafce5cdbc08c064a9894cdc6bf2049cd31fd6dcd554
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b002669c1683d8f865394533b23fd96b908ec48ee4b7bb36aec64cbeb424462
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7cdd9fbb377a92ea428dcf09725ccd455f925b03e4cf35a268ab3e06a1f13564
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4828bf89497ca832dee1cd9302b9806dbaac8bb54c1e251ef7a539ce3dd42164
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fd9e0580c1b2065b529032fb9144c8ac596ea30657a82cc22f5a55d11cf9e07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 305ffe181c0e838a869a73e07393b7b7a506eed4c299e38297a1d602ae1132d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 05ac69aae9bc91e963f06a6746c0acd6fac0ab2f8d44c7b47624f656573cfd7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ab3b40afdeee64ff2d9ae30c50a835ccdaffa5a587f065641f671b9840935ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a64428e36588320aad4ea1342e827ce9830a3eeb8394c00410a21321d3a6b30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4951786cee53af1cf8a4dcc1d8e13199a33cd756491f143c63174c550bf2f67a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e46e86b87bbf7d5e74ca4ebbffae5453926e7b1fd96b27ecd9cd60aebd6e956
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fd9a0ad6e3abdb1e7d5361372f7ee406c7e9aa2e96d21fe8dc639cfb28b5966
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4cb34a3bb1db7d731485140fe2c1c04dfdfda14c8ede1ba08ebe0b250187524
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08fd8d30cd7f85bb6d8e4ec45c285144fbded343a6ade3478256bb256884113f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 41cffc1d7f0b142d8e3e37c737145eadfb3b32e4620e1b9b6c9145939ee7811c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5a1a736311a7403441c14862843aaa9b0ea818fb474d20306e43884d0106954
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43006ddf9e768c6986ace7365058e4c72e1affc0a0a888c9c6500903d803c271
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63f09d8d37512673aac438e1322742ebd0eca0fb47f4768965db46975aa22cc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86af86aee9b7b8332dcdfff51f43920bedd8e57d5b5b57f027671f4ab232093e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55b3d6359548363f613d36788fbe34837da31b4773bd67e6c7f014b797a60c3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3aa2c7dfab3962fb455d697a2526c264a5e93f1390a3200a1ac16a955ba253e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26e1d5b11c63dcce13690f63c4ca35578b510e086a2c26f03dccc23f2ff56696
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fba3e40c7faa515e4ec6d827267c498435959e46b128371d164c282bf3a6b425
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 851650736292d93b1b4d312688edb8205220c74d90fb8464603ea8606e343461
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79bc93bc4a867957cea90234030825e454ddd32f333acd5d8eae20d273127864
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00a9a19b76b3656556a62586026dc3f7836f6173cdbb5a79a4a8f8a638678d6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d95d65fc0fc6b5abf0eef5c4c9bcac159de15781c5033495fb7f4e5e82b6ebd1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70db68e5b784d0e53e6bc2b703e140d5a8747d563737a5e03733185ba53a5df6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2299c03ec704a084bc3a1d302f8c831b5429e66558e1745d3ac5de9f56eaa17d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 747fadf9c8f3f9d2b8a59ff32ba64fff794c63d5e756865aeace6542b0938e21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67a1a7cbb316efc8b178654486c939783d8956b14867f15455d59b61214b4a6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d0abf1777b40fd11b97089cf8350d738436d63acd64cfbfa1cb4719f562fb2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6202380cc6f3f7b54f08a4ee1b1fae170474f1ee49b4e1de789038e98c61e6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb72fac6bd5910c5474e749e682e1ede844441b5d1d42ea2ce992280533406f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 281974259384045b27e905395b1adea1680b14ff683b9a1136e5ca8222869007
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d68432f2ea52b39b7ff1673c68aa56410287ce08441d2dd9f1964b0c0c9a835e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94a88b9f13940d7fa1f92ac50cca2e5e6e90a26e2b659d74af444a4d7e53b6ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb3f048353af4b1ea18f6a27a436ebe239bb9c948d91867dff1121c819a83384
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f0b0a9fd0f4827534e956049f32d7ec9db1e127805c048194697e86b046d471
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f5b07d233134049169eff5b7b6ea3ef8b7553c3932b5c47d2c8a6acbd630004
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9ebf87983cb101c87c6cd50a45dc4f99f982c127f79c5c63bb0021f354ebf84
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71c37c6bf6857ff6822f39f2030e1e4e467ee325abc2e97e8303a39485a9aa8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d170f9aa58e39b17d722ec4b05810ac8a6dfa90d8e41d21b24684661e6372342
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95432643d1d139c739e04dfd98ebb034c71a541999b542a356d51e8d3c425955
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9a06644f7463e530093ed786a8c7f7b91b082ff5d5dd1eaa77a823881f6972ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 176b3cc10d6157a43f8a8e82b5ee7e1f8ae6b893a709d2598d7280f8fe614cab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8c0356319023a4fe1720370433a0fe0f5e815a012cd2b92f59199b7cde365f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3b0117687bb6ed465dc2bfcc0026f5f08a0ac915f762debc8b35cce534dda20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b91a9792c9f1dceee80fa37d19d81ca288c0ad203575e50bcd82c6ffedcc2c35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0f1824cfea4a816fd27b530ce2982d65a1d0dafb7aa9c5c27a02134dd23fdbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c401ff5419e43dab5b6d8ef9211d029d5c05d7b06a07bb4bc05033e315c5e70a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed5c668e4003ecb1288d3cc29e9d749f63b9f767491c25327787723c6e65db1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82b53b4e82553588c20fd2dcc3434943aa8411bbd5f135c22262494ca8f02ffa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00a02230f231b2d3a217b258dce0fa0952cb071576f02fd08a131e2bba2ec3cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ea081f6441948f3fd4c3e160bf9c164c37b1642015e4493a233a3fec184ec4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74cf39f2758bd7688961ce5e30381c10fd173462f728cf6f1459fddca9c7d1a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c2d2dc32d568408a7299fa7be101fca3ed29cb670079ba36a14ef73236617f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ac52ecd93b8ccb0b7ae71e71ef6b092067fc345044f747fc3ed14c373612a604
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4726624f87fcb82cb105c5f27360f96eebaadfcafed915ea097282e03fb9d704
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 179ebe05b468ec8c02bb3574e9ce23a64343aa126e34890ae30112804f395717
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cfe6f32e9a48693791f02d7bcde77464e62963ea3c6c753dbaeff67a65c3fda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 da65b50ddf4b4989a9cbb785d1521e6828e1d11c6bcd9189a67659d82b30ca12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e3363c895e929063a63905ae248d122ab05ecab873223b12fc63beee09a30cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d580ec50e2d727cf25c76bc4633631e72fd7803d7250b9d26c8c2f9ae65b7a3f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b29ecf639136a1443e57cf1c31792ad95dc948c850e8eb35e42ebc0c775e4e47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a04d23e9ce8f9a94336ca397d50d2e5b8be88cb3a36e477e6b3f1ac837423b03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22c28aa2fb2b2050747d0f596cdcfd0c1c13694af4685008ceb6ec69c8343ac8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91a3d70002a3af122323bc9870176ff1213451ac77fa77bd76746084dca182e8
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path \??\c:\dir\install\install\server.exe
            • Size 276KB
            • SHA256 21bfcd1261892b480fd76ab8978a13ecc9d74a62756f4564be9f259efadee359
            • MD5 SHA1 SHA512 SSDEEP

            memory/208-158-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/208-160-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1324-67-0x0000000003DC0000-0x0000000003DC1000-memory.dmp

            memory/1324-69-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1324-587-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1324-8-0x0000000001220000-0x0000000001221000-memory.dmp

            memory/1324-9-0x00000000012E0000-0x00000000012E1000-memory.dmp

            memory/1604-136-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/1604-1041-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/5064-0-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/5064-135-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/5064-64-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5064-7-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/5064-4-0x0000000024010000-0x0000000024072000-memory.dmp