Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/08/2024, 17:19

General

  • Target
    9aed43647ee6794c1d0256b8ccef9cf4_JaffaCakes118.exe
  • Size 398KB
  • Sample240815-vv1cestdjd
  • SHA256 900ef43ca4ea86f0bf5563afb76d9593d97b8eccc11bb06674c2d29dcb7e6030
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • g00.no-ip.biz:515

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9aed43647ee6794c1d0256b8ccef9cf4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9aed43647ee6794c1d0256b8ccef9cf4_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Users\Admin\AppData\Local\Temp\9aed43647ee6794c1d0256b8ccef9cf4_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\9aed43647ee6794c1d0256b8ccef9cf4_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1756
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1088
        • C:\Users\Admin\AppData\Local\Temp\9aed43647ee6794c1d0256b8ccef9cf4_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\9aed43647ee6794c1d0256b8ccef9cf4_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2896
          • C:\Windows\SysWOW64\install\server.exe
            "C:\Windows\system32\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:3004
            • C:\Windows\SysWOW64\install\server.exe
              C:\Windows\SysWOW64\install\server.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2232
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 564
                6⤵
                • Program crash
                PID:3628
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2232 -ip 2232
      1⤵
        PID:5112

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 b3638a7428e29aa3fbb7b1eabede5e05f5b00637c1cc6a79c6bb2efe0cf15b0d
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 dc82272e8b87d989de6f959b4887a4f5c3327a6f36c5b205161c59aa50161cdc
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40cc9161708d2e245a306cb10d9d846d4d8c599d47c717aa0dd61659a96d2210
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 240dc2283430369b1983334d7e6ecb2a864472c7b25fcc5f17f1838e8821bbfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e7c7de93665afec82be56eee4f250851fdae2b42a7a58f1676fc5bfb7d119b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0cbb2651457790c8bdaeeb6862d0ac14be2b44e399799ee4f98e19252eb33fc3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c42a5623e65bbd820186b02b7c5250cc8689b38a4f236917d1b09bbcf9581615
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abcce9063e8d8d1cd12e8276ee00c91db4b6cceba187da3ad77ad5bc25b7fb44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c358329a1c0d00fc6a327e5704dd64e86dbb0b3d29476259f130fd0028e77fd2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c082338cb2e1231e21d327351ca3e80b885ecf3271abf6075bd019ffdbcd3f1e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c63f27d01ac8ee196a054ab0ca9d7785e9f222f0b49d03c912a3b52fe2a11fef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b3c146b6d38384060c0f4605e8e9b68d9b5482ca624e1d00e735bb1d0672a13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5edca564686ac207774ded587c38f9b7a54ad2818d5dfe815f829a098f1bb7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc98103490d5fe9b61ccb4af9580e1f447bfad416520b23ec537b66096f9dd69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 813637ab7f309c3452e6ef302aace1d2ce48f5ab3580009afdccbc8daeeb3cd8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a52c714cac708dae0decdd25eb27566cfe29ad6699a710385ace67266b13e4e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 edc3ca7959a1503c691561167b44ab3501e2b539a5ba3f6049419fefd478aea1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ae579034d2afcd827e39724b13148772b3301af9194d276a2b7b716cb292dad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf239af28204b7d110e99dedbc43f9d296374245cbcb922e2f47bc18fc8455d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0eabb750892a578ad288916607d4d62ae003b4c18454d95c430d1e77045fe0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46027c86d0132daf587c3a4512eef904c17cbf1090af162b52d0d0726812c1c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfb0b1bf37b4c76ae196d5d3499e3b238ba01ea6f6673dc66a474051953dd234
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f49601aa6073fca136c645116f26e8bc3f664a0d4c5fce00f38a6e8b9aed3e58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e81afd6ee52801d42e40caf065083da169944948aa48bbeda2f79992419ca0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d66365c75e704d31f9cf8156c587bd93f0d6938f727efa21b22f3d15efc4def2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 22cd20afd9e601c1dc9aed6fefc6fcfa90729319d16e0bc251eb0e5064f32f18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e1c483e42151cd2f9e0862241b04bdc1ce8eeb4c2142f20239ac3bdbd3f913b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f66fe8a1c2b9340de879e461eae79e8fbdbbcc26964f17e3718c0e151ba78c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37b4129e6b00094469e26a45a4bca78808befb22959390811df27280835ec9a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03dba15eba3656f8c8fe7f9695aa156e03519a1dcd454dc9ee96b5eae86404cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f24de02bf60f13af572b7a5d53c8301b32138d692a8fce73fb74dc1583277fbc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2aa2f945eb81aa829f63ea704ff6c07dc3d1a1f39e57f3d1caaffe4c38496880
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2513dcc83e3ead7a13ccf5f817026294ea9792d7eabe10860fe19790bdab9e22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0be07ce1c12fce8e7229764f157c5cbcfbb665faa5eb27888cfd34af843ae142
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6d4403f01acab80eae487dbea762c69a96ec43a2c6a993238365ca6e7d9bb6dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9615151498eca99bdc0444083e33f0795b04dd0862f11fe2d0074c5d4c48f067
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9404b9556d614b24128b5c26db3eec229988e83f443965784652c2dee41668d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6797ca45c8ed45d8ac762da0df93d5c64e0338ffe4cfc250ebed9d6f879992a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 345daf20813e77d82ed284e83d71ad1ba8951cc72917e55c356716cb6fa41333
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccdfc8ef4917097ddc35d18d9da1094e57031d76ef799bf1fbe1544db0968214
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 776f051b99b63b2b37d1b4d2dacf956b36bebf773e886b93349ef373db556989
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a77c959547aa6e2ab4cb51a7dd999f2c439a9a6073a4ad8169519d682ba09ba6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc6a1df321c9f6039a0e10ac9e75dfe3f437de8f9ef1a8987d1bf7853e3bd090
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99dc7f04df23fdeecfee896ea6b59c54dc5de309df25b142021f86d5e71d06fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0e3144b84ee1b20f122cc9693118c09af0eec19f161f66f342a25d3bba35829
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b410e58d88abd7ad2fec06fb9ed6bc1908b4766c4bf57943563afa9805f91fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f2166b208f8dcadd473f88636519332065ead5c4e4fd1e74ace0224b74d07fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6f40f73af009177d15748971f55c22adaba6c4528c48ff638157ef33794a10f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d80270212c0d020bcf106b9bcde40b52c71529bbfc1a043156be63fd47dc9711
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8e042d8b36fbeeebd4bab1b3fa0d5e6ecead09b8b5b81d4946b55b544526237
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6dcab068f3fe3df3d8ef55f518c6f338a7fcffcfd7f589c8471acad96fcab71e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f0175a4b8fdda136b9455675f6289db6856f38fe7067361e116dc76e91b6996
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a79537c8fa47b88d3a7e29b0cdc0dced6b221591e5ad9a6cd55b744f7112a1d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 101a68a6510065d5bf227d03d77f248457a2d8a19aa54943f996d4dd11fb23ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72976c8757d86b0b796211e5044796042e7cc1e384b714e5597cff1878bda447
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2b954bcdcc09ea4d335f08466a0ad377019a4997cdeafe670baa86f4f4fd75b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 926490b77adc87da6a2ce1dce54104dcce50617d6969422388d91cab3e0e1a70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b51c08ddc627cf079b9b629e6df5bd6ddda1c1e54560fa19542fecc52e827750
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d78fda2fb0a22dba50131a9b1b1fcdfd9cf9e3db6bd32d4dd002e3ae6cc14971
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 598660ee5e52fb9700de2ba118503e4b5c68605e75343f30c7c9ab4902a50970
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1db76fc89d729684d1040f5a7f2f6b4857b6f523c91cb4b4460049a31ca39f7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f924de4fa0df8f6610b4d7715a46c6451a20e8c47a2b053d64c8b24e1941f5e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7411117ec2a110fd4df09073da25bff8177726ba620a9ac6a41f26575ec587a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d16b7b5499eb459342cc6693b59ff74bcf65be8e80542d21df1082a25177e736
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93e8a1e27493c54be61a66be5dd1686a4bd18710724946a7b39bd4fe2cbf5664
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8a8815185c9e8e4114a8b326a143a2962e228306e885925d25e1340ca1d5a48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa8a91674e370b2224baee1a2cf6a5ee0620ab082836e42713ed31d28e9ab9d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06387e5ce4e1aa9ba94ec45c191ad01bf76c0d06f31094123881843d36d37497
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 309669f947efbb64991232b37f9bcce4e8115b8634388ad1e66c08a1a063f4ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f040b4983601e62d1e68a1758523075d1cccdb89ee2ff3897c4b4603fb95bd7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62424cea906c6484f72bae4ebbc65cdfb7d174d410baa0901c125de5193c8b0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6ff276789624deaf4186ea887b8c46000b7991899f56bb18985f1325044b405
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77c39ae2df57053265d275a49a954c617a30d6b775579bb6f89481869db3bbd9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe50e5e8e6abe21858fb676f78caad21298d8c437f79deacab733ad338fdefca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87c097e9d0d2395fc0b64735d8ee9f5d0f5550b76ea2a0fda129da9e66972229
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ca27d50fe4b389706ebb9b8d1a5a1664e281a67365eafd4ea691d062d023cef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e439fecc3158f37c1d26610db5971828c3559b5b06d967014fdce19c5a86da20
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8790065398b1280d892f4e40feb1a44f6ff0d4294bc8671747fc669ed3e4eec2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fe461ba5d7f2446643eff6bfd9fd6add38fa4b063906a400be8b29517e7a8f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 799246023194fa0769fd32aab546ff6f1d3d80935d82dc3a402e86fa9ae5aa54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db62f474a4fdcde9a8180cc9e8507183e0138de6ea6e0ce8cedcf7cb465deba0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75f5439a85b530536e6297eef382f289bf72eec9865dfe65ca761d27147b5ffb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0f91068983d888ac90e696611f7b8127f7b94777e43beccd15cf463bc365868
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f01a7a44c66e9e63d158633219003dba36a5d81ca224e03d549d2fa0c3b3786
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0388526501f8b776506537d34580e08f986eb52374e994bcd80ee0446eaf679c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 217c2205905c543d001119889c68debcfe44b7a48d7282d045ecba53475b667e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9acd65da3bb07bc9ab880aeb730fefd4fd1d7df811066e674c3497d772bfabe5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f2ad4ba92e1546153b5f1ece9c527ce8cc23dc8a4770a36dd65f4f4a6f56aad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe16ea56b86bdcd485ff060d454bc98d686d733656c70fd16d8e444bf821d60e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14b62cca8eb538ec141207a93623038385b2ee97964b6d42074cf1da421b17fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c70a5ea38c46324eaaaa35475c1b70658d00b340f17e3b0815ad02ad6b0e83e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c3c960462abdbf77efee44e7b3be1b36405e4f7896cbe4151cb2f2dbeb1955b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e398013c764f50009cd546fdf49a397bd27c1ff4483e7ae4ac123d2a3a183c13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07ca8d1c5c7c7fb620892be69004d674935c5678f4b3d6e52abc16966d6466a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e107f9e6806712f5a8d3aaf5bc67f67169a6d1a0164b039481a6194f61a3786
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6dee29c1be0574ff6fa08040c9b5d500ad2de98cf0a768375c54a98da9b61d97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5924b3532c6f22836e9e0d051e297734c7e39b86cf0bae039b9a432534394aad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 93d5871a640e581f685a64a1551b4da29070700f9cea13dbb061a9e3b498f7af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fb7b58b7509e2586dcd0a202a3c99dfa5badbdf1b6d83a7f4cbf92aa9611909
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 080dfc4887f3b3b0254ab2b85c9c86b354b9fd041bea83776d2db57488f22b55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2d398c4a0f48f1357c039bebeccfac56e4898d6c5bfedc79cbff43cb5f393d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7f5491b9193f961cca16efa7dfd2964578df135d04b1d040a4b4d2b1192815b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f752721231159594d0118361b2d74bd1afe41dae945d8a8f7310b8f848bbc9e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b3ef5c7b3ff15709a1ed999a092d26e1ef9b9ea765733446d642112708015c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cdb9581ca28be8bb93279377f9454b929ac33e6b31650c9b47681fc0ecd465ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64aed0f309894d698f74befc463577cee733ea5e5525def21d2a355bc4b7a685
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 634368caa05ea21705745499666b73c7e862ef04ac097da6c5b1d365cb111171
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c87d4e6538015635aa718cd0c24bdbbc21f23bb5459fbf09086a4dc467377ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc5e75cd5cbdd3c733dec24b7fb51a945efab40adf7086c4f6e03b68a1cc65e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 299684fc7cb3a9e1d8cdee5bc7f30ccc5cbd0f342e9a80379492196cb0f19c7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14a3f490f2c92e49f3c2e946b6389113b9d5eba9fbf7211e02e83f53a52919ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d592752f20643e4620b21cf1c3f68c8d89b6f4a11ed23e23cdf60c858fe487a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9438b3e11315b930b8fd075a4da22c2e8dec50a4ef875fd00df1a40717be2335
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32542d8bbcfb0377a7baf9a840bf47f8b115165a860e5d01375c43624b85da12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28cadd807ab74b401b633325b0cc23e718d9d1d92c7e8a08b6b3a0ebb6b8b4ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20e423f25e824b001903f1e5c53e15abc0335df60e48ff67c23f5c6782ca439c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b71cdf9cde5632689b4d57219eb84853d0c6f50b4df0fce70448ef42b0fd5613
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fc8351fb5074108fb9833bcc54836945d1041d4778923b266777590cce9636b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cae0d9ab1c54080247b5351f9fb5afa252bca183ef5417a2833b48db0f3244a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 16e1ccb46f3961af11f06d26e893602186f3acd2776ee4b24bc0bc1bc8d565d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c44635e0ccba076f17aacd9d7f9b2377cb833017bcb4d35347209dcb4cbe93fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09429d8470ba22796a6ea0fa99788f634c85be673d4df2eaa7fa7c5b7edab2ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bed9ac646119033223a1552f17b8eb2deb0adf052c231df3c5c53888f21b2db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb4c8962728d24725fcd7247e9b34f3fff523decf3f1e287ca8585b3762a5807
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed2f7e1ec1e9f8f60fb564d70282bd996b3d2685a173c48ad29d2c2d4bd8e322
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d2eaf6d8c95e5d25cfd0ff94ac8cff3785f3f185580aedb311f238081b62bc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e92fa0e25684f8882960af4b57e81336e21d71b48955faa488657306994b0a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c7d7639d131e7d3d4308fdcf65e61b2418af8e3bc29cf3f30e8bb8d08d2f490
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c827cd8062b588d1af95214f8f529c73482b9b305c052c7c369d149f37f4cb89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e49b4d14fbaad5809e2fcf4bd9f3b9a2c1638f5255e93486df1dad34cb543cf1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 996c09ee63a436d53511cb2b3ced1358bed6a2b3daa82dc7ef17242bdcdf9fad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6209584c498ef0d1bd1fdb9a894b17d336fe2ce6be0bda2d3e032ae17a77676c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c1d1f50076dec7aeb432219b1b2ad48a06478499b62f002308969509ed557c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45800756fdd62f11cde4aa6915208d0a5e81562ab73a067499dd4fec78f7c59a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7c3adbc8d150f251ea61bffbc7283489c7fa8f8d037e351ae9918fe5e33a0fcf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bdc825f120dc385966fa369041610b7a80a965ed2c1adb09f0f04cc2c5bbbd67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d43622cde44e4086e49277267b0f20db4ffe42aab1adce3ededb23a69d43f9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d30e4824a1979bd714ac2dd011152c12aab4b45e1e90309454d5676b638be81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84cc8413fe413cc002e9c934eec3da3d1520132d49e45ad277067dc18f7901a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4d17a84bb03aa0cac666bd8b5c68434a5e76f5358ee1ec81ae7d47fb7f1390f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2882d1f98fbed1f6798552d34ed26e04624eb0cdd9cc0c06cdbd227d71161fcf
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 398KB
            • SHA256 900ef43ca4ea86f0bf5563afb76d9593d97b8eccc11bb06674c2d29dcb7e6030
            • MD5 SHA1 SHA512 SSDEEP

            memory/1756-1-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1756-6-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1756-18-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1756-14-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1756-0-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1756-11-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1756-3-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1756-9-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1756-5-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1756-7-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/2848-10-0x0000000000400000-0x000000000046B000-memory.dmp

            memory/2896-81-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2896-124-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2896-19-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/2896-20-0x00000000005D0000-0x00000000005D1000-memory.dmp