Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/08/2024, 00:05

General

  • Target
    9c2aace67b1662e562387bb1c0cb5ff2_JaffaCakes118.exe
  • Size 270KB
  • Sample240816-ac8kvstbpg
  • SHA256 30990b588a176af4a6ce3dc664b4af6989bea7b6483140ca85b9cd3854a0e3ea
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c2aace67b1662e562387bb1c0cb5ff2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9c2aace67b1662e562387bb1c0cb5ff2_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Users\Admin\AppData\Local\Temp\9c2aace67b1662e562387bb1c0cb5ff2_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\9c2aace67b1662e562387bb1c0cb5ff2_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2096
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:4028
        • C:\Users\Admin\AppData\Local\Temp\9c2aace67b1662e562387bb1c0cb5ff2_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\9c2aace67b1662e562387bb1c0cb5ff2_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:4316
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:4672
            • C:\dir\install\install\server.exe
              C:\dir\install\install\server.exe
              5⤵
              • Executes dropped EXE
              PID:1412
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 532
                6⤵
                • Program crash
                PID:1256
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1412 -ip 1412
      1⤵
        PID:1696

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 d2244a12f90788d7d0f01a515a2eac4de68d97b76b4682d3e12d1545d021907b
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 b64225f30fb040d052c11ec1b6dd59d8d4b7ac32ab22dc01deef710b34bf190a
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 224395f216af87c6b10dd60cd71f0abb212d9673273152aa063b613a932c6c80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b591a65f92ea9d696815348274a464fbcd608869c09728336780fa6974509bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94663af8d669b6ac096ee78eda9421d78c77dcd2270986abd987ad1a42233363
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8773e9c44f79eb9d5fdb22f081e6d9778752672ab4fe4268378e47c7ad5de6e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3eb686a32bb42660db1cc6a7c2510f3cb183ae15658c46d1a615b50254bc58af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4142a47f8333d6d82186fb660d40db8cd822be75b3987f92df37900c7d1e1fb5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4e84731fddec5c99c9595b22eb4543309356b6b4783f1ff08acc5052a641924
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 efa9f129e01417eee0f8757110537efce84e143d303980ac8ee56b12dfd3b2b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e81f379d1314db24884d66fea65a7d093a0e548aa7b2b29a9ff491894df7148
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4a7d696a120a7bf36ff8b772e7245c2cc93641b835f1c483f637b1433e2caf4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2cd846ae2cba43babdc6d2be458370617e447f92b8f9fdd769a978ff435dece4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34cf2975ba85a07ffadd38480531df14062202505b7a6f7da2bd3b2f082e0abe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc3f56af27750b4ad9b95bef9825025d7b84c8b17f12ab937d28a6bcce72bf1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36772e6eee4f06fd63ee85c6e1bcb249178b7e4e2b16114fde3fde904de84554
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27ad1551fb47195c1c565162c8fee876d67a5ddce0eca1efacd10df957c35504
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ab88bb5cf2a7c7c64a9174b7227497fbdf263399a1aac1b5d43fe0fda07a810
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0f3bdc437edf7a4334c73ce15600a3cc573ffb77a523655e2ac46b7c11312eb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38ba05b9549eef70c66cf6c2ec93b064c3852f1e63f9778d3cf0a6db0ae7c29b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83e334d2c318ac29e58c11d0f3088ca05c6597638c06f8a3ddc6c689c69ee1f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eeb2dce487bbdf62b85f05e9b2aa8f91516732a0b2a9a0067580b52cf1a258a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ba6b783e096df6e369d4812a893ccbaa43cddb59c64f68204da12c4eee573ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 266c5611461225c4e2f55bcaff023a1156c31052bc4f94b1465f4be1a53b6d04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54f53bcdcd29265663161843491dd977d9e5bc83f2b2fd531dea01484928db0a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f019cc810c9b2591448a780f1cc7824da815e2e18c7f93a2f0bdd6663daa31b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf8bdd839bc9337c3431acd5c01a0080f4d1d0d95b50b3696d24f6c8b2c3d098
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8885d91bb58d2abacb8754cf03db7b8729970c79ac3b1cd3f67bc1fbe2749a37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bce4e172693cd6d8df71d4ca3bef4e9522aa13b7484e6d2b56a1a57d1e237a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6dafc20a40dbaf2d9e02fd81e262769c31647a35a782fbc8edbe21ac22d19316
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91ffbb36371cbf7503947cd6a25d6cb4969b26486611bbb17a68b0f270a740c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4868665ccfc10ecbdaac5edf7fde388bb91baf92bdbde34d5bb7a15de6cc2640
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99af852a0975a379b11fab33b960e3a9c8f6e43e7d6ec74010604486d9ab9c9b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b452f3a350d96edab8a88910c37bf2483ab5f574e484753468815510f9fd3a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d3e3b315873a654fcf8fafd840e34c69a0bf5bed3fde12ec31588bdb5950838
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d99d51ea08110028600c3acceefb094a6f22091489f926573ed491953f9cce0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1bbcf7da72429d0507c30da288578f934ab43e431875ae90bbfa2246f2c4618
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 389fbe215102dcbfde9d84baca327f7730506c7ed7c08858bd769788622a77aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 737f2525c5514c7160334d804bdb3cf1b754880a66190b541c5bd5cdaa91b71a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9bb4180b81cee26c2b0bbf92fae981b1c59f17946b9f5dd5e1e02881ba82977
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21ab255e5e0064432ddc2f55e5874a98b9c1bee89b428757d4e2ca9864902c5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 60deec3b9f94089adee3f39b6ff11a6a2838bd6e9708e843b68c0a61cd721bab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8996ef4642c4cb0c41768fd65ec40b77c9174360002054e4539f16506d3bc97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9167aba4b23785a3a35dd19aeb1ed376220963d4e6de2e08cb8ed203fa39bfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1dc2d70a8707d82b191a71b517686014504ec426189f8c176592eb71546ad5b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 129b0f134ec4592a6fd797616f5fa888d5e8e02e9f2053b0b1f758ba9b403946
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e08163b7f758f045ce8553af63a1e484bd9ac29f48eac9e6f9931f4127c03db3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a2be00c2a07351a72acd66b46de8961e93022adacb5c378fd0278f27c41c54d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14ad779417e54545cc9e2414edd5f8677c2050c2c33320f8675d82f998d52f7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e979bd0c9d2122dd59ca211160cef9955b0a9e5b9d7c732b53fca9d3fe8d161e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40bb6b831035d26a8097c24fd60cc9b972d3d4128cb5ed696ce20cdeef9d635e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4de22e61fe7186b099e9f050ed9d1b4c0b26e6497be3e8ce30e6c9c84ccf3c9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61d53d9a0b06fd88c60abd1b3569a53b35e65a3e0d67db6256d3e0ec23ec2889
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd9b076e64869cf79b9803fc5be2ceff86ae2785c0e3e54e886fae521bfedc54
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fadb5e9190971dd45de0bac5c4259a684374383cf42a8f13a5b7d244383f72df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bc00c6480c3d6fd75dcd22a11464b7dc9955ca966ebd246dfbac9b518318cfd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 43808b37b8449df751ec0f8a378f522ecfcf50f0cb79e03a9a1d479971b76775
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ce847f58c95c32586f9e30466d33685ef4c7504023b0eb0791a39cf9b8a89ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99f0ea3b85001c339d2a3139a5c64badfff9c2fc83215654c0c03ad8f42aa4d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 775a89803e93936e32f0e398ed790ace760365b45435cab46ee52cdbea61ccda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e8bdc1ee9cadf0772d854a822b7dea6ce56d6e130790b06b22d9d471e0e5467
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0314692ef621be0566aa6e98e6820a0309eacd7511994a3ce9fb35fb7121c81b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9f9f7897aaf611f5a2cbb6ca229607314a4592362ee2e790c77802d8441251b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b3bf16e6b64d864fecc0071493e99e15ec8bc2bf4cb50b49552df7eafda680a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cc7757a426fb8de5876c25e943bd4363e690a1446ea47b38e8948ddfe71b797
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0350dc096df9592106c6cabe4c2a74a6a376aa7cb1fe1ed143da95687cda7ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45c7711c8862db04a4993371918dd865157a879ca5d48c8b741cf3c5b1560b5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64919121c8a20f56388c6dc773d842cad64e958fbb58543029e769411871c1e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 557205df25e902108f490553bbdb8c20a5e7231013b8db29897efe836e382611
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45aa65f7dc52f55604f4577b27e98d07208e524ce932958db78d60c93bde0ac2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ecee6c77fed44a4b60293a87631f684fb67026134638d3658969e9e32aa60437
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18d942641fd2d7d797dbc647ce9fee6136f80bf90d22fd6bb6af3fb7647d2a6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b4f9659ee76a136cfa38e770c92f3b18c1fead4706c8e062768d600c4d91407
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1b4091d8a93ecb5fbe59a4dcf2216e282cd786e4521178cc9bb2fbe181ab1f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 632427ff5b657efa6494b0797e5a037197d69961980224d60f4b4b6158792099
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 336d27753d2c1ad64200517c58cf2fd239a743855cea3583273990cd6d1880fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0e7ded79cf257e3954105c339c31a1aa3c86fece7f37e988c7ea3e4a9de5e12
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2c42189d40742d1e2161f2d89a1d2007ec0319b76818e1528163798fc3864ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 311d32fce265c8da42835e7aec4edce01ced67bb135595f43b96346c3dd57599
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63ab431c417441967155d75a0ce00ec4cf83b08b1eabeebf511770a028a834c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76a5f8ecf8bcf172b8ee955a70a1e433bc7a9da9e237fd2ba4cad189edb48ee8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff681133666e4d7978fce1272558c5dd5afcac70f26b296a237fa26cb4b75722
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07d2d22469b53d919d7dc8e171e49136848adeeba6147ca1b07397714025ad45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bea6bd37389bfb65299e30adcfb897f29afd3b33b2b31afbf483f5bc88dfc882
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ce1b0caac26c2c3ec87139fbf1a2f26a7967a6bae427ee335410f0aecf7dc94
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3236e48324ee898a92fe9a8eacb46c8497b659461d1e06beaa7b398adb548257
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e5ab8859f9f3a2c78a370bbead774e36fe69234390db51688c965ca332457c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e98d48dd28d05d48a54df5e06926379db7e93e0375d2b60aca29546328113544
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2f0b9dafab2ee343897bd7d771fa55d25d0cca3f04264a533236b92db532c99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ff7294eb4b04b163bb0df9914ad169cff21373ae1e5eeb5d8c833d589b74de0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00d136e2593aac0decaf8acfbcd852489edb05b8d5c1e2ec9592353dc48a95c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d0de33c41c2f2b8211b2978613da1850e84401c39a4d4384a0da9c25b3cd223
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 186ee1a6d006b94ef529ab97772d9f0b936bb01bd664b52cc89a8f0cf0b378b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4b17221757dc5511c9ed841eb7b4e9ca792d9a22e508133c04450349a05e0ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07d87feb5a9853880a67ca25dcc8b0e175d30354bd7b8f219ca1ba9a8adcbe8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ceff3b4a9fd42680078ea0d48da19ee6875497162a49c29fea716c47382cec5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fe416a89aaccb1c0344bcd2e0d97b1c7bc2c7603c4dd5ef48a1f656c4a19dfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e393b189c7c07f008cc06764f307cc8df493f1aacdbc43966b695edd15a39ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4526b33e7d02cf11c26d340b3549a0609ca98cbc8c9d958040f11b3ce4d39b2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 431c897ece010e6936c6d925d999672f81fe6d3d7d9c03cb54bc6b051a24c427
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d7802914288431a785e424d3d458d038583cc590cc95c98442a300673338b6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 89459a12c12625a49b4f2edd128cf853dd869d93dfdb8c4ab7f652387fe3bc45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47203d4ee178436c02bbece9339a864aee6c894e319ec7428e5c937acbafff17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5986d44c68860500eb0098b484f2df9aaa90b04875acd78dfb5abd2d31fdcf2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91a505bae11063fdeae3fd7ded091b423de23bdb1fa9ae1e727a3773a7f5e8ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 179b077942c31677bb81bf86896715ceb42227c4c03f56d6dce0c259859013cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c0d373c24efad8b2ddd02e0c6827dcfecaf0a27ad3f4dd7d9e32137e6f42a49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca22788f244b4c6172d91e9ee939840d55c8d9d62fc5c76c543fb17319f109ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae023a5064f0345fde604b289f1a94dc1c58a0f7f88d4c17b5e125ab8eb566d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd63b8e5202931bd3a7638aba2a51a95e29b1f96e5723a3580998f90498067c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 382f511173d0a850aebd06b0095257b57017d353f2e6d1624773e04699f91fe0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a8b29810a2cdb95f28088b1201538bf8a0a9cbf4d20659649c7af7164f41bb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1d8fb8aacce0d76179ee7158396ffea9da0fce3abe2541a171a66582178ba41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aab61eafed31a6920966e08684ff0eed2fa1b1eb4699d7b2ef6bdfbdd35b2002
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8728a3b1a63112da999f48f64b9999dcfa7d363f738d00bdc53acc0d5b472f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68166ebb5513381b42c6ff0ba730f8a39711c27d688a90f2d39a53bf0ee61946
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e1d87c17f446b29d1ea9c83e5d933f01537ca6027d3e2939975c6e88ec91d7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b4611310849de3791d7a4e04ec15a1c8382863aced27a8da24a306af5f664f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5aed1d048aa7d6baf89823b61ce769ecb368824d9f5877675ccd232a55325f45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fe5f8754f42ac49ce6040460941e5dc9d4c14bccee3a5798fae632dbbe42233
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 822aad4d9e0e308ea05cac480d3acf7d57aa3d2d8287ade6c70893e2576f6596
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 961aa7fbac5c5b9bfe2d8da83787977f1e4b8de0a6bc87a363c2d89c32362bb4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d6cd358b1fd6c40db22e43e6eae7954e4a3c2747ac1591dbfe294250372ffc7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 358dffb9ce618cd0bf6cef0a2224eb58b0f12677365035a74997b0ce4d8756bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 672a45d5c51805bd2913fabf83d979cbb29657b146c61b1d7cde1fcb01f9c0b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b2333576677a367eccbca5a9e75986bacb3171d899b418dd85c8353c5816e4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba0f970ae0d1361f82a0a90e6883f39ac040b35b4d99a9ff450a2fe7199e6665
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88dd7b18dea9bc7c4ba0193460d12fa4f093dfa8d835d7a820538341911e6f79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76b6a5304040348cfb4ea1da331aa4184d0ce7bf925249ddf48eee978fdb2d1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f7131d096b0b45de336f3ba40af5ea490d16755fcc38f329c3c2add8b2c0967
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ebd555032bfd22079317876bcaa6cc6a3a9fe10b14760a75005338ded19b847
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b7214f041569a8b90db368c4215dcb31232419c60ebbe98e7be34954587744e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 483e3787dd425329275129efa1b28128474a10c3f8d86f84d186003cc683bc07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7da9575b1292a83cb0f12895bef103d73dfcfb026ceee6fee486f0bb45e0cc5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80b517071e3659b88c7f464ec7bf9a807c9931ff964c7c720d0e5691106249d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 76727151e478d10375d627b1ec891ee0a81b8cc0a9087fe1439ff8a72df21b73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c8c095fccd596a67204c86850ae68f799344f8395d1b06daf4d4b660150742f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e623a4935af21bb10265df7b1cd85bec1db5819f5838e5c915bd35804f783bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99e880e85d4ecb83ce98acc6393a5ceb6309930b93c3406675706fe3c9a05b6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0691bf1439cebf49dfa26019ce761609c841395e479e7325551ecdab97982a88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a3fbd9fd5f5409304e60090434184d748f1d7b169c8d85d84751905fa6e7b00
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 270KB
            • SHA256 30990b588a176af4a6ce3dc664b4af6989bea7b6483140ca85b9cd3854a0e3ea
            • MD5 SHA1 SHA512 SSDEEP

            memory/2096-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2096-17-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2096-20-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2096-8-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2096-13-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2096-7-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2096-6-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2096-4-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2096-10-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2096-1-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/2624-12-0x0000000000400000-0x000000000046D000-memory.dmp

            memory/2624-0-0x0000000000400000-0x000000000046D000-memory.dmp

            memory/4316-127-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4316-22-0x00000000005D0000-0x00000000005D1000-memory.dmp

            memory/4316-25-0x0000000000400000-0x000000000046D000-memory.dmp

            memory/4316-21-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/4316-84-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4672-121-0x0000000000400000-0x000000000046D000-memory.dmp