Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 07:06

General

  • Target
    a19bfe2604d6514d94fceb7cfd535673_JaffaCakes118.exe
  • Size 355KB
  • Sample240817-hw5x3swfml
  • SHA256 0011c677d5cf3dcf5d396875c0a931547d5f601c752f8f4648d73da92bad2c38
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • h4zazi.no-ip.biz:82

  • yemene.no-ip.org:299

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a19bfe2604d6514d94fceb7cfd535673_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a19bfe2604d6514d94fceb7cfd535673_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Users\Admin\AppData\Local\Temp\a19bfe2604d6514d94fceb7cfd535673_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a19bfe2604d6514d94fceb7cfd535673_JaffaCakes118.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4884
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:4696
        • C:\Users\Admin\AppData\Local\Temp\a19bfe2604d6514d94fceb7cfd535673_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\a19bfe2604d6514d94fceb7cfd535673_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:3608
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1824
            • C:\dir\install\install\server.exe
              "C:\dir\install\install\server.exe"
              5⤵
              • Executes dropped EXE
              PID:2944
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 532
                6⤵
                • Program crash
                PID:2184
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2944 -ip 2944
      1⤵
        PID:3044
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3980,i,3239535018877284530,3457823197501312703,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
        1⤵
          PID:4240

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 b1cae2a6827618fdf3a76bb48a2c5c0385966f525138ac82f7fb2f9902bc17d6
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 20946b6873f33d86313b0bfa0c6372628b7a71c633efe4733ed28b4469d5051b
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f48ea6a6d86a0ca005e3f70177d598c334545e11412a14e8954605e9aa315af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7730325ab4192ee93e68ce00cd3456d15788dc497f0ef09f2b452be1fa1e0c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 32c6747103f83f4edd6eb22ec07088424239740bc9c066dafd29b1d18a410231
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44eada45c078837244e7f820f9f753694a39ae0fc27f6e140006a8a59f78c2a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b01fb6784ef2134d92349211cb560d2574bf6c49571244ea856d8bb89852b471
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c76246a7e646865faac303d68026b20a84e9a248a6d5ef30d84242d881a46095
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98e4f385c8d1595c2e57a67aa1a3b9822e63a246b59971399cac755288712208
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 83fc8c957dba56a03e197b6ee8faee09cf11b7e10ecf72712733d25d47931200
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e845ca47a50c1d7d7617af6309b83b9d354b22450f3ddf135ee6d44745cafcb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e5ffaaf097c19b7e817b9140c69f9fc1cf92551fea77c4c2dc45f2401d41045f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c7aa8b580b6afb4548049c6654be1c17287128f1ab2f3d89850c925c95ccb33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c8d31ba110e6986c7ef8228990da0e9bca83a0732959394148637306046e59f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d1a557c4074e2d727f4acbb3a1448bd194031f095e320a169cc8c533ee488862
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9da8064830beea5ad4cebd3a0abcd47c1d4c607e812882e048fa9529abf519fd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98cfc602ea977b234fa3ee27d9e2f6b23575afddaeda8e323eb0be0cd7d2171a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56d22e7cbdc82c5356be8a403074679d28079785823831a45a4988aad0ff4581
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 054b21653fc11c2928717f38a466a8dd0740377c32a3444760b53876052f36ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca31bb40ec9fe83c34857fa6298094729635c1cc870691a381a229320a2c9c21
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9934898c937038bacdf8bddeaa6e8e146d06d64427eca938a4cc0ba4786aa5b7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c848f7b087357853175b120361e611a6c6669a16d1875b880e1ac2df7c51d142
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d99ed812fd828c2b3a300ae83330409122b9f183cdad73a9df6697e193fd720
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6de4f8bc30c37c59dd7c57b0f1edbec189297d15947dbd2e8fd4fce7a259c4dc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aaa95f8f5088bcefe608ca7959bff2b34c06c6d0ac729c9b76b45c950bbba5c1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad89f8ab2b358e60e1eafe20ef8bf97cb7a880ed0fa8b4867f212230fe442517
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6b247b1ecd5348b3dc1f8cb54502df5632af5bdc1b86b580df7449bab9ed60ae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 386f1aeaf18b8263315ff2e612e611985794f123c004f904782b7fb0d81688da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11689ece804f8de26646affce4a60748e807d6e57de96de6314fd7d8fa1236d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 31494195103b99f95c6afcbae75288199499f7fac4c2ab14b49ef6b8af6aebda
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7390eed7afdb55013dcd642e8719f392f987c6a90000451393fd402eda9151f1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d0ad930698176f958ba5484431738c30f59df50788dbfe747fbb78f9b75e23c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75693d396a2e32b184fe7f2930811519069234c6d3dcc1c2c67e7514136e7a5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0f0b3b143098cf4748d52449b8c817436b3b44a2ce30a59ee1ca8e0c67b651d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 da627ed9d186c1711705c2b34878015c7a9782644bbebea9c81dc5a7336820f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e86544ab2078b8e0f0fd19c9c3c71663e2c0d214bde66d3f9f857221eea56870
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c70ddf7adf76f0287efe1c51287a86bc405f634ea0503534d44b228c6285321
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78e13ccfb1535393d7a0d9b454fbd315f48e3c0500fb63c96702170db9e667ab
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22cdbb9bfc12a018faf81aed46fd0f4c844996b4fda374b33d00af99a299980b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e288a7d336ffbeaa94115c0c3e3038cdd029d05f068e49908ef6ba0088d7816
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e22614aad7ee4fab5c76b8a5c597934c88dfe81476655ce1b07c7b631d113cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b138ced741ec5955abb4ce5da7c166caba58b740aaa225488c9948c3421e3ee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d7777b428415ecea87b2bee4e71b74cc4d409699af2576d36147365cdade19f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4115071889b8f0a0396de70c8e8da19cbce7185e1d4f2f79c181f075927ec51
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4153cb5d725f95fdfb65ea68d978439be62d88068dbfb84cab0871daced89122
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e9b5b8653f267ebfab6e9fba65c2897d23fdbfb6a2c56ac136160f369f9d2405
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 34195d8e0f7c9a6b51bf9eb5a2e2407eb344dfbe7bb897997b454ca48a62b162
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0c30195b711b696dbca989dcd149dc8a1ee969912e355d199ae69d4fce9c478c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9cb30b5c2098ac4f3048e70ab8eb5139c5d95c46ca79357dd904bac887ea3df
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1e55963ea4eaf611fd8107ddfb8f070c92d1b8aa573d94fa5864314452c6835d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c2360c9939d218f90b58d148ce2d4f709f82a6d3a92e871c68b307ff3aa7c60
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3b6ca7593c851bb0af73e3bc10b121cd8a5fb43a7ca8416b36ec356474eb55c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 06768d8dd36b8bdee3586c7813731f5d757d651138150816854c2f6345824556
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 afa954ce87e38f786f3d9a92e7e8e69d67920b6b940f53e64add7acacbfb224e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 95ccad568272a19ba40f2a53a5fa4a1f6dc5c009322277bc5eccaccf4514ef0b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a804e4770b9fe130a7e24bb22c0b3afe007769e004e012dceb8f4013c0a0013c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1ed02d947d7cf096faee4360c69f1150eee856430682b6797b8be12eed92eafb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 835fe9f5e510cff06e5b0b3a36ab530bde5532325582fd533bda980aff223e74
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f386bc31ecd4915b4b144805419b3302bf1ee6d4ff6ab3b1bf760d4d47f49528
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6205c022f9d5798be8d43d21fbe1c8ea0a07ffcc7393b6ec588a6729e04388d2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 444844a05e8fa126b1614b4a782591f3a1ad39311d160d0b3307abb23b903c07
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 797b670d609992a154ef3e453e4b739800bc65bfb41021b1cc061484d730a1e1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e50f44cd1235a4895ea9186425b345800ef13e73143629aed96ab5a66d78aee7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6dd28a556870e886e16ff98db935160e87cee54bda4589dfd0fe46e4a6d4da92
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca19b1a7a1dfaa37e6e6ba10b740e5c4cc7d13a315a739129f7f1f7becbe4c35
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9394a6e14b08431b627d4c9299a464adb889a9874d99033ebd23757b3aa11975
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3402f1b91c2c7733a317bcfdb54df4ae5933d239ad91cc0b3a7a8c768ca0cc23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb0c5b301f5717006a6bc7bccb5312a8ba0502979336aa3f0485e97e4447b42b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1816fc3b145b6836bee63c3a3bc25a331737d690f38077d3b0bbc3085e94996
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08d348e2674486711d68acd431df2eb9e9c98b4be70a0d306588c82fbefe6b5e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 321e1ef876b64bb713ccf0a22ddc81a4e5eedc9b5294f6c57980026b2e58cb48
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e565a4a56faec1c2334e4b451736c29573987bc8e275bb747302b9baff930811
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2735dd9d48880c6401827f79f6f334ff65b970cd4ca477397041be8a3c13b56f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 045d0f65df9e56f648a7d498f1f394dde0c0945cf8623f45e85a0b836107cf77
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 728fdb0d270629a4cebb317c6e8369f60b36d687e368be2058e48a181df15915
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 27c73313812cded14cc78ef3b2ba34b3756a15fcd9cf6234dd98f5ab215a9494
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 81e311fc782ac5ac2a2902823184144b099fff6291a101003e202ce70feabd4f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71819e3bfa87e4bae9c82bb1aed94660239e44b63462a9dccf885e1ca2ea6998
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e987d90cf6ccc4aecce2e87c311dc66930537750d3c41810afdc86b634a8e37b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0660175fc943bad36a11101f805902a3c94d3656ee931bd372f30552a6eac093
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 500907a6655e57706b5babc10ba6070aa8b1f75436111e629f63217bb0ea5644
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb4748ac8fe4fb25df56203e81d443bbd1dcb5d57baed31b6f5c7340627336ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a77e5af5cec16323c669e59c426734c90a9bbc2eb561fb0a5d2de18a17897489
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca2f37531a72c911ecc20effa9459c348dfa5f0d90263d4b9a44aa10ce5954af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2f6ad496a568773d1899b8b82d892c6e378ab5b7968c7c7036cd7f10ada05756
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78ee9c9406973c98eb98e5417d6dfa6e750bb8c9f8224a107f7de01114513913
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ad76210e675dcf7f503f40d02007338f7c8a4fe2a2549b417caddcb1943a4122
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fc7dfc04d814a119e9ee65eb2ba9bc75a0e1701d22561efd864c1b6b601ec12a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bfa34f58e2c60bc09b9489db2c8a7fd3327206785752c011138e6c3441060ce2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e475f579b86e08d7bd86956d526a936a7d450765d370150226c87e36e3285dcb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d78f3fa8058e51c5ebd1d3bd46575e0239b355bf84a1eee353d755d4683e0db6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb0820980699e8c07774c7d461dfeed0b9392b24bec86136481585a824cadb7f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 02a9b998304757c7aa3b151a57eb3e62a6cb904631b92919325cacb84c7ef481
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fdc2cfdac869c06665b777ce8e083b1f6a71df807b6f01b40c60e126899a1165
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11f9e7669a50070b911331bbe9cb1dc15615f34f52f3b14e373dc35819be3694
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3090387089285c3bdfea3f1e4e3ce68d75e638d1f53c49536bcbca0d9e5179f0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 75e76874b7943c22eeb547eeee50d2306e0dd69926be0ef19cb120359bd500c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f118d631fe47c50ef38aa65dabf0f1254fe245662603f7e58953825cbd39bfbc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2ad78c8b12b111d753232ac03263d44db28cccf4ef9f3cf9891530c4218f13c6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 48a7fffe1d4198191244dd1e5a336965b8739b823c9dbda239fb01bb85227caa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfa47dbf392a4b94143346fe194635a25f208a1b65c5ceb4a4b05ca88ece8e3d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8322b50c2c765d2050c83a25de8965c22f92dbbd8f36d25b98b4be3f7e40deaf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e02f55764f2b083eacde39b01fea77a66cf4f6a76f49a2451599130020690485
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf615bf5297b7be27472e1a292d8056e36ea7132fe9e8f723677a22da5bf26b6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1a9b0e1c9498fe7c129253e81c9357b4a400b3757fba9747ad3a72d382b03581
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 25b74898b16d2e347581951f557b15a7ac811475d6648ad97b4fd98fecdb4579
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7f866e9ba94c6fdf3d59f99adcf22a5ac9cd4cc38d969b369d14a1bf21c4b49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cdce874fcaa223d06ac75e11d1d9463c81abd63f99c9c01e9c8f76462bc788ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e692bfd2e6d1a71a8bca5a3f4ca5ca6995448a6edf84649c3acfe456d2bf77f3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5b630fb81c6aeda59be7fc762688d24d220caa12851b0a0c5bb90e0e425e4fe2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 86053e6d986c535dbe2b296523514444e5ebfacf9ccfe7489100c7fe23649c70
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56261f113f1f0df6406afcac1095ff54bb8d3cd07c288576b78bc28aab9fdb82
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c19d9137b3052c3439613ce226f5300ecd7bdd961730492525a7188c95c2b638
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba54ed16bbfd8f20bbb686a4b8caedb9a70ab10fbc8bc8995f52172093eb366b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 db5a7fd1019d39bac335bdaeadf7b15cda382d45457810f3d751739f942ca19e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 884e4a5183f28239a25df867429b41c065b8f01eab2ae03da2461250bb4f1f80
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3a9edc902554a0a6c9820b3d4a5cf873d979c727f7478cda05c1142a5229884
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eb884e853d5a24d27a7e552d983969ac21a940ad4427f80e4ddbd6524c8f2ce0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a0b8dbfa3f367e5f113d176384a20075e08514f87e118cb8adf12b4cc7682355
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4b4f0de9cf41854d0db0b8c4773c70145162683621ff8faa299621188b436caf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4fb47852539793cd88707e089e503338bff0ba996861daad8c0ebcc2cf130de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a6f7bd4bb2808bc51ef4cd99c1e894793706a776919d7001df72b4134b84ef8f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 418b712542f73eb64d40f48281015b819af860e27ede59f5b3b77c3cd8b7f7e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 20a9c58c11e830550d49e8cf52786656c5cab5433277813b3b7a32ee72b60f9e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 47ed375b32216d5240f2cb56bdd544895e45108c7b5e22d72085095d83864169
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b58bb45cea550afe0d345edc11b18694e56ca186801960d7e8bf4acc1aa7c602
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d52350df2aefeff0d3645767646e1c397a32f27273518b2c739a0af04c4050de
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1c2d61d3a2c000adfcb672c8d8dee2d9df9ef88e52dc12c60794e5ecb8cb1ba4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c30f86680fd8a99c39025f9193c3044971e0b10a9af23a3b3091ce4685b30dc1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5801be315caa57860208e2eb52bf05e85791b8747b513dce46a79e53889685f8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8855ca8fac76c6f2b70d5ae8f1c100d3659dfd45a977f05394969aadc576cd84
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ced785f5eb9695334206001c2403bffa2b238d85f9f149cf71c820eadb6da262
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ca914a370692306b5fd6ac18edb91f71b15b3a8a7b6041be2af9a4ebeb0aabfd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73dfd65becbd56969e60aaa048f9c3c8aadc22b5d51a3cea751d794b6ee87d24
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 60b8741084ff4ccdb6103a4edc5d1ac10a71c1d92d6a3536f20b86c33112b3ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73eb0d080c48a41af1ebf74cd6888c64d965647aa2a06fa4c04543ce0dd60d92
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6543a783bec0252a3085d98e29dda356fefa046e2d828dae9dfbd077b69bf3a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7bce4cf46b8ad3f393fe7bf96e3b0ecae015191d51900b59ea04b22795c296d5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3dea99c7a973a34e4d1600744633870e638944a2815f8c209dc54414b01e7a36
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7005197b7a239fd3b2071b89d5c1434e1922422827a59adc5946d34ed8c07a3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6218bec6ebddb4bee633f3e2be25d6a798c1cf7222077264f18913a75522e932
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\dir\install\install\server.exe
              • Size 355KB
              • SHA256 0011c677d5cf3dcf5d396875c0a931547d5f601c752f8f4648d73da92bad2c38
              • MD5 SHA1 SHA512 SSDEEP

              memory/2944-104-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/3608-14-0x0000000000400000-0x000000000045B000-memory.dmp

              memory/3608-11-0x00000000001E0000-0x00000000001E1000-memory.dmp

              memory/3608-12-0x00000000005C0000-0x00000000005C1000-memory.dmp

              memory/4884-70-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4884-3-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/4884-2-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/4884-1-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/4884-7-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/4884-10-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/4884-28-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/4884-76-0x0000000000400000-0x000000000044E000-memory.dmp

              memory/4884-0-0x0000000000400000-0x000000000044E000-memory.dmp