Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 14:20

General

  • Target
    a2e13d685d14ab246c29d4c07f0da53a_JaffaCakes118.exe
  • Size 398KB
  • Sample240817-rnlnxazejg
  • SHA256 f28e60bccd3682e64420d3b9bd0d027732418b0e3a3d7bb22b691b48a5ae220b
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • g00.no-ip.biz:515

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2e13d685d14ab246c29d4c07f0da53a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a2e13d685d14ab246c29d4c07f0da53a_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Users\Admin\AppData\Local\Temp\a2e13d685d14ab246c29d4c07f0da53a_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\a2e13d685d14ab246c29d4c07f0da53a_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1228
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:4740
        • C:\Users\Admin\AppData\Local\Temp\a2e13d685d14ab246c29d4c07f0da53a_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\a2e13d685d14ab246c29d4c07f0da53a_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1000
          • C:\Windows\SysWOW64\install\server.exe
            "C:\Windows\system32\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:4648
            • C:\Windows\SysWOW64\install\server.exe
              C:\Windows\SysWOW64\install\server.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1456
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 564
                6⤵
                • Program crash
                PID:3036
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1456 -ip 1456
      1⤵
        PID:1432

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 a4bc94d8fe3b50ca5a0e367283b504ce43687d136f2dcfa4a23f4ae5e91f583d
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 096eb9a2c42a5a0c8c6c794b1067b6f494ac3a7f8f42ffca84696e490e52c528
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c99cac07923aa32580d3bd3bf748125dddd68ab58eaeaec446e69e0ead364256
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0f00dfb99819995aed29cfe1c1131bfb7e10b578eb3af78dac209c6f019fbe5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 07a32000a4d59d1a517d4325441d046e02cb048df96e281e7ebf2ebd8af53a81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57e634278bd91af7646ad14ee6e8eb8bf12f332cbe3e94e0683324ab086e1ab6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b33e88953fd3741e47f71eb448a00f5b072f02539859f3d881bed61e783a9485
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01f5b42c5c7c3df467d48b2775cc3f6c0524f07ad54e5e719df2dbb3ae43bc47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef04292d344a6f211ceec124a8d9e651cd261e8e42e83d68233b30aa8d865c98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32ba7778e1466e99a1f5096081cdc4f3f1bd806dd1d4ee7090d793fc57e6c75f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42da32e2dace5b79bccf157ff4e23e51980f2288bfb096e3955dfbf24ccfbbdc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec7c394de20188c37f6c0df0b272402f47ba37720ce736fb49923d36be6096c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 487da96466dff4449591130d4ac0e9bf1a032af987c7922cd73ced828d01e7ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ea3c9c92216287eeba5cc9c412584c7d8d534fda95d618ba925b3803e5398dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bcb9ffe5d9df1a7eac01c1bb62072fab03de70a3115e7aa7d132258b54db799
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d0ad568c7adf65e1de776aae4ada0b08eac840b3ffa30e40b4a5e7c82c807087
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e252e99343aa2265218b882057a27898938bbd86e8d0989a2f026d06c51bcab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1945970a431c75fa43e53b6fa07f58ca2f005351f6b9f66881d0c0b44f0fc1df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1b88548acde19d0d9232821a9a981cd196d9b289edf6307c3ea539c8f04d868
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fda8c31f2d7fb2ae4578b66eb466aa874f888f46d0c95917f6b44f7960f5a9d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 440baabfb4eeed24ba2ce6caae8d52ed8c27a9497532227d02dffab9fe57778a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4b140b63bbf152f1761f4606239d52ff01c6ae8f59713baae4ece56ef701df0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 642eb90c4192dd510832a126235694f96798fe31c676e9c71acfc0877752fb6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6eb10a20e74cbcda8aecc5a73725c9b6e69f6cc73be884908ae264765b667449
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11bab6123bb7ea7d9df56c391b06b4cd5af81a7e623916ca26ba523d5c10635a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0344c64c14b77c235a0f66cafc454e2c2cbef8f7b254672eb73827fee1824805
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 36a1736a6285b1ce2599131ed2826504b0fa1fab59784c8c2c68184649667b9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c69b119d2e51a29a329ec852022d070f1639c6e35806e4b2c2d1cebaa2ab46d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 434ed05566f86563725b78952223c702d49143152a46dda9ed5054963ab50a4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 338b0ae660365f09c08b61b5e15ec57d970c810a80cd5bfb8cc957ea5e10fe39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6520df709b0b886517c7a35b9f16678d8db009d5a1bcf5eac8f88791524710b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14e4f6d9676829e857a0d9765fe8ad067e1ad5ae81a2866fba4a737bce26c1cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3746b07f11d44d3d5244239238a37f792e8016fe9e3760759f1124a49df5be99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97bdc8c0e275ccff4c9972f45bddd19a5776a9b3951df467b841256a0ada3256
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e68b871aa3f882127aaf2b7c40111e43eaf747eb5e8b98a0ef83ee7320dfc31d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96230eb9e316e652e4716db08bc2055874b95d2f20550a5b4aca97861729e3a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13a14241305a290fa5e401b8de67fe424b24f2c2ba5365a10b05c26bfc99fdcd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 becf44ba52d8fec5e704e218eb9739ecb21d4cbc0748c0a835d2f235af85c8dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 879bbe1e07ac5405008155408d3639fbf01365f7f1d9a485b7b55926e5423345
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0447b23183801ff108a598c60f49b877a610d41c3f14a889ed96046e9566654
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fe17f1a761d72347d346405494310a64e9a2cd732bf3e1b5554753bf18ea181
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4df428db390e2b0eb2ad8e01d0859a5f0f008cea9090738be0214b78eb711a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 275688007f0ca81328af3e5e50053a26c9aac18894082a6fdb08690c4869edb9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2171f4ee7aa6ead8fe1d9a092ea9ef34146c2797c7f9b5ade4a964bd85298d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3e8daf35e436633c95a1f6d1ea441ad7070b118edc8ba9fb7b4887566282bc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e82c6f9e2094e6293ec3beabce0e1aae0fde448ff759d32b7b307d58f2853c7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64a83de9bfe76e6df059b82b3101442fcec6bc7825e7cffd4866e226c18a1a26
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a552ae3c1f6df7c4601fa0b369cb01173ec4357a52506756e46e003ba47ce3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c71691a72fa5c0da412f673bb3bc24a9a93befcdc3194a92f944a2929174b79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 563b0f4c2314cfc7567f67c895d9a12dcca7f265e29531e83a631b8973b0545e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bc31604bbcdf866592806a86cc61eaf285ac44ec931a3282f6e58fe9ea02403
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6bd40a786fa9cdfc6986d20c7d686a30d42e6ed3538538e4c95580ab3f8ab2aa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca60ef64be5b37bf1dba2aa4c0e46508d69657393e3adde7f0264cf8ded049a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af3ab88ff0443a6fa759990b9cb2ff111bdcf6e705f3c67780e172b4d73de50a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff5f762988edd4bcc24169093138e2b8bff2309f6ca93396b2074e02d1223229
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bf8869f8a2a1ddce2396ffe6b78ccd489869edd68c2d5de2e4393541ab45833
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4112bf27003dcde222db6702aa3e78f77f7786c0030986447a7b3a4be16b19a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3decae7d00e774697d48c86171f459d4a43316d4cad74a277ed157cb69e2f69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cdcf8dab8acbe2e04dd4f97ee32b8875aff0ce40785622761aaa2f8ed5885c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c175d808e73c437ca722d096771617b5949d950fff02e4e9e786d740827b3d10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a80e3d36fc5f3cc722ffb974b64d85fd4f7b5150a621d95e7b67ea4da242990a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 261fd393544956ed1ba091015101edd9df782e4769d63c1af3acf1e4b335d262
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 98fcaa9d272ee49826d516c5638fd668c5835c9b4221f3a2cf130908f5381af4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 270051094a9f87508a93ace778fd6e500576dd9d4669a23d186178a818af9dac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 850da7df3599cdac14bd47cb00530dd329a5a19bc21cf475ce3a7762d6ee4284
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cd1ca4567e361987029a0872ae7a3c36de568182f7908cfff5a2b9d89d03e48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8228440d309db0c7b543f85fce763d3890377d34b3ea031bb48d80cada2d982b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a669b871cb7b56ab5d7c090810a80a344646407ac552e62ef1e03b2f315bbac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e73522143f3c56a6df2567b58c48d61854a267c8b48a17cdd693cd2f3af49e6b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be175492a99a9637d979d80f7aadf0983385b26c0fa286e14976841a798f46c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b61b47ac07c037da798326eaeb9ec8dc15b6c891762927607659d1146b75a378
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f4bde18370fa34ea9665d1479bcbf04310fdacc057dadb431417b94dffd0718
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e42c5a65dd3195d0ebdf43f1304d20dcdf7b85cc7688e536c5efe0d00709954
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28b2011e08d7c3362a0e58224b678e87b4ec5592446ee1f1675b1ef05604281a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d525c1f33daadb663e21cddd31fee8bf081f32cb202375b5063480a694f273fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d9d76a4cc9f7f619c3a238fd3fe89c2e47019a4addcd72ddf897969671d1b25
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef40a69413b1016b6dea5f7c24961b5c8a51972c5fc114a97e97e1d0569f764e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3097c5c7f01b53e9ec4b98c62c4f1b86686f1f8c11cd35ab3a154923263b24c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d41f0db31c22fbe9f004a25a12bba6c6eff6180960890764eb8afd85d59de97e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d8d5c78eda83093ec295154cc0de1302b049bbe9090bfb8d3c2893eca5620b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 162e1fd99ee2a5295aa4703578486294eb7bed65f2f58de4bc98b2c49d82c063
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4215f35a8650e505cfb0537537ea80d0f553179e8a212295caae1b6d205df10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f316e51a4ad9e553ec20f3e6b427862ff0ea441cd0d508d16cd9f781966eff69
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d3f8b82268520c675e4b67f5787771d75f1ec033a5781b0b8b606dfb6e133b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8628228d2e7a0fcaad2cd6502395596ec0ec14d2b73c827873fabebb8488ad9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 531de58d9628d357c60c9f462a61e3a41dd63cbdcbed2b56c98c5beca6f7330e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be2840355f9e5a078327c6ef14a917680e914ac4c752f69297153f95d0fc238a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9d30ec89b73b89d16068f1d6c48e9f7cf4e93f00856294a337d61f9d7afa294
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 871b058dd0ff63291eeed31942e9c3861da663a9738c606b5bc25c77002dab7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 459db93d5a50d742e3994b379d8bd71da47d68ee5e487bd8afbc9a0177516527
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3049fa06ec277244f0e825ed6175bca8a928d1bdd5c642289fd02bfa67b924a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58836d8c74cbeba4f6068d8debbf3494b8fb8f677dbd10bc3e6439e35ef2a515
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f086ae5e4809ea56d4ec5b122e04b65b0426c44a1c6a0083b65d7712d3c476ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f531654bb778a588808e85b5c96d97169ea451f6807d46d3a1b55a36c9a51d6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a97fb5851ec71b9166a293bf6e535896bc2a6113b6805edd8412b4e6f8b8a83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e7d890b28062b433782afcef6af2f7f72e97da5d30a05c9c31467889b51f549
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8f6ca4fa63220239e37dd16b6f3a3ab3bb6d01376268619a90afed8e30297fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 65f8acec1835378ca84337620365e52d18c52da10dc33baf5bd04a04989ea2c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c919b94e20fcfc652c6f93d57ff0e061fbcfaee3861489db31ed2b208248aec0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3fd0abf3e34986536e7554505e0d2666375d90becb0649f87a2d53a59e8d2aa9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 37ae8148f8866c3412873e56449d84ad16c1cd10454a09bffabcda9dc5332cb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e05a261c581995f263f4188abee0ce00d658010a60533802ee664e299c0df339
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba9308496a41821a21396f6d0f308850dead30b57491d3339a4e91d6ef832583
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c187407db35c8b0193576b3db442d2172c6e347fd1b212971990c5f18f7a6e47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8833726b8a45eccf4a5815cdfd46a4ec3e4277920306a182ef26f77acd15e053
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df9a5652b202f6e4d25902ceb6b8fd11b8663d19ecb6107e5910e6400c6b544c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50c138f95d52e1170471b1ad4436e71e4941acf76822b7e70443dc9629bf0d3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 732157dbf630d1afa7fe9d5a64eeee158287caa08d93e959c747b3105c4056b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba7f265019b63e508637d2afa71d9bfe69b81b026fa71479ed31c00656c21bf3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e6af23b014bc82030d0cfb8a2f171d2a59c73a23b28c34c654ac6c1f9bfa10c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 616511420bf42e682dff8737dfc5d7304c677c4ec584e5e908a8a9f3d1c48fe1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8c287c2370e4d5e3fbe8d15196bd3abc15f9ab2a8ee52b374ab1105c96aa5c5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d57586cb45926f4d61c4c7524be01a8cabeaffcee7533d6ed5476dab216925c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 40aa658d81aab58c7156d14a4e125e105306948d99c109f7ed8f9e14ce15e773
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90613b4ed233759d9fc51e61b49233a3655ec6b90f8b16b906c64074c453e8bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 44a732e130e08ddc9d1584be79ddf2ced5f0ecc2433e82ec0ced9fd650c84cb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d11ea64324e18aa0028ebf3b6f5aa3fc2f28082075ad383e1cf4d72e5f36f40d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2abe0df7263f63434f3f25b552439516d119e99336f673c796b4fa5b44bf462d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6055f3adaf494b918ede79c4cc5c86cdbb0d902fadad53afa02dec3d4a32d3fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c820930befc51cf448fa135f1c75aaf42c54428eb244ed39068ea8272f42a044
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5b8c762be4cfe68ee2651bb6f1668e76e44710cc024fa731fc87001dd1f3ee1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c957e5a51e86f40a85b0f728bb0fa2a67b4a26a5e2d8ab1ca2fcf3505e8bc8b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 483d461d0942311be5f8a2091020298d1c26d1628fdfab7776db5e16ba458b5a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 114dcd17656dad2f6476d9046183390217dd742522272d76e2e69ff8052625b3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b81921fe7f460884880436c2f5ce6b65f94acda3413cda17ad452c7cc240c4f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 322ed20aa7da0f3ab9a1462d59bc272bfff6374602e86c50c97904b5271fed65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7539231ffd1890109753eed1f748fe6ccd0e750d11d6394e2d1599b83fadbe9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c49dc6640ce623c23a0190f85c0ba806673d61218c8f9e6e6899993f6fb8b5b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d461fd5c1339da259ac797635f5822be19a78d3914b17444c50e178f815b3e16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4405a17e3be30d0faa434f969ad57ad01276adf841e6cebffa7db3f6bbfb6127
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a59437e1445f3632e4c5cec24bce39d4bab633eaa9a35612128cff566011350d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 608899043fda79e43a4105c7bf282762df0d2c6745ac963f3b406f2bc8b413af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fec8c0cd13df58ac4803f741364ad148dde836d8c0b7fff85d57ece944bc538
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1535556d69ff95248b0e7d65e60ba02a3976bcbbdbfc32355e31ec0e547d7ee1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03239235e5481cb4c13c005afbf07201a3cb29bd2c1997a4a8b2a075f54c2af3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1047eedbc90f7a7808ae2aa47ca54bad43fbda12e23da51c16b78d14124cc9b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1616a094c70e7b6696670c455339c89c6119b4da41a7c75d378212d9e2c2bef8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28d4646f0e1878267b9e18450ad91624e1ba8d67aacbe6b66b74f714e1dc928f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1314913443c6eb74b123f9c372cb8dbb3375751f3aec35b78f44b15b2ec61537
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8950d007b3c99c75eed14348b81f6c9961d9abbd606c4871a9a172817e1a6f31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ded3852d00f0b819a61c88ec46514e98b3d6f7f68f57b68d38ebd482137b36a
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 398KB
            • SHA256 f28e60bccd3682e64420d3b9bd0d027732418b0e3a3d7bb22b691b48a5ae220b
            • MD5 SHA1 SHA512 SSDEEP

            memory/1000-123-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1000-20-0x00000000005D0000-0x00000000005D1000-memory.dmp

            memory/1000-19-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/1000-80-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1228-5-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1228-0-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1228-9-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1228-1-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1228-3-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1228-7-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1228-15-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/1228-18-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/1228-10-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1228-6-0x0000000000400000-0x0000000000450000-memory.dmp

            memory/1228-14-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/2412-11-0x0000000000400000-0x000000000046B000-memory.dmp