Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 13:44

General

  • Target
    a6e2edb21400ce86784f79a6ca47459c_JaffaCakes118.exe
  • Size 1.2MB
  • Sample240818-q18tjayfmm
  • SHA256 69d08cd77b021e71ee9c6ba44e8d93b25cc671addd0ce23b8facb77f78f41472
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

  • borcanos.no-ip.biz:82

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6e2edb21400ce86784f79a6ca47459c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a6e2edb21400ce86784f79a6ca47459c_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4320
    • C:\Users\Admin\AppData\Local\Temp\a6e2edb21400ce86784f79a6ca47459c_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\a6e2edb21400ce86784f79a6ca47459c_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:224
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:2860
        • C:\Users\Admin\AppData\Local\Temp\a6e2edb21400ce86784f79a6ca47459c_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\a6e2edb21400ce86784f79a6ca47459c_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1540
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1712
            • C:\dir\install\install\server.exe
              C:\dir\install\install\server.exe
              5⤵
              • Executes dropped EXE
              PID:3680
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 532
                6⤵
                • Program crash
                PID:5036
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3680 -ip 3680
      1⤵
        PID:4508

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 a420c37e5f600914cc2f920208abf692695bd0efca113287282cbc2b016727db
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 ffeb517db6a23518eb6fed7d7208c9715aada8d57c79e41bee98ed543736a370
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4399dfc46e2aa66c86af625562721ffc91e3a7a0bfccd87df36a2565f55267e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aade294f5de21c2502ad4e7f00add9a3a88e57a8a4fe9c6543891668ef6051af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cecbed9012bc47f52b26177b7b81361d3d825bf4da97c2d26eedbf9210191c05
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee28ff15d9d5c500c4848eb7dbcffbfb3252bf1d086488b13882cf3acf17e77b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 583139951504900839a9babfc8625d6398f1012ebb61ce4696c7b4f585a52d21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ae66753d95dcb65e6a2c79a19aec5c4a95fee60f5bac590ad720f64bc51212a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1822bd50792becf8e68ef4f4af43f01c55f72e74b9e1c925f4f6004033312149
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83256cb5d981a8e5af7efdfae90fb05e30d9f368f1c8c08908d6c55b7f73ac00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1a011042c051a8dd467bc9bdff3632ebe33b03e48782796fee1c2af5f051a48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d806e439298b5a754054c9754a547325ade8f7e12909179219bc9f1900e4e3a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 49f66dc4e6d191882e7745d10debda69d6ce38d1af0207d84afe7f5470b8bab8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47f7dd35f3439864f3a9eab2a6128a451d794e6c0f8b82013b431a3cb8931a7d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c5e5092b558ef380c3fe77d0d408032660867287fde0cfd1e2b950dd66eeffe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ff10174d09259ae29667ae02cfe39d8d3d66f6923ffd4d4f364cda0cce5ffc9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c277ee5cfbb68fa10ba8dcfccae37752cef16477d3057b577224f8e568a4287
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7df9a099fd73c448c95501246b6c5da4999eb4fe220b29035c117bb024da91b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 426f893322544a4db1a8192702d23a60cb39ec04a1bfbe0b77c69c669aca2117
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b0bf6177e3cd8a5b0ffb62e6a080fea9d3e2f5682ecbfa3af045590d6bfe747
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 822ff108e3e50ddc0d1b04d36c017fdeaba4b968d41e13db38609f5acba36011
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee9873b58b5c77a756b30312b2abb1a2da0041f84862b775c86195ff307d2704
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 85c9d45df8c1061371d2610686961bbee832480f277024277139f69d0bdc69fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b258320edc35b526115671b6426d796ec3bb252a3531b284dea4bda5a0770db5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1fcf944f04c6d8ac67f6f5d92b2d6f0924b0c312a6235950d35acff2a724128e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 390d591a9c58d2e6756d4191e1541358784fcc0d2637e30c007f8afd751131e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 608816e34fd6b486dbdd05864a8ede14590c981e2dda85cd392959c2df99eddc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 712d0f668737870c6ec7c3fa345e6eeb6fd6f139e63cbed9ee68313b64b6c5f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 700e2a51d3a76cc1b540e6ef4b65a6b3f6d0eac443fbe7757b4177167f6be126
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6cbdda6b4e6555776f3816a92f161bdefa998a1484e6c0ece9469e698467cc68
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b31d70047969a225698c64134137139d0f2d1f18b69d2426cf00399932283110
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1d302aeabc6fdf4c55e3c73ad5e4befd1bccbcc9ddbc47b30022d56472098a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5390242e4cebe03b7cb948ab482afdcc14f87d5e72837713f6d2a02a05a43d47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1762e52462171f9b07c1b7ef7a9e60006fb49662094887893e117956c84b5a02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 111237570a5cad31d5c86b66049441f6632d672c2792f8b3e03573c3a4e263c3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c227f99051bc00b3f51e76ce92d8e84ecdd467f2682cd04db0353c8563e05fe6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0bcdf18413ad971ea3eab64fc81a309e66d7bbc3c34689efa5eb9d0add14c33a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a502fbc74e6cfa9091f5ea76ba180e4994dba08ccf7a5e054cd8904a5bc5769
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28aa703dfcabd7302ec354ecd6f88327d741c887b874c32e3045bd6beac89e91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e05c2446b1efd854c99fe513b16e5b8400c0f7adf398f709483e4c4f911ad42
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54f59f4c0ee6f87dd989e104fa8e8de7e0a13f8b585428ab8d0ad02e5491d7ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4242a8e8dad001442c1d00a3a9dae8e826309891ca8b17c12642f8ffd4b57f3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06aa20c4d3adde629babc6fd679fe84c92855f4aec8ecdf1da645d3172491df9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e830a45bf2ee20102e0e953cef9cd6160b5cdddcace969d074904477eea5946
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c1aaa0998f38a2b77b52b110fdf8c0d0f4248a6767e773c462fb913d3022c855
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 72d79d78daa92a7ed6d97235853ceef822bb2e1b5303feed0407ef1c9ce6b06a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 880c59b44da0f7084ae12b63e1655d7275d5d2e2a1ad24a2e4ae87794ccfa8dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ab54ed68c6a9adcf43ea0d71e4fddc7551984f75caaddcf5b5499e35c2bded2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2cc10ea651810061eb9a7d01eed7923e63b978baef7835ef355f6e0123a6ec1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 54552c15b97b95f911d726b0324c24378b025f77f8320278163c12eb441f943a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2fe9d8a60ffc3f0311c84ab10b0de6a53b55a8eb6cbeea78fe9385b2421ce982
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8aff6312a17addc8c0c15ca168de590dc8553773120a25e376a2535769f85a2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af133efc6b7cefce0c24951aa1e024f7ae4e2c0143d003923b32593856c8cb3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0296f68562d2d57644608ac6d325dc73554072876e25fd6f521aa00af18f72e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf820cb74a5d9d7a4358e8a57666c45ccf5f61c2c288f53597b4ac01ab6b67f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dfdc9befbd18bee725e389e30907f7287ce1d4571beb70b9ca8f24f67bb2cba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0e114b6c3e52d9c30b0d4ca5cd66dcca39f1402d40f767b7439c66cab715128
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cceec002d95b4b1e18358f889ad0f5440813429ebfdef7c5f194e23ddabf4ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81aea839f82102985bf1e650bd8e40b2d36cda9e0045aae105433e160754d466
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc9a85363d4280a7e045f1983d5af435107192dbe14884a5e796904eca5125c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 338800893cd3b581ed92c595b52639635e0c2aa4f69640ded7e8629d95e904d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06c45cc0c407037b42152873042cbc660e9fa39428d0b256052ce5a3ac2d9b3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9dfff75269e41b60c7d25715868d26774756e150116577796d3ca2801dbeb606
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec7f91ceee3c76b88934c45389cfaa359643cbf889b96a56a83c086f873d4e1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f13bad061c6f7cf0ef8d00e0af1e062f7bd9a8a3416e5f38e7a0bfe54a3ad5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dfdb550ddb117a49487c77749ccecd8bcea76985b08001bb2c26923eda71ffd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b88b5f5e94f2aa7cc498e746c56d9100066ef2ec8052eecbeb549b4ed0fa0fd4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a42e136861abbc880614f36a6488b076c1c9d793ca16e921b565650affddc98
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 725cbd3f7397546de2e40f3fa71658ad465127d4ed5b9112479e83fcbc0ebdb3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c58eba667a86d1da0a74a773bab6f3c9b797afd9c3286dfa72914a5ba4054ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51866edee4520c1306b68189382651520e9f97ae02032f8cedadfac048256cfd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0eedb6816137320bd1c97d310c95709b7e5b63998106f0279e46ebc5acc6a13
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84950bc6d8704775a5e444d636f26e2f42a632556a953312b6901abc312c780a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51b70fabe59f391f43e3ec538dad6fa18390974f2dc9b1a0f07c650da91ca9b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc08e97af70cc32c99b8908cf9f637be9440f7ad67acf97ecbea185e903aa943
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5ed1e05a018a6da68bda7f0aff42cd3b86d501a0e534551963524ff3816a6726
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 467fe4c097997bdb252eda048a52fea01f33d825f7f78fa54ef9a1537d86a87e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dd0236145488a0a2adf9b15019ab4284ba3015b383c6823f269cd7f66ae196c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9eb1acd86d9d2eeb21fa8e59fcc044906af6102a92c3bb7a71a6c9b0200c196d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42a192bdc1fcf72eff502fbbabef7a5ec7b70e8d62f694c43f5c0746ef9f74dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29bfe4f8d52ca8e6021af424f86a3fe256ae8b2640af8ffabe51c433254c7c5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96400c2ae355f093883e4d51172592c6bc920b2107625d2007a82500de08ebf3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f2d4fc8485874215939dd1eb4b4b84e398f5c925d867232c76be4086abeecdfb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 26b1f555123edb8e43c2003f5f77b35a61e4927a88907abbbc25dd5601326a5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d54cd29e97f5dfaf6b8083c8bac525789edeb2ddf359c22bd5324c592aef25e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78b65c5158cc3b39b8e23d440b31f7ca93f668ae6e30d4ca9b864ae3a226f165
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5f43c594d6fea6ddd8f27f3fd7d189efb24d863a885653b5ae1072988b7515ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 50ab7a11ab93e7fd02cd6c102684a0553b6ff9b06efcbe382afae6197929ced6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 288fb53fd66dace6e2f1bcf3f5ae0c1896d0a8ec80260cd6bdc2699cfa9695c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 beefde9e68126afe1fa7808dc014a0b9f7a61eade510e48dec3619072dc62720
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 32ca783367b6c564254d3348f884fc58d7dfc7f0787a1c2a22d9fc6c11e12747
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b370ddf05f60313a66a75d0070a382f068a6a1180ec1ff055eff14af691836e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1f68a91ad8319217c8c5589266e2f0957ab394539de9011cc429454b260dd18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9dcabdb229a12da1b551e482e8c5c41ca39ec5d20fbd825c023bd0267fb070e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 469e4b60f9c78d95229348be891b98425850a6c501439b63df2a25a6a87c73c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1adaa611395811455bdfb140424e37d6d25264bdd75dfcbbc028f79cbaa878f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 223bb4ef2662c8f2bcddd8e1f3c3c3381c2e3c581c447cc5b232a63601e646db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ff0f10e81c25a190065577d791cd26a12171a055339d7a2b235fa75c98fda07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0306855ac016961d0e565ede2a7dac541089301b0e806962b383edfe0c6db87a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d952a8e035fef858d76d211edf393d6d53b1c384ef6e97225838a7985b2e8bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0345bf132d55bafabfe8fd443bd49e8bc9e2c0f77cb08a0a92affc4799ca89ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28f9ce876995ab074a6aa8228fe8cb69e8b15cf1a3d29c4e6964e63a73291f1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc18101c5c9babd660ec7282cc91447f3330ed3cbe88167c722bc9863c2ff691
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ccb492cc63dc6d9f8718f4607d055c807fcc80a641150b2bbc5aef1ddff92c0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c7996ae6ab5adccd9a4569e36ea24f92db90b2fb19084fef5c4eec0945e8d361
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9e2f70998d76bbafbfbd65acbc450cebbd12b5fede21fad81d2e1c910599644
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bafdfb99e791cc8353f3c45cd7bb30024b58257cfedbf5faaeba0d7328b3861
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04db02d1cc6f7b778c1eaf8fb1381cdd991509de0b4c9ccdae2e144ce1e9a389
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a772ab9614f937620b85db21e81843f5b18271645e72bf49519c9ee660ab1c10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5337513425a9a96691cba4e606b80164b98706572b8394e0a269fdbaee32d005
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 276154d7554a9fb62a6dd51a952d4f96dc9fe508edace8723e4ca7f2714eb1fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a6f628919a67e0c6fc830ca17fa3fdc7d4ff55ad0387ebe563a7d5c5f72a8cd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fdb59bdeb0cc909e1bf4113797623db946d933e6456f781fb9067953740dbcf7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39ed4b2c17d57ae7074a6281f812166a24a3fbbfc6c93769821e5f24f322769f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63013c2d7a7a53ad22552e4b158d690476c4e330168558e0598907047862d2d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba70d0c10d53a546bf030fffe72d508354993736ee2a75137e7d058e2c11ced3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d4796d484f3bee9058577356e8e777335977a530f224fccffec4c8579b787e8e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bee70c13542f38509ea5ef317495b97a51369be5b63b743d8e7d029eb5c821b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3df486f702e4c3a37bbc522c2fab388166c3ba6674afbf58d9bfbe62628db8e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66abad6f2149815c1e6f340541736b2a91081c953ebfd8bf8fe64136158eb4e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e36b2fe57b9113101a16e40e3a5a4590d83b30b540b4b1960f4cd481c2bcb48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2505956c8606356fc45a1fb945f707b1bb55ed845f632e608633b02af8ad0ffe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 23490ce799e4f88088361caf4c62561aa4700080ab2712d0df0dd4273465412a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7063cc3c0685a3c816a2ca5e654180530ce952269a50a3dbb8da1295a09c52b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bb54dc7d363f7528a4bb05cf13d14c130aa84a8f99f29f9f83d2a23505e32d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe46e2f84bd44dce72bd3ab71d02f68375c90e70d2dc11de26fc0b4f6864b2c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c0dd579b0682a415970ad295613a09e1075dfd9e0b0bcc91e9d0cad875a1d390
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53b8d47aa9f6db1b6c71c2e73ba05d521a392f7e2b9cce064bd75833f248828a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 579bc20ec3139d111cbd4ff8946b27676529d9328fd60ce4d3ee59f91a252028
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df37aa5c4eea5128867d109ccde082f258759e2f83a7f1bbed93a6755838eb27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d881cb362047af9d49a600cff51e1233fea6989434aedc35e5c5ca5b68931b7b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81ecfecf6a7689009d5236abdbdd74b3472004f6299cea44311beef6ed9a84bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba4cf1eff89dce4db8934bb9a001142710b7f53e6053a950da0d77d744aa2242
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59bf566f33868df444c9297a12ef6186284f3839f6bb16943529716e47230017
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56e61371fc4b63b7b802543f7f59800938e44df4f8e4c70b683a89d000cf5cfd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8e63b22a5f1631d569245bd179903f6b2629062ee18c14b85a25f766665e4049
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1a5e1c686aaae8ac8aad8f50811eb88daea843d493eb11a1454f2d4f6b42f01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 851b995147b284f1d3ca020c64ef68b36d657c071e9d2c19be2e99fe086cf1f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e011f91e4a48ac82427b8841786fc8776a610ecacbb321c460d2e2f7bbe60134
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 61a931345c0641849dcd87ea3c222fdf295a7b5ad7a6637c0b9542a29d253f21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 29657e69914776454fad44abe97ddcc7521120eed5f96cdc642809a1c6384c1d
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 1.2MB
            • SHA256 69d08cd77b021e71ee9c6ba44e8d93b25cc671addd0ce23b8facb77f78f41472
            • MD5 SHA1 SHA512 SSDEEP

            memory/224-2-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/224-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/224-4-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/224-6-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/224-9-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/224-13-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/224-10-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/224-79-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/224-31-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/1540-15-0x0000000000690000-0x0000000000691000-memory.dmp

            memory/1540-14-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/1540-18-0x0000000000400000-0x0000000000530000-memory.dmp

            memory/3680-110-0x0000000000400000-0x0000000000457000-memory.dmp