Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/08/2024, 04:20

General

  • Target
    add6c36a77c74d24ce97acdaa6ddfa1a_JaffaCakes118.exe
  • Size 811KB
  • Sample240820-eyexwsxamn
  • SHA256 9434538c8e23a46234ffc0cf9da7605b97ebbd0eb7dffa163dd415d7968a1905
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • 127.0.0.1:81

  • 5.77.19.135:81

  • 180.70.202.215:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\add6c36a77c74d24ce97acdaa6ddfa1a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\add6c36a77c74d24ce97acdaa6ddfa1a_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4640
    • C:\Users\Admin\AppData\Local\Temp\Anotador.exe
      "C:\Users\Admin\AppData\Local\Temp\Anotador.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5056
    • C:\Users\Admin\AppData\Local\Temp\server.exe
      "C:\Users\Admin\AppData\Local\Temp\server.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4252
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:3140
        • C:\Users\Admin\AppData\Local\Temp\server.exe
          "C:\Users\Admin\AppData\Local\Temp\server.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:4872
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2556
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 564
              5⤵
              • Program crash
              PID:1480
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2556 -ip 2556
      1⤵
        PID:984

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Anotador.exe

            • Path C:\Users\Admin\AppData\Local\Temp\Anotador.exe
            • Size 319KB
            • SHA256 5131315e6a4c41b35a8140838a127f71732c0d119e2fca0ce1a41258550d85aa
            • MD5 SHA1 SHA512 SSDEEP

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 230KB
            • SHA256 31aba5fc8eb08216e08c2578a491d3d75c315febc783548fd823c3b241f86dc9
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1afd72d5c009d78ecbf873aa4110f0d6945b30e176eeccd17514935c81a018d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90cb2e0b34e534db3e883e5ed65517359361614970304039f4211ba5ab267b61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fb19c1ac36663cfa1a643b915a4d272d1bbe1e778174a3821f3819310177039
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 578abd7e4845f9d226c32fdb60e3843eb8187333f07254a20923a977fc3418f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5a414dc9a8b1fccd78b8f5d0bacd9e2cfc28f01827d731e8e0360b5e0896962
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 072856c889a75ae2940ff034900d585363dc0da1e0da79a37ff7a23ad80c9234
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ac706157b379eb89a8c72cf945c91f16e7f4af2f0306b9a3beb14b552778ba4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf6da176bf7ec48ff8f0067510f9cfa5e324543ff5fe69539069301784ad7c83
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1aa18178bcd39bc3adbd4fc596d343ea1855b26b5e74eefbe40665ff54eea4f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 59cd394578f68be5664ff216b09844163a91c4618088da471b64268650d35a3d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21b39c2a9c6f5355d254fa397564d2164cf6598d1e87daf788ea940fdd332e6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ea3ae567b5e9528806b71e7470eae95bfa8f54dfac0598fbdb107962485afc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 869c576b39342a67897fa27b9c6252095971d0fc8e17bc1123e8defe115ba5a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb104367750acf728d36ecb3b06245c09a28d5f68011d0141e50dd35551bfaaf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 456c3c463d812367f515d76b44b10d23dab0737a9e82075f4a6b738661f57cd7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de7f7c18e6cef032686107981e666b87ae4b4d2a279b1911b860fc3121cbdfca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08bb101d8d2967b847836b319ae235fe54d2ff7324cf89371c043a45bc4d0fe4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be324ab8ba2c57c069637cde71cd41535deb375157e98b69947761b8b74b9568
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e00e5e65974c421988bc91558a8f7bbaf61da0c02952ef23c6dbdf1c14976d5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8169f5f7471cba83465983202ec8145a09aa42c7586fd980e77bedc418537fb8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5878b1cc8bc7e5027860e34f45faef4b74265fb0a96c0d15c07bd11281b874f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f080223c62c30a21c0575976af5e0899776d1fd34164b1290cdda0e4178801f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf58d7c2b809c05a6ad60d6c74cbdfe69eaa0453cea3fc35748ad417d9f427e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73cf735a3c072a3fb4e9b40f3b4dcb27916a038749ba1a24f9c8c533445f72a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11bd960d14f6c4d17dbc9ff9de5333a76ae033ec4542a99b2d74377e62d90386
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cffb1ae074d2089c0635ea227bb67527a0d78aac2701d5cf4419131b75b5e4e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88d04a2bcada717ef500997b0f890055bf27baea8483db8a94ed347ddca36ba6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4f6cef97be1048cc1fcbd48103f9530c2d716a7adc73934e4a41c9f7dfdd3cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fce5637f9174157baf15273f55250f70a5bdfb12c8e671b5a976fc5c7e33d185
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4729ab13ead2f7c6235426ff8a19cb49a301418e0237d4b92d57d4fd8062d19
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce434f1cc6c20509d559ead2ad195e28170ab418edb4fc005d595f669d3981b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88174944978d072748dbb25f08d25b7d876aea466ece48765c4624c0065e44e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 90556465be444b657ef72a87c342e4ed34994e77b7efeb7e7b10974ddd088a2e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfda215b1f9d5f5b156b02baa1f186514f914d3dc03b37a3b2dfd75cf986fb8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9997035e0debc5e7956e782766e8b3948c876271b0b29c5b391e1cfad2e01f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f67cec795632cfc6bbcdda1bebcb70b584b6d5896e1689917f3542d03ad754d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c5237c0d81a65b870165356fb00905f54032341c2080e5fee693db669834b3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99c546de96cf82bfe941ce91db952e0d89c71f0b63fc90835f310e205a86ff92
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5271b35a7cb2aa16f7f7cfca2544f32edaac5f121ab46d5e61d1c2d4b536814a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 698164f92b1a10ce02d9cb22b24e1e4fae96316b0cccdbbfafd0d942bc8836e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 540becc4f371811fd937db01765b680bfd87803320d9ef6552e1b245536e41c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dff9e236f3c7eb8ec8a18a079715e731874d1d1c7678b272ac4a10f5eafa68f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7746005bf3bfeafdb3ea45a15647d38f78f6454efb78ef041d73bc8e2a88007d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6f6c6b497f57a7f49cdb582d0154a24047662d5acb5788153821a32fe986f70
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58622bb70c40f904bc13ba58812e08e104d59b897c543e391d6f6e300fdd19bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b52511da29388ee79fab1ecc24f1eb5400396aee774d3b9924d5c61afd6ccf51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b0030cfebca60de19e9befe8cb94557b4593fefd5c3c86122814afabe72ffaf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 854f239cab00ae0423bf43bbb86b8bca4ea5b7d98d0ef35c11408af02a2f1b31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bb1b40500156c270fddb9309b1bef7440fcd7534bb49b2bc954a4f5cb4fc05a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb06bfff708618ecc8f0848f73a631df897f7c0ba2794fed638c3417ba10c0d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff86ca2c60c6b93223333be2110ad7c2a161d508a0382aa1b89fdc98e5b16bcc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c4e70a441b22cf772e42f217fce52d5b08d5a9290786b3d83fd9eb84ff315cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ac845538f4c515c34844588b835cce4ab6075c88eb563418c6a292e6fc09b78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a126ca6a4d9d81a576963dfea30ca45e2c8a4c0b8dcebc86dd1127b03c6d1b3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1d428853d0e883e8791ac1b114057c927d8c14cf141d881fa8147baa8745ec3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a61cbe6392503c4d044f6be3be327941721b63f181dc4427cfa0f93926aa7818
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b04db782bc24347d6679439e026279844ebfff3fcad1dffca9c5db7b11209491
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 78481e1dc0be4c09564dc4334c4cb827a591abf0764faf4abe83454c3d7bd596
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 892abac08d5508a29b6b040b977dbe2a4d767c29bf6a60cd46d96351a68b2cb2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e67be5f44fa0f7af78d84be3654d6a6496b052f1279167d8c0473300e8e3f510
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3de01ae6fc41dd9e494f099bd701bcdf4b09db9697ce881452888fc8af04d2be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c65da69d7caf4d3177b3bbf480507e388379f7bb48267ae3c8f4d65c7201a372
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fcfcbb36882b50f42505eaffd4594595f0d58367fb84ba7d10e3543e07ab625a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c0bd0b86453079b900eef559d947d9271dab136197bad593b34aaf79abb7fe4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db69e0eec238927945cdeeb5b12c77d9eff7c62c48cb52ec92a08240f4c9a2bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bbf7b3a33b7c13250dd6763c9ce57b2e0567165211ec353f76bb7eccae6cd90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca314c5b4690bd3cf7b1d6850919cbb9b960e76a9b6b88abcb3bc74cc253260f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe4ebdbaea0baff6eba716b8fc96a92aa8324183ae8b8e93b2e997386a8e2b3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71810c0a6125c27707167f32dbf0eb911bc749d2d5ef15f2bae6d8932ae3faa8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 130cdac644baef2a701ccf09b2c9239b493b24333c2f4aaaf59fa93170c78f0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d563153bbfefd71e0034ef0ee774a1e453a70d43c70c872be3120eb28bdb041
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27922c5e6487bb64ec06d96f11405e1b5a76487cd7282fb1193176cadbdaa1f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a095b47ab1fc2d407dfab4330dffef794f1d8f1a4477dbc7e5ef3fdf4ec03e3b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e86f3782d3ae4da7df2e7a11ae45f5e4759b4029d4c07cf9049755ad08e532b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd64995a184c70dff790a698d6ce386680451b5b937c7bdbae3b207b2dc91095
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b673c603cd134029e01c1acb74c46a839bf84e189d84732e043b17db1adf592
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9784263e53355540e177df2223c7421decdeb86eca1e5be6a8bbec3c9cf80e8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 563077d36908a789955f9528b40decc4a05e238c1d5a4259c45df11de9e83150
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2c75aa9d086fb81ebf79fadde973d177a8ebc5fd797e9b3cc05b95bce5fdce9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a16e7c518f01865dde7f09116510a85724826e9d2dae9b60a96245c95afc2c28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e804c927983f0902fa6e118f0c8f58156c589617de91d517aa268b3e0ee746c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b491b6b970df60e53e07a90df938315effa8a0e47e12a8b488da20f5e5aacbe3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a449ad390406a1ab44edd6c80f56432e60d6d06677ddb39c4b09cf5ee7ce301c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18dfc57baa12c85c1634b1a31e31a2ccceeb4b29266c87c799dd5340034ba1f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a5bd60e0a8a3237fd0f1396ceff75e8cd851b80daf9ea659b0b25770ef14cd5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cbab7e8e3a388c91719c5bb9544b1455ee2c33944b6b06090ff29811db319c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b4b1f14045b2b3e86926a707d45f4577221a7c282b937dea82bcf3c6d23ef4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00c458408d8b34235f8dadd27d55d37430f6d3447d2f3c87167a22b00d5b3521
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb68c6a16198e0916cb252594466c7f5b69dd41d906e5f749fc0cf993eaf7ebd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2bf2fe19b3f6aea8c18c6589080457df8101029e2d61de3d543722c76793a17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19f5453b78a6c074929dd57bf4ce9a3fee5ace39e6fafbdcea379df5e72ae627
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53cfe8af8761f31c4c27504135e4cf3101dcf55c8331bb7241067f6acf2d4201
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abda38331667543464ba4046147531992a9152dc3e64ea727c96f2da0431f490
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e0ec57c4870a747f7851706d7b0f756d61a4383ddbdf141d0392d76dea7bedb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4bede4fe3398e3fe64535ea5f10426c9d597bd7fda09c4eb7532dd2c2686bbdc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c29b67186ad72eaeb9afac5c01df80cd0ec37db61ee36723d8c00c344b207d7b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4757af6ecbafe40af28f190264ccef7d434f07e43a90aa557df6eb0736843e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1113d943a16f188d60b4ac768f000c859b2c813bdb5bb7ce936130a71a8a76a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b9b6da72b162ecbbf668fc6214537d595d9ab247fa8e2c5ce14029de3868cd7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b0b1d61061442171e73dd32725c5cfe6ea7054ae935536766ac53254ef8340d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e8f608e065bb15d3f2cab7d2bec2c4616a03ac94d1cf0c1ba9688f90f7173f73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7bcc8ef7119197db068707a757089125947a12a820c6420ad5efa788bb322a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b636417b9d87f57ed6cf52e4480ab8c95a321f963943178a8ca554b41e696511
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2107939512f1740cfbd9f1198815ef6215fd2c5609facab752d1c7d9d8933e18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b4bca94c1792872462c511f606cb3bdf59c7fb15053fb0f2d35939b3a2819587
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01ccd9857feeec883e21e9505b6d7271988aef0522a9c9f3e66a78761297112e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3599d2d0ac85347d5a319654b85eb6dec4e957f5677344e17041740d6596f476
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f386b292574f6df32f217bde34591be76ab77951ea2594105d9e948a67716b3c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f132fdb36677ddb2d0587ca4d193c661d8374ef3ab6c767aabd6d7c97b0b6a5f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77f108457a248864ce831e77a0c1253b0c646eca42c3b49539b436786f88686e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc4f399fae1010b07ce0e843c83f96f137b8bf99194173d42041b099a44ec246
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8d9a57a5c01b2697852024506d67fbe7fd78538e84f2db117758e0c5454d1dd7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c66c06cda556178af01c28684bcf784def4769deb19201a38f070f00c742d632
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7992df304fc40b52c69ceeb7d9b83874dabec1ee24759637c83d6093a94c2ee6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f4a7948402fa6d8a88622fa195a7b1d6c2b66a62b37550f854f86562fef6412
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13365fc1e16c2e51906a473ef65bac222f7de2a44936af6e5241ef27a2994c6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d10f378ed0c635af2c980616a601c076a0032bf2a8b1e7cc4a3742430e82af58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1109d1fad44b3c00a92f17da932321e62b6014c3507ed8f0427bde55dde363d3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6e6bc00ee86dc4f9fbb357186fa1b8d010407a3a1d14448d87241d38f1738ef2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73d733052fd4a803d6dfc92ef5c030567fdd10314143003585d60268f052fef1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 530f60d820a1a6043c2a581efe74f440c3c68808f7a7e4313702483ce71ba5de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cf1980403fd582db7e70cacec0137154aeee3c06e283e4c966d3d76e92cacde6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 235c3d9e525cd9e46a799c1a7ef885eb1d660cd0bef87370d7b5ccebcd73575b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c05bf1d46c2ec32c798e1ac9f78861ea25d4540578282b52f9f44a285a09b97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e62a6a7fad7fc4f1251e462608837acb668410190f688efef487067194357083
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66effc5ac4ddcad88d8d88bc570b8e4026df0eb8f3c8b178043ba3937782ac4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6f1b806dd4af326055421fa07d81f31c1ace19536733a3712e2402454c094db1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 458f5d986120a6249d408320ad98bca2ac8e6f18e7447fef485b874c79b612ce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47ae0d0eaa51e10dfed8316c3840fc98abd17affaa21ce30a03d5e544b2f01e0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5a7ddacba983a33ce5f2066eacb4357cfc71412c77bf332491f35ae2a85f899
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee032889d96d5530e62126690c89972c9b1dc275f5a7643ea3f07737f6ad1b43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd227b940342c0d2d36355d3de1602d84832b257cb76a8ed3018fe18c9436ad0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee97f7062ec90719c2bf394b449c736efc1f9f86cc1e56b5352cf7a286e9c972
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbc7c02c06e894f508712bccbcb73848c8fee10dcecf65ac53384665b205e09e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b44e7715a811e555061427f9c552b8d3e9135b585b25f48e325da6866919c2d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7bab092303eec0346984a8d8695ee4000e7472f765bd3d9ad387a3e6e4e66fe1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3a08883a01ef41b99f0b7801b6fdea247c045dc2ae8b114012fd908247dfa0ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 09d607bb40260094d5d0208c0da556a40779104574d24869d4c8b6e16a4fbc90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 303c9e59726eb66129496b85c35b58ee6980496f33a81a72524c89b1fca48fa6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 923c495c2d17ab4f3eff77a5af98668e2cfaaba772f89da7f38490f5646f2ff9
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Users\Admin\AppData\Local\Temp\server.exe
            • Size 277KB
            • SHA256 83f54f9004bcf85d7d829a775214ea5e0d2c755cb16641926ffa1d613efb605c
            • MD5 SHA1 SHA512 SSDEEP

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            memory/2556-148-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/4252-117-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4252-57-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4252-23-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/4252-123-0x0000000000400000-0x0000000000458000-memory.dmp

            memory/4252-54-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/4640-0-0x00000000754F2000-0x00000000754F3000-memory.dmp

            memory/4640-2-0x00000000754F0000-0x0000000075AA1000-memory.dmp

            memory/4640-149-0x00000000754F0000-0x0000000075AA1000-memory.dmp

            memory/4640-64-0x00000000754F0000-0x0000000075AA1000-memory.dmp

            memory/4640-1-0x00000000754F0000-0x0000000075AA1000-memory.dmp

            memory/4640-61-0x00000000754F2000-0x00000000754F3000-memory.dmp

            memory/4872-58-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/4872-120-0x0000000003DF0000-0x0000000003DF1000-memory.dmp

            memory/4872-59-0x00000000005C0000-0x00000000005C1000-memory.dmp

            memory/5056-46-0x0000000002B40000-0x0000000002B41000-memory.dmp

            memory/5056-49-0x0000000002210000-0x0000000002211000-memory.dmp

            memory/5056-34-0x0000000002130000-0x0000000002131000-memory.dmp

            memory/5056-48-0x0000000002B50000-0x0000000002B51000-memory.dmp

            memory/5056-152-0x0000000002190000-0x00000000021EB000-memory.dmp

            memory/5056-47-0x0000000002B20000-0x0000000002B21000-memory.dmp

            memory/5056-35-0x00000000038E0000-0x00000000038E2000-memory.dmp

            memory/5056-44-0x0000000002B30000-0x0000000002B31000-memory.dmp

            memory/5056-43-0x0000000002B00000-0x0000000002B01000-memory.dmp

            memory/5056-42-0x0000000002B60000-0x0000000002B61000-memory.dmp

            memory/5056-41-0x0000000002220000-0x0000000002221000-memory.dmp

            memory/5056-40-0x0000000002200000-0x0000000002201000-memory.dmp

            memory/5056-151-0x0000000000400000-0x0000000000454000-memory.dmp

            memory/5056-33-0x00000000038F0000-0x00000000038F1000-memory.dmp

            memory/5056-39-0x0000000002A90000-0x0000000002A91000-memory.dmp

            memory/5056-24-0x0000000002190000-0x00000000021EB000-memory.dmp

            memory/5056-25-0x0000000002160000-0x0000000002161000-memory.dmp

            memory/5056-26-0x0000000002140000-0x0000000002141000-memory.dmp

            memory/5056-27-0x0000000000570000-0x0000000000571000-memory.dmp

            memory/5056-28-0x0000000002110000-0x0000000002111000-memory.dmp

            memory/5056-29-0x0000000002120000-0x0000000002121000-memory.dmp

            memory/5056-30-0x0000000002100000-0x0000000002101000-memory.dmp

            memory/5056-31-0x00000000038F0000-0x00000000038F1000-memory.dmp

            memory/5056-32-0x0000000002170000-0x0000000002171000-memory.dmp

            memory/5056-38-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

            memory/5056-14-0x0000000000400000-0x0000000000454000-memory.dmp

            memory/5056-37-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

            memory/5056-36-0x0000000002AE0000-0x0000000002AE1000-memory.dmp