Analysis

  • max time kernel
    150s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/08/2024, 03:35

General

  • Target
    b6322d524d2764a5b24e811a40b9258b_JaffaCakes118.exe
  • Size 398KB
  • Sample240822-d5qsaswglb
  • SHA256 ce93373a4fefd01dd39c86069e1dd1a1796d3d174827b16232b856579df0fe2c
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Beta 02

Botnet
  • vítima

C2
  • 127.0.0.1:288

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6322d524d2764a5b24e811a40b9258b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b6322d524d2764a5b24e811a40b9258b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Users\Admin\AppData\Local\Temp\b6322d524d2764a5b24e811a40b9258b_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\b6322d524d2764a5b24e811a40b9258b_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:636
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:3628
        • C:\Users\Admin\AppData\Local\Temp\b6322d524d2764a5b24e811a40b9258b_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\b6322d524d2764a5b24e811a40b9258b_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:4580
          • C:\Windows\SysWOW64\install\server.exe
            "C:\Windows\system32\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:4164
            • C:\Windows\SysWOW64\install\server.exe
              C:\Windows\SysWOW64\install\server.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:368
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 368 -s 564
                6⤵
                • Program crash
                PID:4732
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 368 -ip 368
      1⤵
        PID:5088

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 196fab67149adc176d0459aa17b11e5a4b7e205562713f8ca8e33a07f6610e8b
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 230KB
            • SHA256 9660e9ed542abc86e34377e9824fe60477f1db73aff39e7228bafe9f9ea677e8
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 944443baebe2ecceffabba591f09c6101ad3a31fedef95947f1a5f96d578be2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64aac8490919934078df20df8cddd2e111baabc23a952c0b2e13560f11ef3554
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d198a7d93ba757a5cb13a74593bc44a0785d51d280a8b4c68f3ecda7f5c485a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b73d50e968b2036d4b5a9385b0b5236458f1c62d3081e6c9ef7d8cc20c7eb87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58f9298e7b898237583e2f0a4c017c8e54dcb901f4c7922c421ea08d2fb62b51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6872df513534d894f108c1497601d16add08f2fc355714a2bfe05f052c4d8e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c8975c4049d698fbe0727a75e4137f7ac2b0b8fbf272bf72fd601750a34d16e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ed32d3337ac5a885df7bfce1f907ff705346c1b3e7df60da47f122abc2a3ae3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a534fd8b24702bec3608e7c0fd797e788907f323ef1c14ec2de86aede44426d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5fb9e6d5f49dc22295dd79b20e433a1f4eba5712faed34f2b165e26d9606aea1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6caef72888ac8df081b790f68c83b5c7d27ecce7d756d56f90da57bc83979e0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a431ae5fa6c274f564cb392dd778ee9b161dfeabaab3f20f67828fc179c9b0e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7d9bd5b16d9ec217ab030288abbd57f4438f143c1aef5fdd52811298ea20e2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a44b9e90b9dd786f35aaf68fe6fa36de38703993ed0bdd31631c672ea6aa3c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0f391d263964800b1b5e9a080c5ff67d641cdb5683f8c0e466419db69b8eb64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a61bbbbe7cfd3255e98319914f778dfdebbcda0db6870743dc478de210b57133
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 517511194366e77d260be94539a49c47de9a1fe534398ed0272e6ee7dfeeb2ef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4edc7a9acff4b144b474c3ac28d9ec09c4d89581d3bf2e4f5c4d921fd8372f18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f79ba8d8837dc52fe79440dd59243dff3c2214fdcb00d158942a192e78ac0f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb65a6416f0c5014b4a34a89fc9775bb7fcf3bd56f95d9f9601b587542b99577
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0cbd5569bcd50ce4c20d43a390cd60d76aee940b0269b15d5cc46967ce1fe3f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c336112389fff63bb297430328cce185469a67e5067b28bd8d62ce6dbf890100
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b37345b3cec6e9195bc8ca324b4501e96879f04e9e6433eecded57ce92f88a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35846e5a6dcf35e76b4c4a30607b38e49f3bef7335bc52d674074fe518452077
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5921c3a3364d3c97215c1171f667cead4227df880651df12b05426f947291de5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f457daad404b6454f22ee4cfe692210c0b279ddf04c4f35748e6cd856c37e58a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9c1f1a781af97a99fc0d23c389190edf7be7b1590746d40b3ffd664e496cdce0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d0aa4d2ee4a20955b39fe6ceaf45fdf46a8a5775024414c729ce8006f9755a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 17e9630f575b29e1d11cdcefca8e35ca2821d7ab89ff8e0567b3e75ab9c2d6e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2edba8d8f543deecd57435a25240e0de68a11bc4cc876b8db78a5c233e0078ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c43e5e338d616bd9035ee8258f8526616019920d029852015f3f0497cbc15c79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b3cda763dd98764f2aa51bdf682039047c4efc610c9ccc2494895a968ca235e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 48d1455cde146f0f4545a39cacfd68b3b2294be4dbdb605e0fb3680a3ff66991
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5feaa5732682971205340c7f220b41093bef95a6e741488f930dc388b12a4c31
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d24cd2808e406471060209d24fbe3f812d0c9f5fe35a748b86469823275cb3a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa539349fc176629abe05981f6586462702c59fb339dfada77a55986cf29bd15
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3e6133a27d0db9ca7733a8a537adf7fb6956daa3de996132ecf6da56359b74b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae8f09b11694baa606475bc78b02d14f747038eaea2a71bca281ae97d9d54350
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 18134e0d3f7265da9c787a624c187fe3591160bd385a70df7b955d82ba25233c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6d0db6c142b84c25873ea06993285db302a96efe7ec4bd9f8ed8a6329a9821c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 756de1b4b28161eb37e0c44507fb534d252c901946072ad7cd96931c325e88ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5aafc27dfbf096742f296b186af53f900f05418e6ecc2d850bd144ce29912c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91c41637404c7f1da698f3404e4acd845b80fa7a74bdb86157995fa4dd5651f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73f78162d09728389f10958f6f84b2852dfaa71e49c16bb3b2effa56a68a7d49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 089c81451c9bc210a393609174e63b2081f134d9e09273c55ab5047652a26d5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fb557feefd8fb3e65b52555a10f4e380d29feb6e245a261f3f0d0c715d233c1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a2d41ea9f1ac21a37e658bab5e683cf92772b97a1fe4e5307d577c6232a4e7f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b5810fe83c7c4ef5c9bdce5cbfd43f418a7f220e3251c7c8a803ad82b6a09df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62ca734b99ee6f12bc7a1ee1ffe4df917b5ceedb92b4567704c8463d38b6255f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca7c8776d907b51ad18b7b3b178d962d5350c2326857f2bdf3a1eea12b030316
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f395c81ee7594e0eeb45ead2c3a5485d88bfc18e7375d54a6a7fe929582ca450
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 097aeb798c041e4195bcb8be38c1886274a7737f37ab6862098e568e6a64a835
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ead02726b792ce4dd7713915f44921321cb6bd02674a722ad77413ce797fa2ff
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d5409beaada3d3ef3f487c472651905fbbf2d98c3a679d1360d27c44fba2b2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e138c140753bf9c1c4f8270d7c68780b3075f651b1731ff2d22b25afb00dd09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ec1942c8e912263843f843f5e9435834cdc5e960993c0f2bc87c963ac04ebc8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 375ed24cda2caf1fa3acdd092af9c63b6293dd135a9548b2529b18c832606aed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ed8137284040ab9828596207e5863d23d6bc4db13dcfd324bd182e3863a448d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c9fccfbbcf75e4ab24bfeffed27d36c8472fa69d6524b56c72d3025efab643c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce3ab08358602f7063d0b40beb714f49d67ae1a1e3ab1cef3864bbfe7e6581c1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 66e77ab8bb6c3cd143431930c12d090e9c83adc6c726fa48808ef368f31a151d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39c31f9bc399c218a7da8d325f4aee9cd1c08ede51d1b2c3171b3d4a1120fbe9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e34ab84a408fa52ff24a870bc4fbc97f2d8779ead6ca222d52500c174175e78
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ccdb6ec12a9e43e0f19df105a92c597592af1002ef022cfea96a3fa0c85755f8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1099b831a566959f7b8b6eb51812e5436ab14572bc2b4ab7553e851f44f5a2b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fd77865042d72c780481c87c0c4e4c81cc44bf576c40c2170b5a6d14e9870a5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96f6dfe4d61e74e00d10eb65f2e2bd5e7789399c9ebe67ddaecf259323dbd7de
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d8b537624d7524a826170318647e77e05ca4d1fd35febbb43f06437964f8638
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c9d07e071b939ae2b430cd521fd933940a7da077d4a128357856dbde2821dcda
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b522b5255543d9451fb1201795aee1823d0bbfd95b388d495e802df635da3ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5bd557cadecde6994862d0e3055ee23eb05a1dc75198511a98b06e15dd3a2115
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3c314a131bb1a391644964873a473ba280eacec848492f34c197ed1f7d954de4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3856b31c18a00d81e629004f240a57bd084bbb42d176048771ed335efe067fe2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f22e1f64146524f0dd78897606a6df3d3a9e24105ae06f3808b220354bec4596
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8111ca5b957a93b446b5ea56ee36cd704a31180cb3bf00a6520e0f53ca1e5de7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4bfc794d7f8c469323dbba9af3d717a767fc26db42d4c1cdfa7aed25efe4fd2a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6219c23762620a2c194bbc83bbac0e06d03cd4ab5071d658fa25a2c9a814ef6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2d389b2e171431fb015488be903f7fa8e4d29f586b6f45a3114d270666198821
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ec9142c3372064d3dbc75c2437fa94398b21bee8c9ffd2f0b4283ec74747d1a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f5cf430f65c35602a2c6b4f60432f1d330e9ea8cbda4168536c60931ad356aa9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86f7d07ceeabe3716b437c3db356355b8def362df50746494a91d8ec1784fb2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d3bad8edebc2971ee8c2e5f3bb55d2c7a143ad5893bc6335a57aec3965315816
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fbe26c7580237baf9e6bc15bdd35cbd8b1b07dd8fd19b2ad8223edd29fa7799d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b6f05d3f9cdc22379218b02ac0ec66d3454f3e475f4d0ed89dd30101247e5ced
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25a7c4b14d35371706bedbe34a0bb20569ffb76b26d529c1a781e20fa8ebb4a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06dd27b243252d2c4e16d945fc5d83ceacb11a39e92026a67ae3ed27613d300e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7ed3102791e7370f0dae29de398178024b19607840b976dc2e0b70ce2d1d6b73
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 970440231978bad3bb404e86f970d5296b7a955706f65d05bde7748e6a61b513
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f1e3c686a479b9629e40b3f978ce0bbdccc50f329b6175f514a99c75ab727df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eaa344d5c279130371a3f423b044b7ea8f5bf2f0ec6cd3cbe24cb709ca1df6e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e155290043088d1600c3864dc1b200dcc6da82d2e0214dafc712a05fd0c141da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 516a797041a64f01caab36660f57c237480b77f3baabbfe07b08ad5f50e8a4ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a6b1f5e119f07f9be474b742697fab86f264fa57cc574dc415cda158f254978
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 321d0452bb7450244abc37a4ce1610078f93ef1b8777478f9ac43fe7d949aaeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 709204024e50b3d1b4f711c606f32f895ef57705a4d29240654472ca2712cb06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97349e520463a807ade2351b3394e6c44149666c6b36da41e401d3f2a92d0d43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b5fe6644f42b87aff4c35bd046f8a88e3344f42affa3616ed12b528e7bbec00
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1f7d0017fc9712bd17a42399d4d5a3df5e0b96c8d953e82971bbba849a823a8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f1e126233718da100d55c22c9624d917fa882c84f2fd9152b1a19388bd7e5931
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b14b80df626b609fc38b2d43b3bc6e7a8276a0f8532a45069ca9699212b5e9c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 81f00ad9bd982bc2862ce69a68c99459bd3325a00034bf4035221f48abfa12f3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51addb596f91c43e97c0f4974bea062dbe3299ea322eee1d6ff1aa5810e7c792
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 58bfe3f2e22f005ffadcca175b753396d1e692fef306b5736e60a113ba14139f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97d3e93a6f01701bc63c58524f639131dc3ea7c6ef5a327a16d0b003c18e084e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce4dd63e496dacd3dcd1f12f6ae0989f56153f297f18fc36d04f6c2417e8590c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1adb550da711c7b792309063d35534d2cb2e053d575bbd94687b75a010b8032e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce20525f3969484bfec5eef87f5fb3971d3d8f67ae32269f832aedd8d63ac3bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb516f494a0a122b641ab8962b2ba000095ba285c361b9d16ce4f174e778ef79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 04f10bc62ecf4b8867eba612e6345b73e9b9d5855f3ce5f47dcd745dd5440efd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4b60537fcc7a7533d973a2bf5308bfe382d5c55af9886a349ad85d20aa8deae4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33b4c733ff536443ce55e3affbee9db771c3e0906a8c421d022d620b2ad4e352
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f373cf00c2f8905f267e0e2554a50f13c837d3be4085e96d7d5d5ccffb9eab0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5e2f96360aa506ae1e4fb0b3a3a7176ea2c13e7f008610df8125625546adb03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 417dd969dae5089f552bce251b3fde1c04f829d3854f4cc5a38f3d9bc2512367
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24bb696216fced971cb85fc4fbf883f93b7fa480f8a0ef019d59a102c0ff3092
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4cf90130cd0cf1862fbc78596d2ce04bd7f6cadcb818519c82a151c14c20bdfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8b7cf85fe1f6e3ef99f528545814189f8a999121aaa206b4a488c18d2ac10126
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c539266bbdead3c7d8ec7d779c55eb4b62cab6da77868c1e11ad43341cc2dcef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 87a8e2fe58da07140075f4e967e04c28fc71e3448517dbf1ba31bcfcd636bd28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4da9dd93e02a67a61c3756625e23d96b81846149e9ad211a93c1e43328519046
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38d71191902c66902eb69077529b5f1a6ccf173151ef3d27c476d366bbad3970
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e6b54d8f26369d4a07188808c4e9d029533e5cf27ff3dc546019ff4acfc9e280
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3226a4123c38c1ca8d1aa2549ac74d5592bc99dd955e0302dc962239b6f555ed
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3830da5b91bda76e1f7b5239f85211e6ab519767c0f971a65c97856d882b0325
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 39dc610b348a17840a9df49c44676a4c9993101149b267ca0f3d68406e520801
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 51293c2b9d218202632a070046e9d225db8dff91c57e7b6c0369fc27f4cd14e2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2ccd9604eb30eb2035048bc171af7d632271791463bcb9dcb4bb4991ccb06fd9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 504b7d071c51a7d22d8745f542d743586da65ba5a8a0550c9ba00c9199ad013c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d792bf690e7cd74dae274728c047865cfb88730fb342f992bd25bf725fdcc2b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 56fe97994301d6a4a71a8f38fbaffd78d4c0147cdb292db1f7cec04318677b5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 751cd745b9d49f094871dc7fc2d917b33a4d33b3e068fbcfb65dd0994ccf047a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b8e2b814a8386c700b9143ca8223c22f6fe04ad08acdfa0e6433e30d665bfa8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ba6ff9f5e802c61cc5a6c0c447589f225fc5d4efe37555bb7fcbd94efb140f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0641c781ed3e3eab2beb2fbfd87b309884b0f93929c1c356c8e59dfee0821a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33096b6ce88443acfa572229797eea95e38a52cad04765422eb5b1496f376aa6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 603b48bd9ee8d27b9b021a09da5c67b0923d316a26f00d09b8374e64dfa4c112
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fd679937a4ad579b79c782038c5c708532e458d62367f75c369ecd8b8fe8f52
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 06985068e01fe975fd7a99c84193086fa7b5507483b46c490fcff1182b4c2faf
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 398KB
            • SHA256 ce93373a4fefd01dd39c86069e1dd1a1796d3d174827b16232b856579df0fe2c
            • MD5 SHA1 SHA512 SSDEEP

            memory/636-5-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/636-11-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/636-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/636-18-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/636-6-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/636-1-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/636-0-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/636-14-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/636-7-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/636-9-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/1044-10-0x0000000000400000-0x000000000046B000-memory.dmp

            memory/4580-19-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/4580-124-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/4580-20-0x00000000005D0000-0x00000000005D1000-memory.dmp

            memory/4580-82-0x0000000024080000-0x00000000240E2000-memory.dmp