Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/08/2024, 06:33

General

  • Target
    b6aced2b5b4c6f768bcec968884c8eee_JaffaCakes118.exe
  • Size 396KB
  • Sample240822-ha8f3stakc
  • SHA256 62304f2e249ecf8cd82dbf9e4d73905aa1ffee276b5f7f868f02c14c1f8ed730
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • birlesiksuclar.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6aced2b5b4c6f768bcec968884c8eee_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\b6aced2b5b4c6f768bcec968884c8eee_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Users\Admin\AppData\Local\Temp\b6aced2b5b4c6f768bcec968884c8eee_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\b6aced2b5b4c6f768bcec968884c8eee_JaffaCakes118.exe"
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1492
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:64
        • C:\Users\Admin\AppData\Local\Temp\b6aced2b5b4c6f768bcec968884c8eee_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\b6aced2b5b4c6f768bcec968884c8eee_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:4880
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2876
            • C:\dir\install\install\server.exe
              "C:\dir\install\install\server.exe"
              5⤵
              • Executes dropped EXE
              PID:4728
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 532
                6⤵
                • Program crash
                PID:4660
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4728 -ip 4728
      1⤵
        PID:4964
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4076,i,12198811467968044966,17227406646827438786,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
        1⤵
          PID:4668

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 a9fe8a15502f3446161abe7e4f4db56fd13d5639c45e5ec860c1990ba564de85
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 f85c4f9c679ac485dedc80eb30952df8256a2ff06146b09ef0ff6b3d5207c775
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f074436e073907a32c6d58bfad453031097189ed7f8477f2252b601ce280ca94
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6bdf54d50bc69ae8aed8f8776ab24159b025258c0571bb6702a9bea50d714287
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f1af712df2089a2fe86a6972a325b9e9a0680bf059d92cac8d8187450179751
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 62c33a1c67238bb37eebf38cd2412a96bdf8fe4a97fa6052de30d6d6f9f30a9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a07c65c4b856d7059eab7ee37a23d24ef6969e470c7d37d2db1237898a330e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1f9a23048da8c9dd3738055aedbf9b814255ed34453e90b4fff3a235ba96b34
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d32d83cb6f2b4f8ab6be3b059e521d434bf5c6bda6e9a7bc9334d55b0caf615
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8d340b6f54e61ad489426e14d3044b8ce874ddfb52a4c1f3eb732d0a4d754e72
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 65936907feedb15c6eb0820dfc09e3c4e6f97bb9ea9ed1399b47f20d7ec92004
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4985d9915d4c70724019a464ed2ac70db018172cf20277b0a6a3a33bc102595e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7da488aa08da6c2c612e36806f4f88a78047f52d52fdb755bba3396f0acac6bb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ffa8a4704915e5fddd52c8302ba1d9798f82548d904d5ce140aaa44c80fb77da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5f528f679ad3199e93f4bc34a0c3ccda41310b8e1ab5710b93079801f4eb1896
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 834d2876d645d4dd84dc9cbce7a169012118327d1f56a888f5f533e04486a872
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 63f1a6ca46483c8f7eaa48cd67c0d5855f4f6f246a6728f180e8b4df96269bba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 95aaeadbe3ff7892a24f7aaf6da87e6101fe826422074a49844c6682d125441b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3e22f57b02bcad354a06d189ab0d5d87ec3490dc66bfc2d7e1caa4d4fdbcce1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 817d743071b7b9d1b20938808a43e0bdd5e0f2b59087664315ad506039588e6d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 570283f85ee013ffce3eb6437684b08b61a6e59fb0eeab24571c33c861aaff7e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eca1f8f57b207c5d8717478491f6de1d7421df6e690c7786a5f5c1bfb14282e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66efd0cffd1ee874e63e144f3a42f40e7c8029c70b7ed3a67d29e58b2a28fe6d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af29646803ecdea6c0c06b669c19122a90d5c37cdbf0adae155099ae31fcfae9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 858802c01ce3ef77d273698d3ef28552ffad6fb078d21b3169d32203b8399258
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bb19e80071a226ba2b790e6e7ccbb37a445f04a2e36931da4ef5b3538646d9b0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5613459f1af4b90ac4bda4f95f92ea53064ae450ff387ca036cccb1f01fc2b05
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 66024390b8010e1888444e92d214209e58747e0d5ae3991803b1fb6d89698bac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a806902cc5943b9223ca312a76a030b8cbda93921d9fc3607bf95062ee543ad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f3c524d4edd6f571530fdff16c6168306356a7a6d32246a74eca0299e9adedf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cb32c9373e35d46ed7f3451ec0f81207a8567a49a4dba2fd3c99888ed6111030
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3fb35de9ed8a2087e685e156fd710993ec582532c10e8954c75773de5e998fad
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0655ff0e4ea40072e9085a950ef08e9777fe9fac11492a4cda15d4f5cac18b5f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a11c76ea37892a5ef78131bd2fc3b2269d744593794d37c632c5d582528a423c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 329b7fd6498a060fac23ac419f2863643701df395cc0e170686ba35e96bcf190
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a8c5d3dd789afdbaa6f2c0a476060d03e44825d685cfddf540e3bf90c7ce6c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 948d7d94602a679637b0862b76708cfc8c27e2d615061667d448ebfd735d024a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f3584ff6610b23e150df4c6a4b0c51dfb1c1c106636aebf4b66ffe64eac7339b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ae1c25bac3ec15134b68e2b01fc06d75dd97febebad45eecdab2af13a43e1ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3dd46db1c4e251e57d19a0943955811ef6ce893a15360b970cdf83efb542ebb3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e872594850a01840c9ba035b0e020da05dc97e0aa7020a54b7f7eb619d71bc4b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 961e211c56c6c26acbf22840d3e68faa9da5ea08d87aec01479fd1f961a1069f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 327c70b6a9f1da1eadaa4c303334e1195b9c887eb24d7e554855cd3e98ea67c3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 46ea2337cb533a633646859207b786b9de26174ab25560875fc370b5585ffd68
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 39ca8540d40c9c3b6749215b652757d50c81805e6a663c6563e04a6875ed9c5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a96569b21c1fa05acd89cb5d98b3c791a38dbd633fca0683a3c03d927f1167ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cfeef38c8952dbec919eaea436832ae9af039aba2fd65d37b7b154555b7e84cb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1982e1698fed43bf691993a5ad3448420464036a2ab76db386fea0ac8646b766
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e225b94f4a28bbb65a8ea5a483ce50608d96c1d6674c7575c613fd2cfa72f5ff
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 765bb3e0d00f6193e95df8a50e5935dc91e90ef7a5c70dfcdc5d4be16b1bf8d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11d4d605cab8f8d4f89d5215b242c03c5e7d3b4e1ac65264a55daab98c76a309
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9ba3b2fc15e64b56499753bdb69ba8c39097eb51f8f4cb54d35d1c6f136988a6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f1a63398d4d501bf8e7b69018aa63a6ef648d9c60b5f150cdc9ba6f7f924bcbf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6115dd921d1f7fc0c57dc0195bd3f2c191b1ee50bccbb98d2f11c0fdf3379054
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 59cef0da4c8d60baf35a2881c7041e0a236b2f3a5f14ea33d69c82d4d4ddd61a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c50dddea8de428c75123baeff53af94cb0bd88023191d84ecfcaaeb0914838a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8726742bd3f1938e17cf3633ac099fdc68bab357fd651461168bfa6e80727176
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f518977b8bcca42a4f5b9f5a920080914e3cc21b33e521d69981dd6f8101720f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 758e4c0729eb8216a7057da607cc4d981cb25988719fa83402f02b45cc6745ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 53775b15b2f1f2f78058913bad7b59a00b4740c3ad3350d61f685e63f8656dfe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f8fadfd97112c4c62246353e4c55b742a0a0bd13bb07b75db2d1ba2863683c23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c47113d552a10342b42f100efdd30d0639015ab17841a21450de9d61ee39271d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a23b66b163da9b60e3a704e59c76d8d660473f4965d9667350c94c139f9291fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8500c3eaca41e9b9246d6a34e661829ba7f0adefb96b11b2624f7c63faedf063
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f64b8d1f20e9c5db393e0f68fa6d2a2291e7d37eaeb8cbc2d3ec0cb3d998a17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85c7c9b1ba35022beb458c2d46ce54b8ca87bd2a7bf3333dda25639a0da9221a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d58d83e0a21a9a7a7ecf7a67cc0c760fa59642543e0baf982ef3be0b292c26b3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 85c4c054aa4f159a91560e0eb4a4c640bad9a5eb7086105d033e9763f5471cdd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 038afb68fe01da925cfa1a7ef57a4d5d5f8b5f704770189d34f5b4d85a99f449
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4febf7dc9611671b5e2476262e473285234f8b7b42d57734f705397b2e9d0842
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e524c48390eab566ff1b7da87941834bc9838c0f1c2a367710019f355fae65d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8e764b078608b3daf42c0f90589f95ebd9003c2b29c1929b6cfd2678ba121203
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0d10d77f9b2d4b47663ab87023f84109bea0737022ae27e7f50576c929fc1ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 88e89e5ee0a5cd3d62c13b0ce81d35f1275c509f8252689f7ecdbfc4fccd3eee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3eb2315d66c7b17fdaf102b2ae561f43d4e37749756c28d137d080c60cec904f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bba77f748b9da1a9544b9efa77bcb44cf22b8e93af366f33dac1c0db26a71fe8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eecd7eebf292af0908ffd8798db0d73412a074113473404ac41a27e701416687
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 78f5fad93d2dffd262db8ecb7bc4de6bf99d8e4dafbea50a883c2ea9442ba116
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11d4317742e3bf91cb6f75227bb82502304832abe27f47edc670f4279ba15a4e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9e9066c0b300cd6cf6de5558420abdd266c049dd1a94d7d6d5ac9e20652b1dcf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c6b11f07484b2f65729cf87b604359cbb4633620ce79e004ecfa6331a9e92c8a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e3499e624d98bdbfb833cde222830b557062eb58e59ad7387129a9ec03e940a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc828a005ca096311f104d3a630aa93b9c4aeeb30f04415d08e64dd54a7095e6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1775346d3c9417610e5dc02a606f31e2e28aaa0b01e38039df4d9fb14e7da5e8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6a882740f6101ece41bbe8d7e657b9bebf6137babf20431dc31b3434226833fc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 76289eead4d0b4af7a712c72a7cde3022fed9a1724d9b8c26b0e2d2d86001cba
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 648a0d404dfb6c79a43201821eccd45c1a1dacc9d13194dc6958cc56cca3f234
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5ae2b46d70c553c74b7b9e170ce447f25b6faad7146232901a52b779bccb63e3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1f5b7e16438aacf2a9e66a2476dad4f2b5e5bfa63dfed2f7fbf6eb58abfa21e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cbba09dc91d55601268c011b6ed740a9af5467d9b025b9bba77b8ee90ce3545f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0d8d7714359483bc3c443c7741f1a99eb0cfe8d86c370cd8f0c7c1909c144ed6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 efb11811b93fa1fc9de6f408bb449bee29d566dcd8ff2ae70cf81a81de97d092
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1630e45fae6fc3eeb2785e72fe7b5975b6123c86117afc005fa16bcec1970b35
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 017a323dee2bbfad611b4ab37b09cea0fe11a13199e814ee0bac50ddb6c094aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6bda22ef90af6ff9023f68d18c5f78418c5f3a5a50c3b6c3672f945d18593288
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ab0f630821b34d25b0b8e0dad4101d52b82e83bcc8f69d8d911ad7edb5dce1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab0f013891c8fd24856cd8835094c749850981c7bc8b9c1b27f6904440541764
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aee3d5a8492a44f80058aac97b0ac309dd8312bcf9b77d277822a01acd266c10
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 769af15a407ca59c7d8fe371c419cf9dddcfee8507a7178212a47f5f8bf318fa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 67fe12ddfd78c33081f23122463ca942197390ee48760fccf2b279c9c788f0da
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c545d4e1342fff4e06b9f70496747fff05576a98d706e7d501bc195b10a19c26
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4d99f3111d1c60a4fb524f50d3e2e0f66cd6a68b51b3ec3081dd9d9fa8c2d307
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea3983609ba9dea38bacfc76a86a4123429ea2a741d62b0b2b4cb5ffe76e40a8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c5146974e1138d88500df68bbd714ca13378892d3a62e310c7cdab71da70620f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 12a8457e0f02fd64ce1d695d65dbac5df55f0abe69afef38e9b03c596f6a1bb6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c84d451c922596f35ace93e834b106d036cfec4627700836080eed7dd16cba94
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 822fafd072a3fbe6451e58c0c2fef319a994c898dbd5997d5f226c4ca81b8908
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9d98bd9d2b9a1960ce2a930db6241c3ea611f120b5660c2150a069bb6f692454
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 42d453df089ec02aedd79ff8f7baf69aa2cb31bea62d16745cc71b1393841c73
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 71024634b58d69593725a41c7639ae592b37cbb0a7da61f6b9ed2e21cf629c3e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ba1d974a5421b8cdac39461ed5247a625a0416f881c35a194cdf4e12c08c6aa
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0fad768f0eb133f7ee5713de321827d056b2e85ec87c9f971cbc9e64c03ec219
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b400b5b439a4fbc84e71788c9074ff6ddbcafb801136c2956072d1df2d1b47ea
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9fbb63def9755f17c04705f2a24bc91312a656cf4bc01582298b2741c34285a4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 28974efdcfcb374c721e061dcf2cbc7af38acdec3ff35bb8af2029ecb48b2981
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 93ca7b6318edfbf1b27332114c853e9d4d9886b4e42a9cb5c03504f85ea5db9f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9f7b6608ad3e67cc4f241cf6898fee2568ffb97dab8ee20cfca96d7cd86892e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dc4c7830b09fec099515af2cfc8b3678a4c4829d2321da7270f8c1d99c58568e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 16a1eb997905c347281acd6b2811efa31f19a14a46ca475a860b21b29e0dd9b8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0ad51dc0b219b5c6642bdd153c9ebd1838f4dd02a7301d03e3b79be0fb1aa500
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1315fab8a9ceadb3f29fbedbbc15a024129e845e47e7b3a99bf3c24f20c79b88
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 819512ade1e5fe00ed5e078e61f4e98897b27d4f9b1c6249f42018dd9660c426
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0e4f464487b6749902130c9e12b63b095899b5bce944f513c23bd45d3b660388
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 817f9d57e001797ec662664a9ba9c9078cd87e4e86e4540fafa71d67f5e123a7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c66616f3a8ff753f755b3bd75cec609b86dfd0592fe3fd15d1e36ef3d810b57
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7bea1285b40390d98ad302f6f6854a41c7571ff68ba5de05e78cbdf0bd43f1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b3e5ba27f2a3253b48120d8e1e0bd8673d4934ea7fa4245696724f3282d81d22
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4e5951dae31c6ff744beb25361021d4c33bb1d3b388d266ee877dbd9a68734ce
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4746bae1df588f86b72d0a79ba9f8b9e61823a8c0e5da0cdbc9af0b43965e7f6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4f7f74124d4aaff1f31acdbf4a0981accec5043a30ed38576c39c9dce7c918fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1aba4b9fe74a4460f8ba35dcffa70ae4a2e271e663731833b9794b7d9c5529f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e80178448dd146e72a6cb36f597608ae3aab1ddee109dc75c26733153c50fccc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 14865a6f1f229c5c460f0dfc459bf694e1fde04672e24a43a0fd44685b586570
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6082da3287ef7691d5bd27dafc116619d8b68c09220291a546c48aff43820ed7
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cf23876fe2b3cf49e3869f3df0079746804e8cd5286e70f6102dfe60f182296e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6043f9568008b39bf293fa8ab84e05e1f430462678d3a43b3971c0c90c7e5b3b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2789d6e7c85866e68d9ca50dce0de1aee7b4417c2c08442e4732138e45dff276
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 960f39959f702aed5615d224ca1108e6e74d0b124a27966d0bb2db0be0ac7be8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c393bc4563b6f7cc07475c77574dee42e5d4c5468438bec542e54ec9ddfc2c9e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5c8201d725bbc53721fb959edbe7e84b2139c6abfdcb14bb356b51e9415e6889
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 df0474f5d396096d96be798bc37f27aab23bcbc62114c1ff64e228536057e781
              • MD5 SHA1 SHA512

              699c4b9cdebca7aaea5193cae8a50098_76278eb0-9988-43b4-9423-af5897ebbcb4

              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2170637797-568393320-3232933035-1000\699c4b9cdebca7aaea5193cae8a50098_76278eb0-9988-43b4-9423-af5897ebbcb4
              • Size 50B
              • SHA256 4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\dir\install\install\server.exe
              • Size 396KB
              • SHA256 62304f2e249ecf8cd82dbf9e4d73905aa1ffee276b5f7f868f02c14c1f8ed730
              • MD5 SHA1 SHA512 SSDEEP

              memory/1492-14-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1492-11-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1492-3-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1492-80-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1492-32-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1492-7-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1492-5-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1492-10-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1492-6-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4728-115-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4728-112-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/4880-15-0x00000000001E0000-0x00000000001E1000-memory.dmp

              memory/4880-16-0x0000000000580000-0x0000000000581000-memory.dmp

              memory/4880-18-0x0000000000400000-0x000000000041FA0C-memory.dmp