Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 07:08

General

  • Target
    bac67722b0b3b996f2fa92f026cfa223_JaffaCakes118.exe
  • Size 265KB
  • Sample240823-hycdjstbrp
  • SHA256 f4c3246245945bad830d8c736ad9a71273402d17cb1f4b49978360e20f011791
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • version 2.0

Botnet
  • vítima

C2
  • lkbira.zapto.org:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bac67722b0b3b996f2fa92f026cfa223_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bac67722b0b3b996f2fa92f026cfa223_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4848
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:456
      • C:\Users\Admin\AppData\Local\Temp\bac67722b0b3b996f2fa92f026cfa223_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\bac67722b0b3b996f2fa92f026cfa223_JaffaCakes118.exe"
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:3708
        • C:\dir\install\install\server.exe
          "C:\dir\install\install\server.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4908
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 564
            4⤵
            • Program crash
            PID:64
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4908 -ip 4908
      1⤵
        PID:2380

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 a0b8dbfa3f367e5f113d176384a20075e08514f87e118cb8adf12b4cc7682355
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 216KB
            • SHA256 aaa954b6ca6103e237fea9684b50ba46159736211ab8de12d1e44f535d7c47da
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a452565c8ca156221d032528951a2b82e23c092aef87b2be000e7e8b6bb2cb49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2b5cf0fab72aee52eaf790fa7e7063ff043794bf74c559c6446d8cfe241476a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc48c5b4d1393da5a6952ca795288ac83c0519c720aefd6ea35cc451464dc284
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b247b1ecd5348b3dc1f8cb54502df5632af5bdc1b86b580df7449bab9ed60ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7390eed7afdb55013dcd642e8719f392f987c6a90000451393fd402eda9151f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c70ddf7adf76f0287efe1c51287a86bc405f634ea0503534d44b228c6285321
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6a131b34ac453e33119d2c1f16dbac47e5c38d113a90907b9802ccc7f572ae0e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77df04f525b566c00bea3c5142f9835cde4fc7d2829661eb0205ce57193f30c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f01244f8b87b74ed275e91815f1366ce154cd515cdebcd497ce59300d69bfa80
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 852eddb2f602c9f81571bcc09c2a6f954ab7ff9df782b184a604e0bee660c5d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2bb6eb2a57bfbed3f54b1d1c3d2e9a037b27984260e97d291c8d59dcfac2a417
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dc059ca029be2fef2d6b8d57e1df326b6472bfa81ae59b8e3d481e8c5d3084a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f526a253225e9c788253933320f9d492c57857d0b22a1401cb547d8439c4022
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1a7d80b25537ede7ddc0f91b544da5eec8d6dbfbc1f0642a6cbc91ab56fd900
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ca97c537b5d341095f5a9228ca0a245459bbc1fe35c22fbba374f7fe862b6f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e20c39a63d95890254d9d3360516d3c4e86fcdec513725f7ef3718f7f6fe7622
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1b65af1740ca29e85d134b708ed7f7a363faadb0318d984a9ad46462044b35e8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4e0504d6acc569a9dad3574c711ec2f1747b2899b843fdaea4a004e9970eaf16
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8281ec6454a967726e2f58fca6a74e8fcabdd0f6d33bdfd9482fd1f0d6c94c4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b9d1f30073f86f16bec0383370708fec106a62d9dfbfdf3d88d4a61fce3e639
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 34195d8e0f7c9a6b51bf9eb5a2e2407eb344dfbe7bb897997b454ca48a62b162
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3e8f107e9bed57e0c98f20514a5704e446090a405db77315a40c2552aa7d05e5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b22ff182778c29c3534a2099947d10a6f6cc096633f10bb6405765d9955bc34
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 893d98ba8fb3743415948af9a5f8e284fb6fd4860426246fef2c7b5bc1aa2370
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 53cb222fe8d98541cd9cddc722b1fe7d9f788dfdb1704b8031df457124bca285
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e22614aad7ee4fab5c76b8a5c597934c88dfe81476655ce1b07c7b631d113cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e0d429be5ace09639051865930f85ea14dbe85c8d93f5261113ab980854f737
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd79c904fe574e22fef8ac555f3ed1e1b968f9e4cf7043c8cd600eea728cd80a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a36f18c769e1026a6ad509b3f5a8d6c0c96601aa528e0ac781a87f210769e491
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3b6ca7593c851bb0af73e3bc10b121cd8a5fb43a7ca8416b36ec356474eb55c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bd7a0c583f019be8d6db5cb1ba2d362a5402d714b6ed3ac1530d919cb56a5465
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f96240dacf76fdca856198223fe1c4d38a3fef5f0da66d260e9536660b403577
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 769880534c6285c39447d89f0e304fbb4a1542e28f063793e5db617d7fdfd93a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7ff6c08f0ac477651088f0db7a53e2fe347943c8540edc514eeac3e3d291045
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0350d7db837c5adb57a61bb9b41958d375b9f9be4ccb43800da56dacced98f17
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad3c24776b1ab6117bcfa1b267a540d47ced7d9f57a8c87285d997d1e4db7ee8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a804e4770b9fe130a7e24bb22c0b3afe007769e004e012dceb8f4013c0a0013c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7cba75354972d839704fb11d0a1579bc07dd2b3130057bf4aca942d9321f791
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 68c7236f8a76963cf3abf0f138de9a242b5710982241c309520175cf280c98ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a6b8bca5451e565b10c0b09f923159a6c69b9274f3a59b52ade75620b0e597a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99985c4f338ffb8d271fec87f08d011bd8b402ed0a15b52447b2f57020d967f9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 444844a05e8fa126b1614b4a782591f3a1ad39311d160d0b3307abb23b903c07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 57e9c2e0ff8e51b40a9c49281758d00dddd9cd110acbf34956be163a0d7815bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2d8cfa4ddcd48d5fd1c0a83fe4148d5157af8cafe85e9f9038a75451d5719d0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f309cf708e752b08d292490d4d31410f909cea5f2bf8109c34f78ce6985f89d2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5a8a98840e6aff21f50697dd5d0159da074839b878d9964c322c4a7e5397632
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1154bcaae78006f54f3a341d298faf7c5bed4d61b208861a663cee41c4633b5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e1bd9fb0ac249642632d6b8323ffbd8d7c1e00e89fdd5bec5f67aa38fdf53692
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca19b1a7a1dfaa37e6e6ba10b740e5c4cc7d13a315a739129f7f1f7becbe4c35
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1183aa94568f21b9021e7c3d2f1517ed4401477d586b7a4e414690ce96d8f7f7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d399fe43a5a9e0a784db1467e9198ae3835927e955c9104b5b06b89bd9e0f47c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7efb8ca9d1589efe199b78221fd597d98e83ee9edbbf32d63c4cdd162ea2daba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fc343db7bc82a6692811255b39be22c2424250c41c6e7f1e0d0b59bde75b9ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa0aa37493605ba8208b2f81df45213f2aabd8bf576bc3d187e386cdcc4cc8e9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08d348e2674486711d68acd431df2eb9e9c98b4be70a0d306588c82fbefe6b5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a559de44529422abdaa92826196475be72da624641f9b14cb5ace41c4dd8d75
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b2a3a7090a046bd055f6ec2c36f0354fd914ad6682c2982895e4f348b1b2b72
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a4f58d9e99c5c3e421d568770664116f5733d35d939ed238a3da0c6e1304febb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30ece3f985d46691e8c8fd3dc79819b9b266af9a3a05e82c5ed99384b6373f01
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e2714d641055cebce71df7f35030dd9b6da450fa6d85a2d3cd026fa8d9f8c478
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 728fdb0d270629a4cebb317c6e8369f60b36d687e368be2058e48a181df15915
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9ebb49fb42404f479fde050d5574ce4fb7fc345324d9f54e2a332e8599d25cd8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e3614e2579dd1b5fbc132da3a36d5e93f1354cd0c5d9930c00d1ed9c1d5401fe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8f1676306db8f0e7303567bf6dadf465b6ed398759dbdba7b8c470b3fdfbedd2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d707f6b81379ec271f96c572aabaebee88b30e5b365b9022dda22cc6e34c93d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e987d90cf6ccc4aecce2e87c311dc66930537750d3c41810afdc86b634a8e37b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eabfee4f73f3c28a2881fec6e32d382a4dbed3f5269a7d505610afdf2b5d0dfb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55e6ccef7ad510dde470232195b99fd56f7b36ffd598b70e57f11c650b31ad07
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d1518f742da6a87c14860feb345f0bbef083f099eca2e03107528be2bd78f93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca2f37531a72c911ecc20effa9459c348dfa5f0d90263d4b9a44aa10ce5954af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7fa25067e2ec6e3ef3fd4dd232e59e28c6f1d706f46b99344bda4f56ff3780c2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c6f7c54ef36ef32629296f2cf04a1879def4f03f66c00e88a6673c154fd45385
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e105b2a081fd089cb6dba2265a9a1a37cf2ebde2b9298f58703667d972d883a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4aa0de796a66275f767fcd6d52fb3b55190d63e3da2d33ce9d8e1ec0deafcc0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bfa34f58e2c60bc09b9489db2c8a7fd3327206785752c011138e6c3441060ce2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01fba99a114a9d0c68db5a59a8dc3ad47177a70a982846912ee93288278c6c86
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc2b53f1fb516f48b5e114c86f25b9d1aa2af0780e3295d24e66b96bf0ace97b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed27744e5f1034a68e017d9bdd3ccd5ec323994b3819d524fcedfddc56ac2e39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4bd973d51d3075488c198fef2e8f1da9788f8d6339f06ae044f3284570c68b21
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cd7d6f9df4118f5ceda961f72316d213bde54b815fee42a0d97a122df10516f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b77455b176840ed298d6eb21a44821047179cbe3d970d0a7103db9ca816f404
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c2e1c48a671f1f56726470b0336ef03b0d4f9a15fb0b7a2378cfb9787952bfbb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbd227e6616e8cb4241569278778915eecd65001363493745087ed7a1ac81abc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff3e6710c932d407c646283591c90d6c5550cb6e214372b1be4c5ac870a8c292
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 02b548f67d1671c2516ac88902774c6eeb30f2e1b38cfad7cea45825934d9116
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46202643a37bf0e21711fe0242f6e1f428948ecec8b03bd29b40e3360fff6643
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9ef20b8256b22d517e54b2fda997cf7b5a9d9ffa789451a36269732ed341844
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 958e9c6cd0fe143d1be707d9136036a45d9c8770ce51865e2d95ae57d3c75d7e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d99380275d14f7bc99c6abe52c7b0a1a596a2f53d0a7c6186401b786e3e00e55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b7301fc33c364de8fb622ec1b652f03b9150aeeb8ba60ea93283dd9c663f9de7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb538d6084249f1288d45f70a3330fe0de2fb79e92305dd5120587184bef1d85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1471b3f1f895c0ea846c4a4b9f17918a197b76ccb12205006558d2824b65289e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 15aecdc71265e77218fb728b2999ad353a5ab221005739f475a0cf5d8f0fa157
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc4633b78a468346910a69013d38e441fff81c5f9a9b3d9b6bd2f22d506f78a4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 86376a2b2c35f2317087ddd617773543723859bb15a224f768a29f618454cec0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 70dfba763e7f1dad0726c42479ed40b0e44992718bfbdcb1b2522bcdf770f329
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 711459dc21c5acb9bb545d67fb462f6b0a50b58ab7ac69d22489c34c1a802a02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7fba2f779cf94f6d36c148654cf445f9bdeefdff1b727c5d8991dd94b8810f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af19cc6275a2b292725d1ac92bad15713cdfa34a0f085284eac77e996685c637
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ab9c7738683fdabfbd7997f8adbd0039dbc9fecf0c8df86282179c2bf062e056
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de98105c59fa14ab29bd7b38ce6193be414cda660e0946d174e90b1ad583109a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 324b24dfcfe42668ea30056b88fc7249f194982ac727c9bf4a8b672531187fe5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 553389ae2da515ece04188cd4a83ceecd6552e4ad7c49d6683df022ba80ba04c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 584b4075f092bf56794c47ae001b540fa5f4736134bf173f9507502c0d0f2ec1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de39675e2415056224ba2bb311d9ff2e4992684ef53421628453d7eecbc76849
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5462fc8dc3cd8105eee322f252c317919be61cb73474f846fab6dd71b9b3fbe4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2179e0b4feb133f402ebb71f451e3ea20c59aa21a223f76abb0bab9e763ca7ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7bf6de7dacf3346f0790be0b07556ee9b9585d960c1b97678cfbbbd84dca4397
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 677c2e937b0233112aba5db7de7d7ae0aab0b8a8acb253c23e9a766cda6ec4cc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62540e896344dc473e36e8bef4f985beefc34fe84a535d1d7958f86b9831c447
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4c27c47be0d159aa0c10cba3b89b4630b7731342e274c1ba3dcf4a2f3e01eac7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99629aa5e790bd52cf02a4ec5454636b4a58dce524274c6aa705cb5194691d48
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c57f265eaca1ee83f829bc394f0a715c4d58a94d7b0a534afde47ab06361ebeb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8caafa86a5b0e3edff9c9cea3d68cb3d6cb3759bc58e281b5cf5f5c05b4433f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5aef06d83fc195f0d62c562e36b86a9dbd7104f89a181443439abc440318e48e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2473cdd717dcf86a3c40475715878a439a0c5c8e81f56116607a4064571af652
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0cdcdef82eb4d8da767f307bf9c5a6a96fb847bbb84c99fda0ae327b961f92a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ad70d5b8036da1a6b8af8bb7b6c19503ab5928a13bf0586c24ef7ddacaa1331c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f55ba11768416aa91fbf33c57b7f80f9b8cf67771aa5331294db3d56b9733720
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 557fd88e5a4f2e8c4c43d09717453cad120606aa8238117604c5dcd01421d5cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce1b7a46aa0be37e572458e1ba1dcfa8fbd765636cab2109d5656b43d16b9c5b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7474fc0784b5c4a080337414973274cefd0652d9b651ec203debf2400a77479b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be0540c205596a32403bfce8208577411fbe8c50c4bbc640b3fbf08502593c64
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6145345f49ddfdbf5a0d22d87a7cbecb90e67a04fa4c652a0793ea8f0951b675
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a80f78ca4f3eb224f26f2eea8aa2bbd1cf5cefaeb9da016a442986003f7fd6df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 140be3da7a1cf58c8128c7a81cc4798ebd350c41f16a1ad5f6c4659f657055e1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d81d7a47167f17681d324ed93b9c89c8a02ca7dd87196f35697154f0985d3993
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 637145ad4a14b4328d73cc832a0090a353eccbaf9b1e39e34df0c4f60bf8f773
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fd636825edcaa20a6bb0fccf1a2bd034cbd75e6fdef08703e3fe16b35213119a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24b2e56755803944dc76ec87b9f7512ddf674642a19832f600a91a6a836abbbe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 621e04cee1cc8d9c534a42abaf3597b3cc0b70da2a33787993fe6cc3793878fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b27d5cb370dff84ff9ba9c18dbc7df1e58e1924a5e0573176143fb4590824a61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 761c842e299e5423541ec9b718a038894bb81c05c64433afdeb47572255cfbac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 654ad722fa994d385737866eac0a43b87cb4cc14779a2712549c55ad222b44d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b2d369e84cc551f61aba0d5c57a325d101f6de2487135115c9f947c70f8f98c8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1d8d965bc867a4a2c5a042566f37cdcb5de42f829b7c8b513637be687f67c0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8333c46cd97a0e68efc26e449dc3c792ade84b3a698bde6324abc4af5ca6f213
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8b58e3789bcf537d91985b27f506b7e610f1ec74bee99a7616d392993e823bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8c6c3545f20a1f82f9491122d4ad170976d4351f3cc68cc9e5843c471b4c679c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e7a38aeac80cc37043f49548afd43be9080dcc2f5699d3e0a53efd024fdf5c9
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 bc2f1504363b2ad8244b55c7655946ed4522b5f75256e7114347e3265c3ad0bf
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 265KB
            • SHA256 f4c3246245945bad830d8c736ad9a71273402d17cb1f4b49978360e20f011791
            • MD5 SHA1 SHA512 SSDEEP

            memory/3708-26-0x0000000014000000-0x0000000014054000-memory.dmp

            memory/3708-96-0x0000000024070000-0x00000000240CE000-memory.dmp

            memory/3708-65-0x0000000024070000-0x00000000240CE000-memory.dmp

            memory/3708-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/3708-69-0x0000000024070000-0x00000000240CE000-memory.dmp

            memory/3708-63-0x0000000003B90000-0x0000000003B91000-memory.dmp

            memory/3708-71-0x0000000024070000-0x00000000240CE000-memory.dmp

            memory/3708-70-0x0000000024070000-0x00000000240CE000-memory.dmp

            memory/3708-67-0x0000000024070000-0x00000000240CE000-memory.dmp

            memory/3708-9-0x0000000000560000-0x0000000000561000-memory.dmp

            memory/4848-3-0x0000000024010000-0x000000002406E000-memory.dmp

            memory/4848-22-0x0000000014000000-0x0000000014054000-memory.dmp

            memory/4848-66-0x0000000014000000-0x0000000014054000-memory.dmp

            memory/4848-0-0x0000000014000000-0x0000000014054000-memory.dmp

            memory/4848-60-0x0000000024070000-0x00000000240CE000-memory.dmp

            memory/4848-4-0x0000000024010000-0x000000002406E000-memory.dmp

            memory/4908-92-0x0000000014000000-0x0000000014054000-memory.dmp