Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 18:08

General

  • Target
    bca5b3a4b173acc7cbe1d817c61f9c38_JaffaCakes118.exe
  • Size 575KB
  • Sample240823-wrbeka1app
  • SHA256 e7faaf1cf824f0b159193622366b8042503595747bd53366da833718f5f08f1b
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • kurubaglama.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3380
      • C:\Users\Admin\AppData\Local\Temp\bca5b3a4b173acc7cbe1d817c61f9c38_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\bca5b3a4b173acc7cbe1d817c61f9c38_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:624
        • C:\Users\Admin\AppData\Local\Temp\bca5b3a4b173acc7cbe1d817c61f9c38_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3604
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:228
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Deletes itself
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:2012
            • C:\Windows\SysWOW64\install\server.exe
              "C:\Windows\system32\install\server.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1784
              • C:\Windows\SysWOW64\install\server.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3360
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 564
                  7⤵
                  • Program crash
                  PID:4524
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3360 -ip 3360
      1⤵
        PID:4408

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 a42d897273a0df60be147d88718a4415ff7c62dce26b720a875d0b7d7efff09a
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 92f791e671ad160f2b1f6fb75e82dbee3b8649bf9ca568361e2e6497ba94c1a0
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 984318fcc2483fc25f1a84709b554f1e6b2d84e7e0c9587d26683e1db8f18ee6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 96dd1c217bf50f2cc2c791567fa310566f7c85485fe1a2614ea56e361ea49ee7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 14fedddcadefbd44c85301220a3fc0898a3caf6266ccaefc9a394d3424fd2898
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2670b6bff7a08df427079c66b8ccc5b4dfbc121822aef712ad9a42b874b68263
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6fc9e9a0213f5eb503c8a15e3f285124ee377babb69a5d86324065692c258bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 91b685d837c2a7b15d93cc3c117381ad80fc2931244d1e8266b4353c3f48508b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 416cdaac60f22bc30c65c5ea57ac7124454e18dbf95f4b4b71d7b273903f5951
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dde11f2fb510b0a4027fe93597d82f21f5254a3c8154cee3d7310c3c967ee205
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 675d527653278decdb6538e5605230c49eee2225c14c9422435b2d9ca65e375a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 857784923c1eccf9276b81dcb750e1d0b271b4b84ddb20d4b9601c960c75aab8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5e7a75ba1d0b9e92fe0937f4b7deb67efbb0857ac598c1882fd2230adcb5f1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1a31bbb08c93d1019ffd646a6678ffaa5f6a2e22be161ac5a98f02608178c571
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb91d36ef08a594de411e5fbc97f34803c9303b1dd96379c7d7ecd352eb8a3cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73f46fb1124ff161af6399b3ec60f439e33ee36d5208e8b30bcdc15ea3bf9f51
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 21c8d1dc9fa6321aa995fee5489852dc64a64c9e5b1bcdb97916fc90ee1aad99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed87bd8f318fa96a219b5d97bd1eb48ba2626b812c33cff5ec11e3a0536b1eea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6107c98d607cd8dd919b4e77bcf0d604192f0608df10b130d1029f3a8be922b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f20c047407c67b30c1e2294d3162acbb33e6918cc3491046afd1c62d9110dc2f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d68efc24d6d816c7f03fe3f28950e8550dd78475f822cb6a607c844db4d67c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 27da1062a8293e0761d42f8bcae1e653f2ab8133f4704ff044c56ef5f7ffe5fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 405b4143a2aea3c4468f0fb69daa061db20f7ec2bd8fd1372e4c058a6483139a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11d3a8a3f69cfd17d2f65477d158be47cb3bc332c1974aa059784b2cc5ed2b3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ef8004f0ea368ddb59d2e1ffb5dac02c2c512ffee286d5fe635e9b5ec28cee43
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d1a592fcc9ee2cb25e631c208542adfd2594fbb4ce440ca52b2899ee2469e5f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5db7de83635b191927efb9c478040ac2d654b2d0b1951cf1c41d741a9a81a776
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c21bc26b7fd7915c0846841c52f864bd134ff2058419fb5f14cacdd605b09df2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 083b4c7e3cc322325712ace5fa40657e00648eba7aa7f23ab0042a9ffa32eb33
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9bb6f9f9b0ccf1462d62b0d6fd6014df4ed2b4f47ecc67bbbe49b2fa3abf9f0f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa956588c628f21254ab1a2aa250e3fdc76c8f32f315457286e67f7e52fd9d38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 79d7720548a424b35a92e98ae0d7a8ed4e636fa4cbab02af110452e55123df81
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 73c700744b2e1b5f619b7c11a86c0eb062115dff9cb5fc50cc85af3a4013fc55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 75d96804fd4d4c262142ae56ebeb92606406eb4ab816cd2e0953d5478193417d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 45a7ea9b6f9d22cae00741eab2fba6efd9f33bef92fa9008549de0575225fff4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 398759465e906b6d7db448d413989a5216ad492182697cf772971ddaec41af90
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 003f8301b7e4cd486eb33ecb235df2813cc66dd88e2c93d8aad29ce9ad32a507
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 414d36ded4efece7bdfebdc5b3cbb503ffa34b159350a875b37a6f0384637872
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ba6f5bd82b9d42a0e9e65e66b071684574c4075a011d84c604216eb6db00c163
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebd9570679aa156af6eebdab9893a3b1b0ce83f34e4db711dea1f753207e5c06
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28d9c1ac23aa9e895b8a9c67551168055536bc76363f4a398cc8ce3f5eeeeb6a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 078037e0998af7b094a751973fbda37739ccc5a3abef281c47a02ee897eaea5d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d88a6759c7948058f5245087f80f8ab9beee2786bdd158ccac317e1c7e5fe9a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c4c6ba130e229dc1b8596e2019c2648cdb53fd31fe880372d18931aa0f1e40d6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e592765a9a8ca8e9d8247f0ec4100c3dab9e7c67a8d0fa8caa40974646a25577
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ddac641ac79994ac44f0ebe06bb5e7bb15c31eabd2e223bd18f22130782de86b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20b837f52460bbbdd23050187751bd52f2c69fc471168aa02e849c55ebf93815
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f0047eb0735b6fb41c028ed03d44d5a8b675631a47a36307659f42e4427e45bf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0f8eefe6061753ea1f3bdce08f6e9131561dca66d23b011e225c7a2d6febd9be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28a5b76871ee19eceb91b38373c42054c1c418c6d5150832722c1107cf839aba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffbd3197a2e9605e5105352c929a9851e3a3afb778d6aae7ad299651bb888eec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 74dd2a82fa3a3a5a58561a11f03a0de03b9e140ba77021d5211663014f4e5481
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 627d12ed1c1448d10039f972099122efcb2148ff7e785f37d6b04d81dcae647b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d593b92378a84c7b39af122c2dcd7cae139f579f2e9d357ed5e41ce058c01268
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f7f02200ed27e7cd6c76343ddb7d694beaf8df9a8539b1eaebc720ada8965a93
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a92f8a0b8c18a99e61b5340be2d5c78832d317449cc4b93a8ab12843d8b6a38a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ce4b5cf8619195eed8d90ac8ee9dd6c95db1cfae1b688b8ae52ae0c490edd23c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0fb02deee3e4a73533d610ff5a67310e1b759252ea62b780e11d7fd1280529cb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6fcf9bea966a2603231c8b767e845f172a586f62952ec7e1f7f6d9600b66be2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8074e37c97f4b89d20270cdc8474ce654990c71557621db8d59c8b078aade701
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4841ac66d53d5e2bf880817de6f239f21f433f8bc5a10b71f35f3e2ce31596e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0c2f5f5736ccded590f5420444b7ab366172919f37eafc5e005fef0e457342e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6c063e98d6233b9dfc624783f9919bcd825afdf82ac307e1f7ed7db5be78a99
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f882c32b45393c8579b350ce263e3e800d3b2012400ab752ea61c4c11200a50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7bbdf92e18ca0baf7d3efc20de77dcaa163db79787f74f0e9cefebe409a2e925
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 956ecdacfc3bb857f3776a6fadac29132482a30fe438d9bfbc85b91b5132da1c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1ee1ee87044954d296ed4e1baefc20ab719aa7a40ce69dfc3d45ddbee9378bf9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d94add1bf8500c72bd5099061b85c8f5be875e237cfe224078198a902a3e2c7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 468c53abe8c11a40d9b0e2da61f821b89f105a0667d7ba71a95447d549649617
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2c5d99b9352c1366acba5e0a53d94e94ada437e52b3176013b71595689aa2f47
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b55f0adb41a2727f2be6d392db8183653e456c8c24a7f94046035b4c75c94d65
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bbb5ef2fa71513bfd129687557552e3001e898e0e6aef3fb4c4af86933f2516e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 010a44413624a934d00ad30d237486e82a3fd7d7f68fe35d6759b22b8c7587f4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2eb0e82ec04e9f2457fbe548b5a0a02f956c1ed082b6ad62113d4420f84e460c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6294cf9584e6b87fb8f17114a7e51ce0d064210e7b6caf391acfac32878bbf88
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ecbd9ffac6e1b2166a5c9901eccc2a3af332091a3e63568f599bf4eac07453e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 80b84a32e92c3c6f57febf51b36211dc80f24115fac35a1349a8763a1ee47479
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb850460d9ddf7ffe0bd3f967fecf6568e00b36f2e5cdae3f4f19ea8ada3b244
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a49e7b8e21056a9b900173583ba87f2caeae0c662193950df150afd6e1cd6f0b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5eea157e17a618b46ad8e160f9ccbbd5e5dc4897cea99935a91e7e174c59f8b9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99ce65fb8a2235fd62165e9ff19bbf21a903e852c657102c20c255487cb7a00a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a2f148bf69076c2db7b89d22f1f07e97cbc8f256a6732c0229e2e25c03fe62c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0a17a13c0dfc4c99aafe6f82948ccccc48a426bf765c7d6bce23f21bef931f36
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8faaeebb12a085fc21a996cb48a5f105b5d14c5eabc76c43dd216ee6699bc9a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 67590aea07c29810784473bf37af766ca1952606d9e797acd5ffe7bbf1b53a09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cdec8ad5b978b3a12fe862647f7f1660f55ecf43cafa3ebe53d6b0352c390508
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae6dd586ecd555f22545c9eccd1d347e20990e6a77046a08c33219e48bda4add
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 768f05c3de2dbc61e368c432fb7c9a7590eaa625f9c44501bd328556c3e6954c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 637395e169d61837a19e1b07a618602c811a735b0984b223a55b34d09acb6856
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d689a91fbda6ad61f138158a3f85f4a7c6435f0b1e8a100dfa9e0247d62f8d04
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ca6ecbfb5934c6388da553bbada611b0a46ef520b21b0973bcb2cd8ad8b0aa3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f1a4e9875693412ba653055475f1924fc7f90d2e13e1ae58c8ed673cb8fb33c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fff68dce175af4191f62c4179c073894ff58772f86e24d49637ffb828aa889c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d16a00234c01dddab4d15cc618c87fa2bb82aedb48e26dab1238a85692a2961d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 473b20e6ba035d113acbfe5fcec9ecc27ba6732504513425b39f460b014301ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed434a88f19d7c40426499647acb5f232eff63759f89c2baa1ae7751180c7ff8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1e7fd47a56a1036e57e687b1f83cec5c8498619aa8f85eb69fa3ab66c8a0de39
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9040d7fd35ed137d6b26b65a652ca69e26f6f774e1b1ee72932e7875c6be63ee
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f8182eba603db0c740217ff975841c67b33f23377f9ff58764385e8905a65d5e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c288031c3c7cc54a11e9da0202e02b3797f5c6dab5cfd059040c627282cb75d7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea3aa756833d917fd05027adaa6f5f5880aaea4cb6a597a66e9c71c46cb75da9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eca39cd7a6dddd8b73f791167777cad2acfb383f4e423e660c76d78058eac1b4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d9175ad8b4c3e9eaf3305749d8c2998ebd7a5cce4dbaafbd02e46dd59267755f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5e59e2e1112d1af58651658de636c23372bd70633f0beecd3ef5b5fce268830
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4a01fbc4bfeab64442b04cc3525230c2dc113db4f283ef507d25ea5dc44a51f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cd5cb0461a346893d502613d53d0270f91f93f29484ddf442ae5296609da8c85
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 585d80b9254e18d7fa143e596e11cc04f231d8ee34fe8cbb21e54eb158be6d5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a0192aff75d48d1ede38352666349f2ccd3293f84101edd889f20d54ca8c86b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5c1dbbbf20be0d50606493858382bbd51ba24a06d00ebabf0de528ad5b92b859
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2e41a8f8d3b8c33265090fcfe6ac7d0d712387a87c462470d4afe87e7e5d9372
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 08089c1e4ef68d37b0666842a92ba04f42e84fc444ded90eca312ed5090d6b68
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 512a3b38e54ebe6a2dab6a30351e4034dc1813524c0fa0ae75b9a3d472dc8d7a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64a1cd3e2349c80f068365814bfb2331758d4bf9e1142c638fd67a7c8c6a6d3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 afab7ed6e43ea86d27960e73ded0c1060a800a986eba9ffcc7c969845b30cac1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff0ef9f0e7fccc25f16fc21279d1e8c6a8b31c8ddfb45728470fb0835a92e770
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f5c48e102b50bb7975899f7c950f5b74c62269c38c65492d0ee16ff70a0a0d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55b30691c4b6c13c434e3453e423cd59dd285d130bc4d7e2b98eebdcca1ad6ea
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 419f8038e68dc323529229c2e565914cb94a9cd1a0e5e613add081d3eb4743b1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 220c628c680b00b7b99c468715c6fc74b57400eb012c5acdb8b80cb31f948b22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b82723e2c79209b8a6adde98ccafbacff4d667f2c6030db1a6e1b7bc2c082ef5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6379c27febce96fc330c3ba3b7900a0358f6380bb7cbf803a32d2c7e151975d9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cb848acafdc3757a47ce731115ede4acdd49e556d501db92dac5ff8dac1b72d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6fa0db4b3fadfa5a76026d510a8c7bfbfa5afe9487622516ffb769f02802a585
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cdab63cf9a4f6ac70ab8031881ba2e836e7fa05d96399c7363c54992fe81853
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f8cb8fe84d929488d4a9f8ddedbb8a75fff6320a2c99f0027d63245331408fb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9f2a339c14550e078ce4c4ee1a2fb7b8ad575cbc41d4fa8f707d0ead31ce3a1d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 13d3efc0cfbb5ce8315efaec24900a0e96974321e8cbb81cd701fc7f10555c61
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 101e13bb14b514fd98900efede462d7fd686bee398364707996ed88fbefc6e18
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 234227926c02ce948059691cf534c9c6ddfe3ca3a0b90812794d39a4c194d8f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb0cddd09ea0f7d5d236bce5782b2bc76d2cfde296cdab8a4730c3c67d1c5ff5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 891956cd14c95d65ba40b66329fb664d4ed06dc19430cc1e439fff880628aaef
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b930aa17bc1b4d8c23a3f77240eb3849e87ec641066aa9f2a7cf8609c9504a9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b1a73520ba7a2768b0ed332d5e2ff6f1f53f549f82d7a7ca201b5adbe53fefd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 035002fb3c20c31e646e17dd4a278a37e458479d8d9c44f6f0d5c85e6564d041
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 63b58ba9630643a7f987098881559a68983086e0fdb8c78aaa66f864fa528fc7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e80bd7789048ad0ef446345b8f62060e798003b304435cfc4d9b0dde571ebbe1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0bac6d3e705d47e1753eb93f684e91e30d0659df9da905a9d4e540fc61c9cb1f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b02e326dff702c4d90cb77ac3426d962e7735d22ca6580d0e719c7ee70183d6c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b859275070df1bd8f1ac5f4706f4698e5f1aabc02963dbfa4c113e8a6ae84171
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83d10b915481d7d395170748aa1297e2a283d69431c857344649af61693c77f5
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 575KB
            • SHA256 e7faaf1cf824f0b159193622366b8042503595747bd53366da833718f5f08f1b
            • MD5 SHA1 SHA512 SSDEEP

            memory/228-172-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/228-14-0x0000000000E20000-0x0000000000E21000-memory.dmp

            memory/228-13-0x0000000000D60000-0x0000000000D61000-memory.dmp

            memory/228-75-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/2012-176-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/2012-143-0x00000000240F0000-0x0000000024152000-memory.dmp

            memory/3604-4-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3604-3-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3604-2-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3604-5-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3604-70-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3604-8-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3604-29-0x0000000000400000-0x000000000044E000-memory.dmp

            memory/3604-142-0x0000000000400000-0x000000000044E000-memory.dmp