Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 02:06

General

  • Target
    95928eac40fc45f8328a61f011882d14a9aa5a5b6102ba543060998a921349e4.exe
  • Size 275KB
  • Sample240825-cjk49asbpg
  • SHA256 95928eac40fc45f8328a61f011882d14a9aa5a5b6102ba543060998a921349e4
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

  • 192.168.1.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    true

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    emre

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95928eac40fc45f8328a61f011882d14a9aa5a5b6102ba543060998a921349e4.exe
    "C:\Users\Admin\AppData\Local\Temp\95928eac40fc45f8328a61f011882d14a9aa5a5b6102ba543060998a921349e4.exe"
    1⤵
    • Adds policy Run key to start application
    • Boot or Logon Autostart Execution: Active Setup
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Users\Admin\AppData\Local\Temp\95928eac40fc45f8328a61f011882d14a9aa5a5b6102ba543060998a921349e4.exe
      "C:\Users\Admin\AppData\Local\Temp\95928eac40fc45f8328a61f011882d14a9aa5a5b6102ba543060998a921349e4.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:2208
      • C:\install\server.exe
        "C:\install\server.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2028
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 560
          4⤵
          • Program crash
          PID:3656
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2028 -ip 2028
    1⤵
      PID:4052

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          XX--XX--XX.txt

          • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
          • Size 229KB
          • SHA256 27c5a0609edd300e48a0637eb74a10303937cbf3ed925adfacaf00422d9d3b12
          • MD5 SHA1 SHA512 SSDEEP

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 aade6f1de2e81d5f84192227af1c77e4970d30d2542fb8cb43c6f2033ac69a0b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ece01f98053b3729c24e4f59101943b3dc31aaea9cf5d5b5d2e962bb592a23ac
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3539c889bf7f6118a01d0b2b8f21356afe201b74250fdaabe7747f2f2f761c34
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 339e2cc319c7d6fb490935b8c434b7997ed7fde60dcb52595b123206c856d483
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9e46c5de63c86725c21b853d8d6e98b78d56c35b253031a1b349c2211c3f496c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a80fcee46578d7b4fefc5b060c6445743570acf1abbd25d414e00e3fde255eeb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 60febf89df28c3bda4bf5955ca68b8da523d2c4b5bdee1ae600975a0ef3011ba
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 945743d664e5a1e8b930008d8393da1bc927ee6f617737782051545a55a8c649
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 531b23f29071305d370dad73af372808e4854032295ba19f8db859fbcd942719
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8ebc9e84575f5b2e229a870b089fade3e72d312bfa5327a5754dee07e82a7c11
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 84f3a0291afc77aaf5c1ef6c7630021236c6157dc09d8472c5cb12c92a1fa818
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e485ff40bd81b52a3421ba95c42a974a3085b0b8870a983b7ec43ff7a954b597
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e992669cd7f3ee439efc515ca1de5e6a8c4dda742f590393894582392b8f7cac
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 55509a09df70c4c06c6cc0f6a347ab2b9667bcfb0dbb61acc296c4f57eab3700
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 87923171dbd3155c07afe69ad84c87a8d3c9d0aca9d66fe3a0492d3349155da0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ddec5962140fed783ba6e5a7e76459407df0fa5a991b974f8d5a05c6156b7bdc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 405b687785093f607b29d9d546274c8c070f1c00e1f5eb7d3a8f8e83073ba778
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 39fb69be1d04d53a75784e6807238138fbb88746e35ae58c424b20464ea38fe5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 44f439bcecda29559193ea7cf03f4a8862b446e6abba72a118002f2322ac9af3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1c6b4f18d02b7ec468ca994a6ade47b5f6b91f46a9b4c733b848b6f5e0fc5de2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e27e6b7bbb4d5ffbbbc11061a91f303ec7b81d8b8f18de8cbba5d4366933fcfc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 13c89df586e9c66577ca5006dfa9ad0acc74842a34aabc4abd13404974d81261
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 086cb654436a4cfaac464de0c5980355c642c6317ecf7f678148a16dc80624e8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cf6f02a610499b23c757c81ea342ec922b92563963641e810bb1cb7d73ac4deb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4bc3ec2f564e0fa09a47001a212fbd91d6ad2edf8e833b1a097d4e2db6c712db
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8158f3fc4444d35acd3b98b0805cc60759c127a82c44c504d28578dfa56d63d7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 13c8d9b7c29dbb7a865dde80648908d181bacf515bb1102836f7608e9ea6e2f2
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 681abb9730deab79a05d1f436b53cda6f245b3e47e624da9837bb2854a2cb085
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 bcbdab94bfc9a2a3165cf6d82c463403f51f6688e7eaaa046681fd32b0aaee87
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 ef86e22509e981ffc7586eba87289da2de85bd2570fa2e066d323d7105df6e20
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 258f1c9f5e36e22608d97adb992809b6579b3bccf2b7446c0db639029ef6c5a0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 88dc61b1b2cdaff21b543626f5bc2a444c065326b78e458e6e6cb367f258264f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 46b38bedb5829ccfa1f85d093aa78e325a9caa4ed97c06dd6ba323b0096e890e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9c47b2597f6db062fbddadaffdc8bcf6f3c1f33fe89ea9ce1061f353908418be
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f7ea66c1f6d7df67c64b6712860d83eb3463489df2600f797cd754e02de0a51b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f77371ef89efc53c24c25f6f98fbca7b944b8409a70a2f50619b0fb169fa360b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b3e02cf40160da68b284bcebb7cca7dfabcedb3cddfc69c91d8d35eb87ae2dae
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4358f31775ee8a4c9027f9593cd7d4f323de93900ebf8fc36d5b600a0795c51f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0ac80ac8d016f5723349f4b67394c38b8dac73555655cc5871205d565c7b18a8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d883dc786a175a76c9b916a938326f605a98ba43470133d3b34404370795eaf1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6cd4e58dbbc9bfa622c3800bc4935cecde552cba8bf1bda83d2b7528e241d8f5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 46264392aaddaad9f59e6603f2bb8b49b146d064149af32c4ecff1281feb69d0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 647a796c09a12bed979de97c07228f56b0c87575b112107fdbed3bc8f12588cf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f9c6a1cc4887bb4054557461ff6c4cb9d4ecfa7cb5862a2283185f522dc461af
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fc54a1f1ad43dfe990b1e7643daed849271dee6ecfc5e51ee9d1e4957c0e5ddc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 22b4f63bbdd436d805520ec9abb7bed7aa20742eb7b743fa288ce717a2745b9c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2f160604962e844a4b49392e9377ab6db613be8a54a9ac47a28481e039c32dff
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 75ec843dafb3abb64059bce33edb96238661ea37f00b50f6ed3e20a5add929e9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9ec0e7c65b165b58f6b87827face88926e048064229b5727ece97d65ce13806f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a4e4491b88eadd07114a7a07c31c712d45f4a339ef12f423a6e66ab20b5d91cc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6f9d180e8dd473371d1fd3e4463625e4543bc278a337d9add2eb36b958219e69
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d563a2dbf38a32d1b3d8febf78b0147a879be027d8234163792100176fc93207
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 41f68717e080638b7afd1f17830c67b7e4f5c3f69fc8811773139cbec9457dec
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d279b641d7435b22f29dd87d0abe7906a19b5076bda84cbcf5533c98db4e48d8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cd3f5628121ab8dcc78941b53fbab4eba247e6a3b929cd35c846e2ef2b3946a4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 983adfe9dbdf080d68c8ac6b2dec6cebdf6c0edde0d6862ef16aa1391aac6c73
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0c25039b2f7c1411c2487cee8eb657d91583cdb2665edcfe238e8c6757aac287
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 241780c78c628aab40b40f380a81e12e416d7a7d3706345d8e69fbca7c7faabf
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 cfbc2faa42abe564bfabf3b4ae620c7287caf54d2a7f2f001f9ce5239a54f7f1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1360a213f2467af0d90e476049a0a37d383339794ff74b86bd52429b4db04f9d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0a61100c75e4c553ed91cf4c171381f7e54eac55791eab646a54d63366ad5b0f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1322973a31ee96df2a68b775d429cc80261e169c21aa88bda4ce40a9af835e5c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a06dff281d798c1ee49985f405811a4d4ab10defee23815f47fa5fa0d15c7e65
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 df82ec959e3d8ebd25fb410ab2dc2b10a591a32fcc0acc456e0c67459a90eaf5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 76c961de3d52876cff0d86c5235d27f31580a28912144122352493162f1bdfb9
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a74da4961c68c94d42c5f8dbac154f32479619d118616a51728ac0256454c5e8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d467ec759b71ab01faebf9c63a5b8c7e91ddaaa502980a9b4c3e62e094585e66
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f660db6a3ee6367833c903dad6954218a7fbc3c80a4b5faade1b665d19cfd116
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 55fd0a06105567ad0420d31af0cc3e3428978842f7d454a55971a41c6c1ab9e3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 270745873f435745db5f8322b7a476640d57233a8d93a008378d24cd0ce25a94
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 11dfab397f2d9b6d3e0af3467a7be1fa5585b019d8b3b9573d1f195b751ef4ee
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1683fb2ef9e9aad3bb00df3ce3068a3b68f4d947393548f8b9527c1da9895a63
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 50af0799ac06f40e42123a7127662750ec50124dde8cce66d9a47e0b703999d0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c352c27e3145d4cfdc30121402d7bb192a062376a26050da1012ad1879595d35
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 af49d8c756675060a36a382664dfe3bd06301ca3a797f44f35f32983008041a7
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 306f1da4708f94742f8989de9928812b061b7ffc2888936fd9c807235169124b
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8cfa8bc284187963cbedb819a821b059546991e946096c2e1683faca7dc6a274
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1a5c37c14dbd95b0c58becabd27d04a07c5237a6cca8b7a2abcfe380541dfab0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 96bf98db8da5a339c29a751a99ae0fef1c69f4f1cad294fba8a4a42e1c809d17
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a2f460effe038aec572176f44d9664f0d3c94e05df6db68a7629718dd4b71d21
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c6520b1275848a24917dd7420f6a2463bae55659f414ecc533ed1e91218c67af
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 13b373246d6aa94d351611d136744dc92c536f0e81ce2bd873475ec530808e3c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d0f33ccc38a23c9b581d009e9bff0d1c23ccd256a0a4f2414871075c83a1a6ec
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 5eb9e115d2229bd265505a444fda76c3aa42f3ba6e831ac3afee09615b471ebb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 368737dc3bbb1ccf1b9bc83e264c6133b0d7dc872a626116d5bad7ebce441e8a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d0a3daed5a59acdb146eeeee81f790447500e2d043181ad8e5aac7c664448cd5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c2545ad98102a9e8426665267349d4740f633c237c3bcb07b92c019ed6324e59
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 61b3248f285321ab9849d1500610f91a44a307a3acfe8612378d2e420b3e5ccd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b3424d434515a92d8e7ef267109b7fe6a83d16a70fccb3a1cd6e50fc4ed3d6ce
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9904ff1b1aa7b3c99e7f42461a8b40acf8e36ee62aa85a7b783c76c6199fbac4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2364c6351712312be7e2a399a213f6a69905dc3e24c0cc00785968d58c4aad43
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c8df7f14874da74ff4e221c23b26bd8d7b6998abe398d53378a326ae24e546fa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 19dafcbd2ad54d0a21cf5372c95bb3dada2a8997d45a8c1656f150b5a4659a11
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0be5cd542c62afc666802739866e1123fcb77280a4b2b55112e34ab23f65e25d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a658657d0441186e7c2665cd6149a35711a6feae56f25555d1b76397e1ba3c89
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 e6e6341490d9ef000776eab675ff37a398707c0486e8adad6a0c0ae89dc71a1f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f4f5a9cfa8816dea16e698008fd90058e4910d3716af1453a97a7a9db2d6585c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c4e5b915ca0085e475f75aff2a8be0f0db1b66510a794b3ae74cd454524ca1ba
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d49f3165a61589e6b69a97f357238477d6ff09f4b87418547866a510654a5712
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9c840471adeb92abd98419dd87ca665c34da3e9cad7e2e4ff95dac9144717e95
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f927b93de99730a24b691d4edfd024c416e8ce073b62eda78a7a0ec347915c45
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 dd6214f7b38809ef75dfaee5c7c7982997b303cd1e4dd229ec6c4d74372bcbf4
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0400b3197b3a1aec85522e6c293eb171936886547d5f69d6f4b49c037afdb4d1
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 94f4f79e2016b247f28d4f4cf62b6e2be1026c600dd6ff256a50b26e0fcce53e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 df1d6af8406c5819b7a44522f7cf470e619226afe483ecdeae3d7ecbd4961d6c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 29280f0f6cb0e950b24c81aa39a48d787bd72de41603d087143ff7ff0855a9f3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fb8e0a7011b870e78a15847ea1ecadd4972510da73935d9e5a29898513949d0e
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3381ad35ecb3b2e6470586e743df957aa19c8efd10edbac0f096f71a5be7b831
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 32cb4342382d966dd832d07314896b4962c8fa169f660af6fc44364c070063de
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0bd301cdb0245bb5fd6924dd82244796f6c88d60f0c2e257b85bbd17bff16af3
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 8a68a092ac35c2090915eb03d064d34008878de2473ee9cedb9657f10f1a9faa
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a67828efef31e8cf2d117a35d88e25c9b0b4c1be0a13cc0ae718e0a000c655fd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 66742c58f89b6e848d98495909b930f6d8920003f869ebc58b385faf09b994f8
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 b542f770d345b1ac973cb5e303cf3cc66f409c18f3bf3a8d5ca11b7a7148883a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 2d73a7eb526dd7e3fa67e004232bff8b0aff91bcdf1909525e46f88ebec1195f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 7e13f0d46d6778537d316806f5531a744c9c943404059700c68ee23c50d54f3f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 733903fc6700ff0ccf28d263d0e0cb9da0908f181d7a49d68555f6f21e0ec2f5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 aa2bd519a0a9f42abd0015e8d629d865b76c99c688fedc6025f060bb539f0d59
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 4a98377e88f78cb1179fe6986b704c43e8d34c6f48e412136707c3f508aefe00
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 c464267326176c2b0234e0af781b2d5b162bdd855b29b245b0dda0f69b4342d5
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 154bf77d77e67c2be5f107c6584ed34819a3a998376c61d8d0899ec601fc5aeb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 15ca509605ff3b3aad91651c6e33b453b4485d09bc123a57a2a462a6d084d4cc
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 09042aeb4f2d715325590a4e7bd1dba5d1db3a5ccbbe3ad27996270e36b5c612
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 d0f55477770c390cd18bc3138a5dbaff970defc1a92f36cbea0871b409c50b07
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fb7f7ef69dc89ec9fcc2406ddd558668f3ed45b2da7f362d030609a2946f2d9d
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 0c3ffc276b2241d6ee8fc8a8efd341405240a81ee868dd868da9a71010b8a59c
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 990140015f19ae4172209ff5771c68387ba03d26dad5c58e8f7137ab0cca9993
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 223ef91d327ab2e3fb101d5292fe9dac33d2d393ea15f3ec349dde558db12cdb
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1b376452f599f78f0bf5fc75641dee3f5d1d3df7076de4da2296d7b36c3026ab
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 3ba99a67f86bc6dc55b58602b726fe075b5aafaece1897ea143ef2c330fb5634
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 fab7de899b4fef716a72a9ac80abb9fdc87484b8c464b32d931cb2d1a69c32b6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 6f13f2f522ecbab28b4d67a3f86116e56ab0a23ccb7844e3aac5c4c0c9ced336
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 1624e7e248ef7a99247f3bcf5f7929109f12d0bfaec33deec18afa3134b10fa6
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 802d1633068cf4fa582702c96f5817a9b75a826083d08843dd8d3b5375dbf8c0
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 f16da9eb72b5bda00c44a95dc472d9d8e07d61f765dbd86dc3405ebfc6a21fdd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 68fb26a86617810943a9b3327955b24ddef3bb0bdce173d522829d33507c284f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 63521499f2d9a05bf1bec987569cd8295d10e221abb24bb57686e2fe9876068a
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 9d181793d2a19593965c8bdfc3f5525b1337bed39154fd3868a5bbef808372ae
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 add4288caecfaca2be78d174b841bc3bf4087e3e3ab426ab9b5fe99c7ea5780f
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 a5ea2e5d1755b90d2fecccd2cd2d6db40d5b1b3464bd992239df162d33c57fcd
          • MD5 SHA1 SHA512

          XxX.xXx

          • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
          • Size 8B
          • SHA256 53d3bc56842ee3f666f5a15acf38b026447f88e25ce48ebf8b165d9ac2f8692b
          • MD5 SHA1 SHA512

          logs.dat

          • Path C:\Users\Admin\AppData\Roaming\logs.dat
          • Size 15B
          • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
          • MD5 SHA1 SHA512

          server.exe

          • Path C:\install\server.exe
          • Size 275KB
          • SHA256 95928eac40fc45f8328a61f011882d14a9aa5a5b6102ba543060998a921349e4
          • MD5 SHA1 SHA512 SSDEEP

          memory/2028-95-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/2208-4-0x00000000001E0000-0x00000000001E1000-memory.dmp

          memory/2208-5-0x00000000005C0000-0x00000000005C1000-memory.dmp

          memory/2208-25-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/2208-65-0x0000000003DE0000-0x0000000003DE1000-memory.dmp

          memory/2208-97-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/2208-71-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/2208-72-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/2208-66-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/2208-69-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/4464-0-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/4464-20-0x0000000000400000-0x0000000000457000-memory.dmp

          memory/4464-62-0x0000000024010000-0x0000000024072000-memory.dmp

          memory/4464-68-0x0000000000400000-0x0000000000457000-memory.dmp