Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/08/2024, 01:58

General

  • Target
    c60c0d16d47d9674163497a0d9928489_JaffaCakes118.exe
  • Size 296KB
  • Sample240828-cdvrhasbpp
  • SHA256 caf153682beb2b2f8c63ff7108b0a25528dbaf6ae668cf8b3381a3cb05bede5c
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    sysrem32

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3508
      • C:\Users\Admin\AppData\Local\Temp\c60c0d16d47d9674163497a0d9928489_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\c60c0d16d47d9674163497a0d9928489_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1604
        • C:\Users\Admin\AppData\Local\Temp\c60c0d16d47d9674163497a0d9928489_JaffaCakes118.exe
          C:\Users\Admin\AppData\Local\Temp\c60c0d16d47d9674163497a0d9928489_JaffaCakes118.exe
          3⤵
          • Adds policy Run key to start application
          • Boot or Logon Autostart Execution: Active Setup
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1008
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
            • Boot or Logon Autostart Execution: Active Setup
            • System Location Discovery: System Language Discovery
            PID:2256
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
              PID:2308
            • C:\Users\Admin\AppData\Local\Temp\c60c0d16d47d9674163497a0d9928489_JaffaCakes118.exe
              "C:\Users\Admin\AppData\Local\Temp\c60c0d16d47d9674163497a0d9928489_JaffaCakes118.exe"
              4⤵
              • Checks computer location settings
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:3824
              • C:\WINDOWS\SysWOW64\install\server.exe
                "C:\WINDOWS\system32\install\server.exe"
                5⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4384
                • C:\WINDOWS\SysWOW64\install\server.exe
                  C:\WINDOWS\SysWOW64\install\server.exe
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3544
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 572
                    7⤵
                    • Program crash
                    PID:3740
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3544 -ip 3544
        1⤵
          PID:212

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              UuU.uUu

              • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
              • Size 8B
              • SHA256 5daee6c171e9481e54f617dcccc90a834ab76505701e76cf53cdc3aa0d348914
              • MD5 SHA1 SHA512

              XX--XX--XX.txt

              • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
              • Size 229KB
              • SHA256 788d90e524c77477496d79aea52d310b26d0d3ecc201196d1c9ca167803c5e3e
              • MD5 SHA1 SHA512 SSDEEP

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 475652c2695056294b09bb09561225dffa54fbc7173f141e2959e46e28124b2e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 acb5de6ff39fd62154d7ee3aebf4a007ab4b7d18dc0b82c0f5013d622bd5e956
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ec08e0baa64a7d159b4b972f42ba7bfcec3d1df8ced6f39e6a507d88747f8ca0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94b54460a59f716f0ac64e583389d7439e8e0433fcc81737e049792da1856471
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e54dbea07240801d03a6a3926cc99fb14c1ac4d5209e1fc328016df91862b24
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7514c389ee5249fe9e45c6e9ebba182ee374a6f4c8014d1b1daaef87c2922e65
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 eefd5788c662d0c79f43d88e937fe5fcb4f7802c45a9ebd8e2f900cb5713cf68
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c3aae5c2611e07285fa96d3cd42121c866110b2add6c8088b7f50e395032287e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d2ae5bd355ff283e95ba8482b18f0e0a9fe6dd140763225241b001b201eedbfe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ebc88e79173505849b491886d924162a035f888823bbb22ac6f1de35ffa8ac83
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c0f52e7f6532f302a27e094a74fb884ffd04898c37977a415b7ae970ae46f37
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0bc2e03f7158fc6c259224596497e80ccc7939f77104c145076f43c79964f62d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f07738c14f797300d992fb58b2d5a69e3394958a149d477b0a492bc12d576499
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 37ca905180daba687c44e6df91c94c28287c8a888e0460c65d1230e56ba6844d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5a416f2e19204e645c15157597c5d4ccc2c0d630bfb86eea693af7fb5b78a872
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f6822da1a00b486091cab1e4f0c68df3e6a83d5da13be33f68fcbdac662da7c2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c43fe112490862fa14e9334f81b5f26026844529e8b583c798e753899b8c7084
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b629d32d6fc7c42d1bf3cd0624f1a3b93fadb6db2256268e172b3a9c23dd3ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d20f56cd3b9782afd0a818380fdcd4c9ecd53ac5b7481a698b42b454a4052c55
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3c86458858374d6470c6072bba5a3156093bfa5d4e4e851b6cc962a4013fe95b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4724135b760b67e825c7eb93668fa78a9030cc710f45937f5fddbcc4774a1848
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0322cd620ee512581bca4d5329b6319d9c9646df76ca0734d21306b517c2d67
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b890da2e52fe06e1ceb3f6fe39b76e48b2099f4289d684eb3ca62c5aa2a63893
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f9fa1f20a134dd5bed7fe5e3f334abac62e98de4eb274f21a77105b1be823416
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e53e5b9f1c57b0cc38e7ab3e37550e614ecc6898391ba277e4b2eefa1304e0c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f909415b574e55306eb42b27cb7c495f529956b5f5ebb8407f06c8d1c249be33
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 227a2b7c27d3ab861febcc0bf429ea89348ca60c8c50d4d0ccd6556a1c826bcc
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ba90ed379d295bfbeefe551bda3f7725128d319a78565d4625a13d6fbb8d06d4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a1474b7f5f0101a32627df5a38940f714df6738d4a59a4f0d52ebdb2ce475aec
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f51a0c2a06634e747eb22bcc20a3871128f3368c7e3f13210f55b59b81ce1117
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94b13fd6c479090103a878d18703891d8ae55636980cbf9ee2ec565f35d03f44
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bc068f0e696900cf9362341dc1a1cc436934996b8d399ba7d14a9a8e9bd8a020
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1f395fdeaf14c9dc702bcdebb221c0361d3948570fa88ed0e4eb0d2fb066999d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3d473b838b36b1b7b89e2babd4ec9dcfaf521afff075a9b24f23676e52f6bb81
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 94f2ed8705b6fad874a262983ee705dce19b78f82ef3de23ad18c41c3344f28f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af2015b7badc91f8d16ef9a083df47a4f76e025b8e0640750a23999ac3576161
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c74f06df67cc880fdcaffceba2834b7496e73ff5b4f21da6d5adf37adbff42e9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7a9ab1abcc27b21e8766e7e5062eba1d4fb362d7b2a71a10229346604c32a8d3
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9e30b4ca99c5e9f45bdbe3295e26b8bc5cf127606e5f4a24955a7cf35cd5972
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a77977fb7804dee57772db582c373a4e2ad17d85cdf2ceee2863050d2916fbee
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 08bedddbd00788fce3d72a8d615734625b7e9ecdb2c0142e11550b1a0f51b2cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6e606f2b70930a123ffb5e0d9e6a91e9b70f32aea5a55154e31afa6e173a2f93
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b1deeef577244e17d2068a5b025f4a40944d5c0b1db11960fc106600c0668541
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fd77ee9694b01285569ba177d32cfcaad643baee2c89ff400caedcf25ffef9d0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fb75ff20e91325dd0bbb6068da833c9212bc1c7bcf6ce90113106bb93d63cc8b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c3eda0610cc853c6d789164d5fca593916d355bd1947c66d9b23ed94f3b6830b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 441e4ac299a46b9909d02788e6737d15f4ba04263535a31758e7f19979c8d58a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44fbec97c90d8fbdc85c544f220f1ec0cd9257f8319dde4d4b24c30ae2691cfe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 11045a50b6926c70255fac31dae9e24bb040598eb1da376655546771157cfacb
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 9231f4296debdccdc21ee85a63bc39975e7f61423ebfaf25db9061cd8d9ea5a6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 56b879cd258ca6b9948e2a1f3e8d77dd3b48c81a4f81adfee8c4ffe4167e1096
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a3a3a1543e2f440f66de694f5ee47c362951b54e6a7ff6db9b6af3cc55d7fc91
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 531ff2924a54f70eb7d6470936b7cca5b14cfc84cbd8343e5cb61dd2c6c343c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a05cd417f44917b204f759093a2d6d964f8c60c44c48d2444edcf0a24b79080e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1ab8d4276a55327eb33180ad9631cc3490688ad08aa58a1794280c5ec49c215
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fda8d3d95135ac3719f85d6eb2947cdba5edf63472da19a4533ff02efd1102a6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6db58ca4cc6b81d1a31a6ad8d81fc5e8a80f5bcc37ffe0425ce3016ca846de3f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2acb5f9ac2eece1172902767bb81a8c7bce88d4aaa9f9b16664f754c85f2de17
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d48cc60511a87f12dd91db1ff84a2ecea80d4f07c40f1139ef8d1ad4b0c10331
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0d80168f5893a1e5154667a3f798a679ed86688a5ba441b675864f8397a2f66
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0a969af196eb35ca5b1a6bed9f3265219243a3264d0af5d886d89d34a3f9d654
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c81e946aa621dd5cbef4589a48e353318eeaa1acc9a79787dc3628c782f2445b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7ef03e5d56efecc5ae2d0311d8332c0382e5b4f02cf8e26ab04ee7d46d2de364
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b4c3a015900fc0da5c9b24bdfd3ef1f765dcc8abe26f8b2af05bf5538456ba0c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4a4797bba6217eb5d320ffba145dfe50592dddfbd3573d6a8d7bf5e4466425cd
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 64acafd67458fb39f7fdab3d8db57bb40e2f4dd58e85686fda7fe3320db0d162
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 44109789c802ffee335719bd360e48c6c09230b215d476e0ee59fa259672d576
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af5002ee612005ae90812b58a98afbeaf8836e43d3b37e4d2a0a63f50a12d514
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c9fa16fb47aedec1638891cb66fd015dfe07ba0f1440de24d4d084daf4547bc0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 818b8037f1d5810821fb9dae49c73aa9e854cd707c0cf402ce1da7cebbaf26d2
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 234fa2c68e89726a0048045e034bf0f88f71ecddee71949226d0aefaaa0baa49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 812781d95fc3e2986f4b04cf6807d983fb1c41178a58ada017efa8a5e7438a1c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8c1ccab48d9ce9f8a75efd630c0b579e1a3a9e5b5714183856e303346bf8bfc6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e1cf68076b323f5841b70022165acd89fdf51762c31bcf18fefb29f362987bae
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4c80e7966ddea040551781874fb5e4157c456a584eccb81376f6c0310670fb87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 fa2a93f3ddf67fb89d14f3999c097e1a8fe8dfd520f66302873fa3aa17b8c015
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 644c3e0afa180958a49c2f052cef4480d3f714964eb09deb8fb018b3cc0a1ec8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 47dc859bdd39a4a588a818e1818a10165c0e3f6717fa329ed6def1536340a3d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 654eb0d4c225d0dfe94d8f6fc32787dfe1616009ba6ad0bf42c7e6bba8b54f03
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 af23d07010cc419a2a3ec673878ef10bceb252e251fa489dfc34760ce64a1320
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 4089331ca0d928a66d51eb597e3a5e021971ebaed77935369415d1df580c9765
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 1168828aae84b1b91f7714226e08a49a06d091c3fd148d23b6ce6cf79bb0b5d1
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf28a42d3574524f7d84b5e873d8e9abb07b1fb06b0a74186288ee7221ea5180
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e0dccd4a9bbafc527ef4aa148b0cc2a8b60a8757e06075297d5d1bada09ea9c5
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6138833196a22617c758951682f07b610082f6818bb341b7c9281095b657699f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bab6fa4b3d132c61faafd5688fbc1f8fc3b87bb4afa09c7fe471bf56dba60350
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 cd523a60494019f2fe3f4e14668738a9eec2f067392c1a70c133589cd47b282f
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c901687f1e896d818c0c2db06c9e4a2f1bed555baede24785bb073cda926bc61
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a301d6a1f9dbcd60162e7c050a57e04cf0d80656c6fc54f60423bfe457fea8a6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ee688ced3a91c55c9b0b7d1b330aebf552ef57c74c0233e99a4f2ad090fedd49
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ea6ce5102146447f31cffd51f8209cc1f5dc36c2506a39c0942fa43def845297
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9ab88a1ce11749f9c6838a7669760f5a1b8e4ea1431d0138a869b392f21ae5a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f945d03849b25e435c5d13f84a7d73cca65d9fc4859357e2aca229ad5e72ff8
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c7e912b82eeee7b784b594da3cd6ee31c496904c541e50826b3096948d0c9277
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e995d03cc00c95b5625a5bd8622f565d50cf1649d330fa43d7da04b704637439
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 54140ab99b8aeb035f0887693313516cc2241ee1ea70af943eb106be6f505b05
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 26e309c5a6a02039916b3e3de2f814e95788172a70925a3110db302e41c35f32
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 22d89757827b229b2043c28a47e3df2d61893097829bf821668b4f861926fc86
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 3033894d585fd95543574c2c0c00bed12f5c2290bdea90e3feeb2278b08b923e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7407fef1542f35b6ae1c541bbb82198d8dec3cda3f43eb4177caa852f1f9594a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a99ad2b1391eb565326f22942def0f46c4c905ed29c3c274b371679bc7aa3a87
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b3b9ecc7920d2d3a424d507acc18aa35ce16251b786ff2d5465586eafaca6ea6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 21b7a567c9fc6dcfccb7df8281f69755cc6ad463e54d08a63dc622c8f15bb301
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 831ff1308383e07412c6f463f6f44736bc39b9205dba4add4ab1445afcd95604
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 d4ef175b4a9c0971412936787c15e07573fca02e1033dda4e74c3a7aacce503a
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f0882e1811dc83175b456cb0641b2f6137dd37f7ce1908f10ed129f9dc094e5d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e6e707433949bbca838df3fec01a1f61082dfc2890eaf03ebc0061850a8f2c23
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b56b81dbd78cd43a6e55d3865c5d27377009fe1708f50b233d532c39665221f4
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2052b8222a4120f817c1a11dc28c56c7df1e32c0e4468d05e35a0a1c9e95f768
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b0c15fef985b2b2bbd16f94f8cb5e47347d9189af117dbb821d5770cbcc09b80
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 f7e721fd8ae5c4e1f98708254b08603a86f13cfea002f305ac5aed0675ea8154
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c6e42264e1cb0b0edea9ca91a9b15ccd5ac915064acd35cfe459ed2380b02ebf
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 73601385e4350b539c3c1f28715dc2ace0d1bd3d14b0943b183670ec903ce6c9
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 c72ec27bdb70e2d5d2201b8d3d40465a80fcf8857602442cc896b6dd82c6fc07
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9e6c447b551fd6bc21265446e68794ebb52254ddf85ceca259f43c5d85b24fe
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 ab4c813be836080d675a7ac64e34a5413a4cf32f46b0fd6194b2c998b9a4c825
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0cbbcea46ee303a7c3914013e0dcd8e23763f35fbf290550efd838b821c50c80
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 6d84c60ef69bbbed8951b9fd6f140b700b799dd8e7692bc6c97c430404342db6
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2dcf376069c647cfa31b8005cec8ff3ac2a21d64d24ca059140892c52cf70a0d
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b7cac7e4453a2013da145ff7b0ee768c51e6e3dd008e7f4452268138b3a80a96
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 231c03071e8182abe41a78a0dc78943bed63091f947127cae73fc0ea10305213
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 5d9a9a664f4cf6d734166d7dde8a2d117746a15d5ba9985a43c0a42ed24d5b27
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 e82ef0d483d94665bf32cad62ee413c88f126aad5031d0135268505a3b5462ac
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 7e03f868b84355fbd001942c4404cd36297e9e25089da597e7a9b911602a2096
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 98c2675c46aeed69b549f1e2ce4043a641c72aeac3b57d1b2d83d9a2232f7192
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 dfce1be745561de054275a114884b5778a6dbc988a297c7b2a24babfb9e67b77
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 bf2a84964d0a4a94dbdc94686936a9dbb7d784c7cf7250bdad25f7e9fd2fa1af
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b6ffd0608b95b84dfba4846033707436af504a4921d3ecb733c97e0f55c02b70
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 a9843132b890ce0a6209845aa2f26ca7515fb1813b86dbe58b0c060d7baae489
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b174a162eefe9241b2784eb5e8a8bd4a470661253c6a54feff9df3f5bf98ab6c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0b46735157a408b2ca8d67c07efa31d741a52c837670e8213c4b7fa7c2dd9f3c
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8a78a435d6a51eeff99b7eb3c530efae0fc89e1560f3d72bbb7feebe5948d7a0
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 2bda30ba51f0113580fb422f5813e5adbd270c045ffa5fa829fbd629ab464d77
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 324869296631f98bad5e49679e403638a3088d6a4fb1461f8850999acd7f876b
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 8f5024ad7b7b6c5ae0534f7d7f51b5259441c1fc62494d5ab4c0771119f9b115
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 0677f57e3186d0a1faa3ce58fe94970843e1536b51f1949a99831a873af7c04e
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 b9b268217637bbee0a10b88e6702c4d201a3251ef084d1dc1713e340006d9340
              • MD5 SHA1 SHA512

              XxX.xXx

              • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
              • Size 8B
              • SHA256 aa865bedcde1190e015ad343cddded4f951212633a4fc692034e657376a146e6
              • MD5 SHA1 SHA512

              logs.dat

              • Path C:\Users\Admin\AppData\Roaming\logs.dat
              • Size 15B
              • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
              • MD5 SHA1 SHA512

              server.exe

              • Path C:\WINDOWS\SysWOW64\install\server.exe
              • Size 296KB
              • SHA256 caf153682beb2b2f8c63ff7108b0a25528dbaf6ae668cf8b3381a3cb05bede5c
              • MD5 SHA1 SHA512 SSDEEP

              memory/1008-5-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1008-2-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1008-4-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1008-147-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/1008-13-0x0000000024080000-0x00000000240E2000-memory.dmp

              memory/1008-10-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1008-9-0x0000000024010000-0x0000000024072000-memory.dmp

              memory/1008-6-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/2256-54-0x00000000002B0000-0x00000000006E3000-memory.dmp

              memory/2256-15-0x0000000000A10000-0x0000000000A11000-memory.dmp

              memory/2256-14-0x0000000000750000-0x0000000000751000-memory.dmp

              memory/3544-175-0x0000000000400000-0x0000000000457000-memory.dmp

              memory/3824-144-0x0000000024160000-0x00000000241C2000-memory.dmp

              memory/3824-181-0x0000000024160000-0x00000000241C2000-memory.dmp