Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/08/2024, 14:05

General

  • Target
    c8f862e3a3559a5a31c268c918730f53_JaffaCakes118.exe
  • Size 676KB
  • Sample240829-rdvh3avgra
  • SHA256 9ef7449c02ffe1c007bb8dd0523f1a8d3fd523e2ccd4c42edf8554e020540088
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.6

Botnet
  • vítima

C2
  • birkan99.no-ip.biz:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

  • regkey_hkcu

    HKCU

  • regkey_hklm

    HKLM

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c8f862e3a3559a5a31c268c918730f53_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c8f862e3a3559a5a31c268c918730f53_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Users\Admin\AppData\Local\Temp\c8f862e3a3559a5a31c268c918730f53_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3456
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:1400
        • C:\Users\Admin\AppData\Local\Temp\c8f862e3a3559a5a31c268c918730f53_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\c8f862e3a3559a5a31c268c918730f53_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2832
          • C:\Windows\SysWOW64\install\server.exe
            "C:\Windows\system32\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4972
            • C:\Windows\SysWOW64\install\server.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2776
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 564
                6⤵
                • Program crash
                PID:4156
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2776 -ip 2776
      1⤵
        PID:2628

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 95d76203c3f6d2efe72a9d0cef1aee52225ed5e15eab3b294f89286d2e593aa0
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 229KB
            • SHA256 56dbd9c757e55897ecfefe65a60c19072c32d3921f2df71abf158d93fa1346fb
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d5a3696f8a67a6096764f5818168c6bb3ff8c5e296b2a03b497062c28978dc6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 452f66149edfaf331dfc80996590fbd605ca30913b40bab7f9035a8b2616618b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3e49ac20ba1d0b28e519ccb0d0b82f89911b3c13a6c36d7ce2f96335dc2441b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6dc1c129c0e2e1bcd50ee41c7e3d593d44a213eb19ad0eb2839fa08f897da4a3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eeaedc81df59443b5cc6d017d039e516cf9b27ab778bc61759517ab49b038e79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b20d393d11229627eccea67fe01474394af1db33b19259e7b9e5a49f69872a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 391df0ace9e6a35a65b57489ffa38d3fe2e696a66ec6c11e8b8ef380f0c60af9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 adb69819751f3453e30edb3d00d5e7fd1ba96c947c050b012dcd82451bdb8068
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 83f69a0b1e56f42a5d44244a966c82ccf73cd9d4cab01ada1dea982fab1e2f02
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2f856b8c8bb39de4ad8b659c49e4e23f7f4ce220e3df0fb5bb3ab457904c4189
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f06cf9664ff17d9da6412d2b6c6b6c3824800518797dd174f2e5a0ddb379f6c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2075330f17b16c7016308476704e9cf0f7bb1891cedc6f30758b8547bff0d508
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a7af1704fe99e982b7d95f98075efbe436b1594c56fa02f09832585a1c31f79
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e234d1ae657e62bbcf18a9675bb6899d0fd35e33c346c4d20fda7cbfed6f9108
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bb8dd9dff8c768e7426e33ca64bcb07609221bcb66dce624dca03349ec2227ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 930968d849fd0806c967af603e2e7554956a469313028c0433962dd99b75b87b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47eff7e6163764f8101cd91ff6d8b1574ca8ca67eb72a4fbc5f8c7b4804b335d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b10c6cd1a4a90e12cb2eb6267e89f57131f6c872d0c63d3dd822f47fcfa4ddd7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e35e6993f38e6a448c5fa158d78340ed092cb37a982fa14ed56ad02ada0369f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2aefe7c2229baebfbc98404cb25f84832160340961e399da8f4bccdcaf072e77
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dbc128ba4d5b077367e4fb3af2a0a69f8210078868e4a37028e82b63aeadf751
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33444ff0ece63d29d2b53a8fa7f0169f99f3226f0b1f4edb6d9c71cbedc78c63
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0865f6178a2e1cb0aff9d5f4d9177e5719ec900409470c8d85ee2d2da3ab30b8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 181eac4bb2ddc90c2a1d004c92d9e3b7ee44ec995b2cd2587aad896222d0dc58
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9be4f379865ce714a65d2f838b3ad831086ba0a3433b12b5adc15b1a644216ae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8280868cc16e941e4dd7756ab5deb02eae72e7cb4525484fc72085a189e66c29
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 19ec7d9ebcd93ee8564c2ca821e51501b974c64e343e97dce0b3bff9fef5b885
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f8f2466ad4d090a02ea9fc0f47efb272419c65c4425a3f8e829d694c61fa8e6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ebc31e3eb264d64f6d13ffbc346754b96d030c1d46bfb04a33ed986f3ab9a8cf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d734605d392afff5497f094caa3d6554730e0575f7621d99583a7f7581f53b55
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46042a792a809b60c9875f99bc6f6e13fe7f66105103bde66c8b4096c0049a72
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9caa5429b4152f9090382eb05f49e837aae1bfa1900a64ee5e601732e564e6ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 35b3806e3d577860ed61e32b7b1bcedcf12e23574d5056471ddd20d9d6bab417
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84fdcddb5cc4f97e30b0d38ebf7943fb68227438b494d0806bfd1beb67538b41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8ea6298f43bdeb8d643dc1d42a009e2edb42ffb0086dc1da94999895c38e815c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8037bea14674c8aea47cc4553a0e589e01bf1e155346da2894996ac268c2c6a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bbf91670351a50f467b07e0ffbb904b5cda149a9f0c7c642e5964b0701a48dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 25eef4a4e0603334b2e70bb8ff817116eefe08e92a64f3a2087b32fcf7cde79b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a1940c8351c042dc967628939bb2e658e6266178c6470640228048506fb0a5a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 351aa7bcf87b2dd5e4e15de43593d4091f0c6159239682a543f94aa0e4cf5f09
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 82bddc59da5957bcb8792297f62ef136ce240f4ad3bdb1b1e917f5b89e6cb56b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c341aad67dda5861dfdffe00731e3482e391ac626cf396d4786e9b1d4a254830
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 dba965bf37fa7573bddc38a6cc4d8eef1bad1345057913218a73a28c74b2c2dc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be42195ebdb03469f9c1c369e916b0cab9c0dffc11a36053b4320bc796fda11e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64fbee58d2f14cc1818329f6da75ec52fbfb75b26d3c47adbb5a8bce8e4799bc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e03ff62a509f55d3ee44f9b0b7debfde53651bb8ffe50c25651804139223ca8a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5cadcaca0de50dbef173197857fb9636175df8bd1cb304a85332599d0aca497c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97eea9fd4fd2a04449e31c0e9207fce8bc8b333e6e60db6148b79faeee98602e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1bf285d98d97ff632718005299f13f55ccbb1ff8c0fbbe6492003a031db355b6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e884afdb14f65231d798c90e00b399e59d5014254cfff0d54a7002afa2c41e4d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 315481d0841138a39d878a1c055926da38a2c17e7a850705de5033afbe003970
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 751234aaafcf508c45a16af662a370349104b87d3a5721f66b6eae61676157f2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 77e278868de62461448adaf3b5a36105539effc8786f1f924dd975506bd4545d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a07f5d4af913de51899cdde2d6a27ef348c6e50d9cfe8c8b208389f87668bda8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de5f8b79544fd3fe13263a69da31f841419b0cac17323915f9123ea061da5bc3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d88bec28d4a19cfb3cecd346b2d85cc09c260a241a47896e8e548a92cf377ac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3864fe198d82c99f83d753ba100301b8493aa26080add903ecaf7ff45882cff0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2411c45901c36ef8a5886b27f6f1837ee38885fdf38ab7041956a2199da806c9
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f3815892231b627eda5a590c3775bd997220e20519850bd90edf54fd0896f4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f833c307620b0577669f644ae1840488fa9f3dcc37071044b941ed541395ae45
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3e874df6d94ad016e49487c6ed0c2451eacb1c673b967f4755d5054f43c8b0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3d3f09469834b156964ba9b5c13a64419eeb41c29b826b7925d1d8b390418110
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a8c8c94cfc1957476b6b035fdf8d82159eae6b6dffb46db723c9b6460e4bb04c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d512fdfd2fc7eb4b5f3b300e3b9f4d501bf18287a93b000f4661990c32f15f6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 350589e231ad070bfaa54457d47f2569adf6c0548bf04fd92f84a8e124a214a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4fa74342e33bcfe234fb2164b66c8246eb48c180d281ab7d32b03d8d2673e56b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ddcd704076cd18eb1587b514a1903886a975b5b02715bf73cb95ff17ff1d85f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 064ff6b9d4a63de2edd200b5c13febb99bed6642df586094f93fd0a2e2f4f5ca
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 62bfd85ce3d1cbf0b52ce014ba39df2dfe7bbf7df7047fe91c09b2191d3fb47f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 38bef82fd093f9d7864242b91342c8b85fea77c8d291638ee5b912ec1919499f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 382fea354bfcc712154f0da2882ce13a85a9322c765d36e9e2eb82c2eb51d845
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a454f39e7c7b12d6f0a6b908756252ecae194f4f4531838a1113d478d170af28
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d61f8c7c576833f7636e57d06fd7f5e755248fbd792746a2e6f09b11014d636b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a3ebf921fe03a19fd0cb981f4e6b760a9b97fe32ba47af7d2c9dc9ce56b5eb44
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3dbffe37204a0126ddf7eaf5f6312cc744b83fa5a0f7d420107588cdbf752be0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 33ab96141c0d9bdc77d7be031da463e90eca30d4ac34e3b405876ae26a7fd21b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 513671df598e7e52cfb848b201326334478fe487dd73159f510c54b5f3b49153
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b5ee3e07cca571755cfa5e4867d2ae30ba983f60faa9ff65de80b394232e7bfd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3ade59a62f8a45671dc503565fb033e7cd8a385f29bf969f61d7b8d2ba290278
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b3d399c7bb246dc455f9ceced238ee57f397d6a26d6e45f5be9acde89ec18b41
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 af2c7ee83f29474f8a648d62aa85d4c242b33dcff9b46d6325b815002d1b07ab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f3b3de7abfd7a1c35aa93a8f2e8ed733d20e73f89f22dff612ecc484232d0934
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b02b3918032dc52e115856d752ad2724a33295421fb562b4d24e7a202cb5e765
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d2a85c4f1428cd02a89e95f42ab6dbc8c60c8714c1465559f77f4632f0b14a87
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5373da4670f9134f573cb71bd1220e81b6e708e84bb2638cf8ee8b84fd079135
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f6a54b2b86045c6cd10c79443687d26def90dee19635d3dc08803dd9faba8991
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 909eb7fb6d260242466e18ac5b160e607af64cfe8c0b64d8da51744d79dd7af6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c3abd7e91ba20e19bc2a475eec1d134a2b5dddf1be2e19cf27507470cab05905
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3cbd82d1aa9d52d08b1b3d9fcda47e460868b6278f8dee027f0c35d2e20fda38
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b9b47cdf6e10ef646f0d937166af6aa322d028673643eeaa91700e7f140d9dc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6b822f7bd5ce7bc07ba1497d87b3b418db29bf5ac9d9f3baa43dbf9aeda7f86d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b8001333a68148e358fef8c341d2a80d35125276f8eb050ec58047b13b94fcc4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1d27c45699bf3449f98f09fd018584665a611b06b32e59587f3917c689cc26fc
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 811b5618fa3ca43016ca932a6fda779d52f48ba0c58af1cf641a2ae33ebdb9c6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 abddc7806086514a0d31fe68a8711e08a4eaa6a1edf2df0d736050fadbd59f10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8cd5286903a38d0c805563cf3c0d9f524881499c5f41a2f3917c89e400363e37
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 12ff4e7f19b69e6af1ab681188ddaaf36723ce6d14c9474ba903bdbb541cdc67
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bec3835b1136d3aab1b12d5780053971d794ca08a495f01f61895602be618ca1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea521cb23c08d8d8d88aa21680ee51c7383dd7bb6b43bbcb25c2ec89330e7d6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e621ac2b6886f4dde87da5a127f5769eb71cfcc028a0cfb195dddb0d9d7f61be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 292b802f202ea4de47892068974d0f7614ee7673b44e9b2cb6ccb6a697575215
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca0849075254b745b01f912a5daa376af7f49d194b9138553dd63aaebd457263
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5682e52ef4c31debccea46f5bf378f2a8fc03fca5aafb6dc8409a9640bfdecbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff4413405f15ce6a0fbf5983df58654ad655cb60a12c3d64c5b0e52027fbc037
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2063f2e4f4c5f19b577f6e1bad4850bb58af76e25ff15e7883371d8b0a4e2030
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b21b71b4ab50ed9463fd825ed57d13f62da94fbc50243a12036bbdb88c65a6bd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 11e674d4ddb28600d048846f43efb4372b3e14d1df7da4ed6d391762b74e89df
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ff4ad7cbd140dc0ed8243d27aa4806d9dc41a8cd5f9dedd95f9439eb94e8f896
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2a1c9483e2e203d287f28359d46af60fd264d6f51b592962601baa967cfbfeab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d90518b60ba4af5cb5ea6bd341480051162656aa939036c32754f113d7eb6317
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 770fdbd7803f4607ee410b02a3ac2ddad68a6ab922642af9b51ba792f0f73f2b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d544fc6c7036697ad205de6b8074ac98091b3f0bcce982f55bbbaf696f79a7e7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 341b1f926c860886f752ad6c7761236e002998669c11bc2e5b00a45e898bff0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 20d738a6b68ac2057975a4903136d4d96f2d742318d3d2174f9f72bd4992b94a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 866efb744d7d6b4eee51dd50d4a49c02219ad20344e22f946519b26757f2073e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 97b5b7d455d3f3d9bdf62806a0c05cc2dbe6e718ba1c87d07420a854c215dc4b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1c6b0c67ec048a1d3ff043de1c228a86b02174955dc53ff7d0f400caf00a18e3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3276d410c57cdf0bb231a3f9b18bc2844a7294a992935bb5b5f9050ca4a0b473
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4f59ff24695e1dc121cad787b4dfe772dab1efdf8da2ec21a655bc9cd8c11368
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b55217e9eb962711f81ec4155371c6eebc3f308a207c13b22675a8c144d4abab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 928882b1e7f7b96510aadc056bc8f45c6190f8f2552fb22f7ecf0660e04e318f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a90fd7272b2dcc99bad050f71d44758b4d4aa7f5a75ddf93864a4735854357a1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2dca0730c8e78b771404c4aa15529a1d91ea8fee17ac105892aaf583126c0150
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a52f780c998cc463bf19029012442e9a8f284afa92401c84e2b0eed3130ef9fd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fe218fb4b547c30e5a3ca80d1bab96164124f0a286a43df6998f19915967e5a6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 202bedd8dc2648c8ea28d2bdae628b10b45947ea7a9c672efb88339a21e4ed66
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6fc0e0725dfff2bbe86a31093ec3148789f0a80bbadf45872dfcbad82ac90b5c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8dbf74d838fc21032f4bf6875a1eac383fa055a48b8b13504ffbe4b5ce878cc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 84cd55fd2cc3c091cd3fe8829e288fd5984a103aac396b27c579cba83b40fd50
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e0370d3a2283b70d451b1fe9741bbc05dc596a58652ffeb0aed31358823b9742
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 df4332f9280d1b656e470c00d6fdcb4917bdc823f2ff33dad42ad5074f240244
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5e7d18ccc0a24f8222f3595ffa7a5f996692ebdc513e04e29a667b96995ac458
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0d3c21fe6f60fee2db84baefdba6d4d9f4bea26e7086198bdfbc304b73bf8edb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 823ad9f7d4475cbce891e1e77142ec6c66ac47eadf5a58f0cc7b2524b9d39d4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 515565ebb93114951d602180db39e4cb44386e79c59799f00c22390a939b66bb
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 347ec7a1f65c21fa80f1ebc4a82321c12bacb28edbe2a1c5455ecf62942e4b3e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 141057d1723aa4bd2d731df80eceee9505cc3ed6a4c3fc7b5765c80abc2c053c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bc87c93fbc3a8c57e3dced8c33f390369463d50ea5d7e4c20df15b1abcfa851d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be1aac798d5f13fc92907c7f1f36d022c0e4d4e200ee90f2d6536bac99da7737
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 730914f1d5ec183265a94332980b97d28a7172e922b41a76bbe93e2104911bc7
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\Windows\SysWOW64\install\server.exe
            • Size 676KB
            • SHA256 9ef7449c02ffe1c007bb8dd0523f1a8d3fd523e2ccd4c42edf8554e020540088
            • MD5 SHA1 SHA512 SSDEEP

            memory/2776-113-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2776-110-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/2832-18-0x0000000000400000-0x0000000000466000-memory.dmp

            memory/2832-15-0x00000000005D0000-0x00000000005D1000-memory.dmp

            memory/2832-14-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/3456-6-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3456-4-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3456-5-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3456-9-0x0000000024010000-0x0000000024072000-memory.dmp

            memory/3456-13-0x0000000024080000-0x00000000240E2000-memory.dmp

            memory/3456-2-0x0000000000400000-0x0000000000457000-memory.dmp

            memory/3456-78-0x0000000000400000-0x0000000000457000-memory.dmp