Analysis

  • max time kernel
    150s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 15:21

General

  • Target
    cfd6bcae047aeb462acb0b20bb46d66d_JaffaCakes118.exe
  • Size 838KB
  • Sample240906-srns4stcmm
  • SHA256 23fac4121252079f0b431caed4bbf5351d5718456f577c79cd5229d6cb5b8928
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • cybergate

Version
  • 2.7 Final

Botnet
  • vítima

C2
  • 127.0.0.1:81

Mutex
  • ***MUTEX***

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_dir

    install

  • install_file

    server.exe

  • install_flag

    true

  • keylogger_enable_ftp

    false

  • message_box_caption

    texto da mensagem

  • message_box_title

    título da mensagem

  • password

    abcd1234

Signatures

  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cfd6bcae047aeb462acb0b20bb46d66d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cfd6bcae047aeb462acb0b20bb46d66d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2804
    • C:\Users\Admin\AppData\Local\Temp\cfd6bcae047aeb462acb0b20bb46d66d_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\cfd6bcae047aeb462acb0b20bb46d66d_JaffaCakes118.exe
      2⤵
      • Adds policy Run key to start application
      • Boot or Logon Autostart Execution: Active Setup
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3504
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
          PID:3388
        • C:\Users\Admin\AppData\Local\Temp\cfd6bcae047aeb462acb0b20bb46d66d_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\cfd6bcae047aeb462acb0b20bb46d66d_JaffaCakes118.exe"
          3⤵
          • Checks computer location settings
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2476
          • C:\dir\install\install\server.exe
            "C:\dir\install\install\server.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4348
            • C:\dir\install\install\server.exe
              C:\dir\install\install\server.exe
              5⤵
              • Executes dropped EXE
              PID:1884
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 532
                6⤵
                • Program crash
                PID:3764
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1884 -ip 1884
      1⤵
        PID:5072

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            UuU.uUu

            • Path C:\Users\Admin\AppData\Local\Temp\UuU.uUu
            • Size 8B
            • SHA256 5be58541b77a5d9e2bff46bfc28f5397ddb180e784baadfb2246034ba7e40536
            • MD5 SHA1 SHA512

            XX--XX--XX.txt

            • Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
            • Size 588KB
            • SHA256 150b73ae63bb41b1a65979e3d43030fc9643cc5c371ac7d8aca4cba5bc3a528f
            • MD5 SHA1 SHA512 SSDEEP

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c073c5556345cdea0b8ce0417f5860250e0fae4ea11819d37c5fbc0261f62995
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6eaa2f93e8d3ea314871c2227fb8408ec9aa0d3cd2a3dad413fa7851728d2139
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 028c9c8a72cb05911d77ed95478dc0c96d9a100216fe35818780d975041bbfe2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f4c0ec5333d6587fcdd7a7b8d0f4411fe106cffccdcf8b90219e4e698da5f50e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b240906ac662555d570db04fc65b184f762b9e62833d35b73042324a7e3fb7b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a5ca126164ad57dc0141ae240334180786f057218468e04f8775ce1633f65cc2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e9c91a146000460252ec1fbdeb574894cba91b6484414c80765acf893e33a34c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7260b37901d7c14e5669459aec545870843d23baf6928b7773622390ff5cb496
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d5a1666d439ee81c1868f9151a44fff95a2bd7c917d6e1c143b626db060b2c6e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d6fdaeedfe42b88be10bb71e6501b8e94ebad939fa733b5d3d222fe073d79f6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 368f611f943784ce067f3aba344e9b9c5eb9f393cc683dce20b107a404aff0af
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9e0ddb47f59fd1759e8cc22196f365449a9a922d1de00d612a928ad63243628f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9039fca25e2dbaac4911b2e6bcf4cf006458d93f9ad94d5a40e8bf5b1cd54449
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b79b4d0f9c15fca69503b942aaf5d0b7ab2c1936ddb24cd2f11be561d8503ced
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9cd0903ba64bdefd8c7ed01cbeba16d551b35311ca38415c3ae5d1e61c73fa0c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a053b76e189c623a2b5d86cb6f426d59a07ad6693f79572d631e7d7b1038ade
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d2eb2019ce02c046edd3bd4f3a9cd0c1d46d883d16147a59a73daefdced9451
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 759f055dd4f058745c8ccc9d96a909db8289735c901bfb0c782a9ffd5e69d994
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3edd78b0684492e75e0a0bfc41f7f84b792ccb9858e7637fb69458738b1bd908
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b819e96ed19be32819c9639c8cd10673a83ce83af84cbb2ac68e2b07400899ec
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1697a176bb447206e82af7991b504fc1f0a420b9d67e2cb0d94de9c789e46b3a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 269ebcacfa83091ed512b7dc4fe5434e4f4ce9f61f8127e5f59d6ca6b4ab90ad
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 664836ae7c6c45cceeb8c56aeb3daca7be66a07adc8388374b978254d255e1a0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 88ea3a9275b5da44e7d26219074c669064078270a32120b8d4cb862090c58ded
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 64b5c7bbf322d8a1fad522aaf4afd8ddfe8ac0866d583962af4832f13dda4e4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ab0e1d3bca40b1dc8a068247307e5024dd990a61b1df057e71ebc5a4b5319f0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c617041092278307ec87a0f88ba233217e64a77a5cd38fce9105233ae11ab24b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4d69be7360f8c8ba2d3b934decaeaf54970f9d3d1e1631cdbec6f914377053f1
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3f0b90cf5d1f67f6e83131c4a43f35b024427bbe88182124fbff76ef650e8c56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c58da3c01708660a2eb7bc7b9854e64a6fe8919c08ff41d453c69b1ab8858756
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea2717262e4daf9dc65631d0e87ee213ab7cded01432535aae82afb5ceb058b7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7d60573ac2f6077255de9f6009a3a30dec1815103e126e8a0229ef7491ab55da
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 3787d7a61689e5f22060796ebfd9b063c9a26965705cb3b93b68fc532b1c0582
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d184e92f570a8ac79e86e4fb8aa9624f59acb208557253a48feef40b4a348905
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a92d2964a3a5bbf724d1a07804e425bc741341e5b5dd4824366e0a67f93f5466
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e5c54f93bbf5505718e9601eb79cb462313e38be1bc41df6b8b403445403d389
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b23107ff4a7659aca715d9ad44edfd185fc9618a7e5809b28f4253363ef4113c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ff98fae8b8ba847acdc596d6b8a1f3290bca069f18e6a65eb620876fd4ebbac
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc6f5506f3fab76a0efd9ce0d77de057550ffec59ec65730021c9fd2d8e4e535
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e85eda7756eedc9c6abbc40b715815a642207856b963cdb314b961024c3a0893
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5a40c86a030c804111b2aba780631b00ac7c08278ac09e79889ef7922c2aeb03
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffb34ca66a1ae5dcb255c747c409de9237731b6b3b1b6f3fae6963d662c44707
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6005d0a534e9518b62174a8526b61eaaf6e1aed3b5a8d72e6859410fef80e442
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b76bd0a0804ec5cc19543ceaf9a12f7bfac480f94c70f01138282db7a3db36c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7eafbbe9d07199a0745fb45871ee7321fd975ebbb6640c13dd18a984d1209c89
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8bb049ed3da9e46c21150bc98c3503fb0029c7cc275552cbe096315790ae7e4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 00c8569695e020e69f380c50054a65e3449d79dca3f3cf41489ea73ce0888eb6
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aad5ea908afdd1909b9f6c7dd40962256e863c4fd55375834f50c6dae9e3c350
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1713bdd89ab60c13df4981cb77b5513ebaff77b25b3ed27ae0eef6c80856f74f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5b140aeec7f575749809be62ae5cc8bb2ac8ed5c477a67abf7a6e62c788651d5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 01588c672b103debba3ea1a264642e6756246dc00f18272cd71aab404cc2bb96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 de1d21afb91e3188877b709de61d18b4ec12fa8ac05af4a6e03da4f75ca51f8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 337714dac4808bd749abf225ae14003a06b3db9f10139099e506f621495d4e27
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ece17e33c3cf97e95374e1f4537c650784ac360499082fa3a03b740d099015b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5542cacb1a17839bb00a1fe0f9ec094b3cdb5088916890b4bbe5a3320814cf2c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 b1aa52e4e570626f45c3d21978baac5f2db994eb6ffc272a21ac1c39a0342daa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9d1f17d9c2a5f2b748e492fe9fcd9ffc321461120615a3f866630e4da831e19f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 10da2c3644591e6d6e53d3367888d8253b76084bb79bb891678fd853a1a540dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 148e701fcaff683aeb99c75ed1775dd7e1c797306aa5ac78104031f8bfa9be22
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 30ef603442981ffe800507b86340336442f32aa75cb75876c6d58944b103f359
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 074a86275c94939c09ea9f63f66c2ad4e67d4944ce514f85d275a0342280fcce
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7e124f94eaeaa6c0bc6fe33330ca80b21f71accd710b48147b2796f92f8dd8e4
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8fad9367401f95265cc6e41d3c2026669e54186c8dd3fe11d3ef0063e7d96349
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 274c6c69a54c92f6c0af4f0968ac4be5ac89a18a6477f1adda8f2b0a40f2353e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 d8aed9623c7e61b17dcb8ef98771b995f2dc6df0c2d5ee5b6fd594e9dac55e10
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 455b92fe632f9cddad401c25785cc0dc62b19b3b2921ba099066bed06f308792
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8aae157bbce74c42176c98fabc624c7e65db70575352b182256ad3d8e272ce9d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fc44fbef748f2d083db204de094b4f6e35c2844fec36a42a62dde9e59714302b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e92bc811caf7c1ddd8b36bf3c374865ef52aa932eb6237c149a7df246506101f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ec638e084fae0d17ce21f2bf0df0b29979b05639ab3fdbf8a0a10b159b2359fa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 359eb7defef47b7eaca98ac3c53f2032b7d6f27178e3b566e5b15623afca4bfe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a7c8322f77120fbc2652040c1acbebda794e22b5ed243b4824d855d19488d94a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ea40cc1d03954380a2a1730ac2ed68d40cff8b6ceadb366a8e592df9fade36db
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1f48b3080863f9aa416090338dae7ed4a3e6db0f4442a9e6e94e58b1d851bce0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 758f3f62cfd0c517150bc9ae15aacf72c109223b5c9bdd2cb08aba6e38bd1b96
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 bf62fbba82570adfb6e813fe8965bd91d03cda42fdf58b1ed8fb6d7c4bd60dc5
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 237129822a45516c7bb4dd6149d0ef3b39d2c2901992da7de42ca890e1d972b0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ee95279bc1ddf4a7a54b61b758c8b942dd81421feb612a29065ceee9bd775abf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 efdda355fedc6ca4737429a7cd2e911cf8e109afb512af6006bdd36ee38c4178
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6ec35e6647b536183b7e1a47e4161fc2e5290b868d249efedf643a9d92617185
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 8a316a29ce633edfe0c952435a0dc2a30d8425c6e80aed738ade59db57408bab
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 03356a37be545a72948557d87659c8ecf580d6589d72c21b03cb7ac3c3d26498
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ade745ff44c2e899fadbec64913717e1fb2b573db0777627ccce12fbc8ab2173
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 c5d431e4c208ade2984586b0c4d3250b0a26c5fac398b1bc4ab692f2aacc5f8c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 095fd7268b60a2920ea84d72092183eb075b15bb1da43d7056b9c2f2e1adfebe
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 be902fad3be10a1d83996a3ad1499dc4959d7cb804e80ea7df8c939532fae4ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 6c93b4fa7cd31e58578024a9402d80e4ad45cb3141802011f70c4e75445ac558
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 759b091d8dff52e2ef67afce7b17946fb15994edc495b69c3b98989ca8418647
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0ed41792f13b321d70e950e54acf005ce93dafca96239a894fea765df388d940
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cb00d482f307e6d1c569c2991c4362bcda7977c54c874a49ad7c7afa8ac7888a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 eb225bd8a3cfada6126da3d0abd78c6f99f1e1f07ea288cb9a79116f549ed1a7
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ed038ea03f8b8d232a8b306462015b946d950f13d44feba2d49619b7a5c243dd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aa58c2035b49c904da128fa7042adaa781f45aad1050d0bdae19ab863ff86d4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 151f4097c4a3e621d1a086844a85c6913c4d088c5f117cab38aaf9bf7f631f49
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 a392f7378f997053d08a84934cc4ea7d2f05608c0f12a642545d88fd9afedd97
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7b52958f607f5b53b506908634a9b5f53a71abb4d5004a12049f423633e8fdb0
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f27ecc378c1518fb1a3ba5a1b64e4f64c5d06eb7adddfb361cb04d748ee5041b
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 640ffb2a394327e258ed669108c153d7d79c43b5aca2796e6244f286bef12cbf
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7a95dba5392f51319e0ccd2a658433eb9637bcb484f7792e3c7515cc7585f189
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 2b3d9ea7b2829c7412349c80d9bae31453bbe788cfea80f5b51cd8f61a3f6be8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e4eb56bccef4cc76b5bf66baed23b259e7c9ce31f0eb0750319d5dfc42f12cae
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 42d7b94e335fedd3d1b17c0b5797c2bb75b9568436945ddab8531774ccda6a4c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 46f673651d885f331bacbd78f72a856b144f23808f9199ed4503c650eba6dc08
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 99cbd9f8d9816ad6bf19d26aa848fa980c6ab28f9df8c7e4176de4b4e3c62dbd
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 db15fbd22ade1845f969c2b3033123fc6edb224affade584cb2a13831a8dd465
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0b47df780f4462d45d6ca86e53ea250377536f0904651f4fe07a870ba099da68
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 cc5fed2cd70fc94e5f32b8390bebcb606d4abad77479648d2c474a2f5475a69d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 95fd6562cf9cb39e7b22138c415eed8947a37a9e09db1154d287abfe0d08330e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ca8e3bff18e2addfc1bd75442d7ce0316982d25a610155cb63c67c674d47cf6f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 1675863ba8eb65ac61c9238285c1a1cf91b6663bfc78ae3341bb9c241f1bf72f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 94b4331b86992c9c0b9a36e5aa85794e8cc63f1b018e51fd50327c09a75aed30
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 9b55ef718d3ce824e0bd4da734f0254119843b70bc5e272d0cf8d06f4a954f56
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f47818c3181bff3959f7f94dcf52a94f8c5ed4b1484eed04a19503684f99197a
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 f9252ddd27daafd5451444d72b72be7614341bcbba73e28303aa7484721a5207
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 47d6659fce297d14a058dc7da45193e17646da9d32d3b8a189bf4a48f0dc4185
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 374cbfe5ada49979a5f7102ee740ca98bb6368ea3594744f2f481654f7c38936
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 5d9ecbdeececd235250a218c67eeb122d58eb9b02325182dda1fa4a268eab4d8
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 55fd9e50b5969f02c95b1e8ea3e1200bc7aa911517d956b7fe3584369d3e587f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 24b48e3be9cc44da769b78e94c0a0d96f467031a6e07d265c1ca6084606b301e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 e7ce88a941f906cfbc1d393ccd589f6eaa882b71fe71b430e880aaf19e6bf13c
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 fa0fdb874f7f3a0fe1f85df7f2269c88fed10a973905a4eeba84a4216855f0a2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 aebf331a00193f5305a8e74b16901a2c465580051cd55bf0237648e162cc88ba
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ae0ea17ee445b4b39acc9a3f7e7ed2aef3202c7bb8fb66c47eee6d448eea736f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 881e2328e0fb763e788474ad9a0f54fb0bd70afbfc9beea1b9fc902d742ec9be
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4df91ee490c13ddf487c1c20ad445a336043dcf2f8d5bb1850ed00c84a3051b2
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 4ae0fa4d03e472b4c4704a5c5514d17d630403a750c67adedf4d96cb1451797e
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 079d1472b04b9d66fd437e04ad3b286e108b4b450afc309a2dbe72d3216e1c91
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 7957c3b1664ead6139e98e4f7eacb3ffb5c0996fded26f3fb4820c793d769cfa
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 71269e2717e87610a685b407bd4feb45fac40776ab23384b1cce641dd966ee8f
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 ffc9ec63a5e9828a66cdffc8b0086e39dc6798b83328a1651531a03123ac4ed3
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 28580b9f73ab3449edc4296be66e83edf9d8ba5ddb9d7dbab1fddd7dd3165b0d
            • MD5 SHA1 SHA512

            XxX.xXx

            • Path C:\Users\Admin\AppData\Local\Temp\XxX.xXx
            • Size 8B
            • SHA256 0e3fd7e798fc272d0a118cb5e2d01a7a18738c1940a64f42ad3eb417b463b548
            • MD5 SHA1 SHA512

            logs.dat

            • Path C:\Users\Admin\AppData\Roaming\logs.dat
            • Size 15B
            • SHA256 4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d
            • MD5 SHA1 SHA512

            server.exe

            • Path C:\dir\install\install\server.exe
            • Size 838KB
            • SHA256 23fac4121252079f0b431caed4bbf5351d5718456f577c79cd5229d6cb5b8928
            • MD5 SHA1 SHA512 SSDEEP

            memory/2476-74-0x00000000001E0000-0x00000000001E1000-memory.dmp

            memory/2476-78-0x0000000000400000-0x0000000000514000-memory.dmp

            memory/2476-75-0x0000000000680000-0x0000000000681000-memory.dmp

            memory/2804-9-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-57-0x00000000006F0000-0x00000000006F1000-memory.dmp

            memory/2804-34-0x00000000006E0000-0x00000000006E1000-memory.dmp

            memory/2804-35-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

            memory/2804-36-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

            memory/2804-37-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

            memory/2804-38-0x0000000002D00000-0x0000000002D01000-memory.dmp

            memory/2804-59-0x0000000003100000-0x0000000003101000-memory.dmp

            memory/2804-60-0x0000000003110000-0x0000000003111000-memory.dmp

            memory/2804-41-0x0000000002C10000-0x0000000002C11000-memory.dmp

            memory/2804-33-0x0000000000640000-0x0000000000641000-memory.dmp

            memory/2804-30-0x0000000002360000-0x0000000002361000-memory.dmp

            memory/2804-28-0x0000000000400000-0x0000000000514000-memory.dmp

            memory/2804-3-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-2-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-4-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-5-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-6-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-8-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-0-0x0000000000400000-0x0000000000514000-memory.dmp

            memory/2804-10-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-1-0x0000000002370000-0x0000000002372000-memory.dmp

            memory/2804-7-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-63-0x0000000000400000-0x0000000000514000-memory.dmp

            memory/2804-21-0x0000000002C10000-0x0000000002C11000-memory.dmp

            memory/2804-24-0x0000000002C10000-0x0000000002C11000-memory.dmp

            memory/2804-39-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-40-0x0000000002D20000-0x0000000002D21000-memory.dmp

            memory/2804-42-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-23-0x0000000002C10000-0x0000000002C11000-memory.dmp

            memory/2804-43-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-44-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-22-0x0000000002C10000-0x0000000002C11000-memory.dmp

            memory/2804-58-0x00000000030F0000-0x00000000030F1000-memory.dmp

            memory/2804-32-0x0000000002380000-0x0000000002381000-memory.dmp

            memory/2804-56-0x00000000030D0000-0x00000000030D1000-memory.dmp

            memory/2804-55-0x00000000030E0000-0x00000000030E1000-memory.dmp

            memory/2804-54-0x00000000030C0000-0x00000000030C1000-memory.dmp

            memory/2804-53-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-52-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-51-0x0000000002D10000-0x0000000002D11000-memory.dmp

            memory/2804-11-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-12-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-13-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-27-0x0000000002C10000-0x0000000002C11000-memory.dmp

            memory/2804-14-0x0000000002C10000-0x0000000002C11000-memory.dmp

            memory/2804-25-0x0000000002C10000-0x0000000002C11000-memory.dmp

            memory/2804-26-0x00000000006F0000-0x00000000006F1000-memory.dmp

            memory/2804-15-0x0000000002C10000-0x0000000002C11000-memory.dmp

            memory/2804-50-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-49-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-48-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-47-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-46-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-45-0x0000000002C20000-0x0000000002C21000-memory.dmp

            memory/2804-16-0x0000000002C10000-0x0000000002C11000-memory.dmp

            memory/2804-17-0x0000000002C10000-0x0000000002C11000-memory.dmp

            memory/2804-18-0x0000000002C10000-0x0000000002C11000-memory.dmp

            memory/2804-19-0x0000000002C10000-0x0000000002C11000-memory.dmp

            memory/2804-20-0x0000000002C10000-0x0000000002C11000-memory.dmp

            memory/3504-67-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/3504-73-0x0000000010470000-0x00000000104CC000-memory.dmp

            memory/3504-66-0x0000000010410000-0x000000001046C000-memory.dmp

            memory/3504-62-0x0000000000400000-0x00000000004AA000-memory.dmp

            memory/3504-61-0x0000000000400000-0x00000000004AA000-memory.dmp

            memory/4348-774-0x0000000000400000-0x0000000000514000-memory.dmp